Kali Linux Web Penetration Testing Cookbook - Second Edition

How it works...

Our first move after gaining access to command execution through a web-shell was to use that command execution capability to upload a more advanced shell to the host so we could try privilege escalation exploits.

First, we prepared a metasploit payload using msfvenom and set up its handler. Then we used PowerShell and its Invoke-Expression (IEX) command. This takes a string and executes it as a script; the string we gave it as parameter was the contents of a file stored in our server that was downloaded using the WebClient object and its DownloadString function. This way, the contents of the remote file were passed directly to be executed by IEX without them being stored on the disk. This prevents the action of most antiviruses, ...