Web Penetration Testing with Kali Linux - Third Edition

Exploitation using Metasploit

Launch the Metasploit console from Terminal (msfconsole). You need to select the apache_mod_cgi_bash_env_exec exploit under exploit/multi/http:

use exploit/multi/http/apache_mod_cgi_bash_env_exec  

Then you need to define the remote host and target URI value using the set command. You also need to select the reverse_tcp payload that will make the web server connect to the attacker's machine. This can be found by navigating to linux | x86 | meterpreter.

Make sure that the localhost (SRVHOST) and local port (SRVPORT) values are correct. You can set these and other values using the set command:

set SRVHOST 0.0.0.0
set SRVPORT 8080  

Using the 0.0.0.0 host, the server will listen through all of the network interfaces ...