How to upload php shell on website

When we hack a web server, we usually want to be able to control it in order to download files or further exploit it. There are many websites that let you upload files such as avatar pictures that don't take the proper security measures. In this series, I will be showing you how to gain root access to such a web server.

For part 1, we will be trying to upload a PHP file that allows us to control the system.

Requirements

We are going to need Nmap for this part of the tutorial.

Step 1: Scan the Server

For this tutorial, I have setup a vulnerable server on my network. Let's scan it.

Nmap found two open ports: 80 and 22, so we know that the server has both HTTP and SSH services. At this point, we could use Hydra to crack the root password on SSH, but that is not the point of this tutorial. Let's visit the webpage...

Step 2: Upload Attempt

Let's view the upload page...

The form tells us that the file must be either a .jpeg, a .jpg, or a .png file. But, just in case, we'll try to upload a malicious PHP file.

Darn it. It doesn't upload. But what if we add our malicious code to the Exif data of a picture file?

Step 3: Backdooring an Image

In order to upload our shell, we need to use a legitimate picture file. In order to get our code to run, we need to add the PHP code to the Exif data. Enter this command:

exiftool -Comment="