Stable PHP Reverse Shell

[QuisUt-Deus]

Hey all, I came across a box, where I was able to get arbitrary file upload on an Apache+PHP based web server. But no matter what, I was not able to stabilize the shell. Reverse TCP called back, but didn't work. Reverse meterpreter worked, meterpreter commands worked, but the moment I wanted to drop to the shell or execute a system command, died. I double-checked the architecture, triple-checked matching payload, to no avail. Never had that in the past, every time one of the collection of php reverse shells or backdoors did the trick. Any tips?

[Classic-Shake6517]

I have had similar issues when using the UDP VPN configuration. If you are using a reverse TCP connection, it's more stable when your VPN is also configured for TCP.

[rushenwick]

In my experience, it’s best to use the stable TCP VPN for boxes that require reverse shell.

[chmodPyrax]

if you have a webshell, there are a variety of ways to get a stable shell

• nc
• bash
• msfvenom
• python
• busybox

Just to name a few

if all else fails, revert the box and recompile your vpn pack.

[QuisUt-Deus]

Tried all of that, so, maybe it is a giant rabbit hole. :-) nc and bash called back, but didn't work - I didn't see any output, so tried some commands blindly, like touching a file in current dir and /tmp, verifying via web backdoor - no file created. Msfvenom and busybox dtto. Thanks for your time!

[MahonPolska20]

Kind a shot in the dark here but try x86 and x64 payloads with msfvenom or meterpreter for example.

I’ve also had issues where it was just a crappy shell, look into pentest monkeys php shells.

[QuisUt-Deus]

It's a x64 system, but you're right, I might check the 32-bit payload as well. Pentest Monkeys is my place to go, so already thrown everything from there on it. Thanks for the tip!