---
description: April 29, 2024
---

# Laudanum, One Webshell to Rule Them All

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FxS2Q30O9SD8rAU3n7eiN%2Fimage.png?alt=media&#x26;token=4c22658a-5a65-4ae5-a041-8b97589c13f1" alt=""><figcaption></figcaption></figure>

```
ls /usr/share/laudanum
```

First I try to see the webpage of the ip

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FIy41OOFBhaRoDbtYhxRW%2Fimage.png?alt=media&#x26;token=21495733-1b5c-4990-8cee-7d5b013f4c8f" alt=""><figcaption></figcaption></figure>

Then i add the IP and domain name in the /etc/hosts

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FGXn3N510y5twwW7klHDR%2Fimage.png?alt=media&#x26;token=5cbdd17e-5dc9-468d-ab57-6f1c9121a542" alt=""><figcaption></figcaption></figure>

I just use whatweb to see some details about the site

```
whatweb
```

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FqbHGFQQFa7qne48qti8H%2Fimage.png?alt=media&#x26;token=e9ceb9ff-1cf7-4233-9019-091ad5bff6be" alt=""><figcaption></figcaption></figure>

After that i just copy the shell.aspx from the laudanum directory to current directory

```
cp /usr/share/laudanum/aspx/shell.aspx ./shell.aspx
```

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FTxlj68OfLwwfoyYKoNfv%2Fimage.png?alt=media&#x26;token=87a5c73a-aeab-4775-b02a-2995ed5b2476" alt=""><figcaption></figcaption></figure>

I just add the ip of attacker&#x20;

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FxN9UQLr2iyNOlb4716Vk%2Fimage.png?alt=media&#x26;token=d0733d7a-7527-4eeb-bbe3-f05ea81faa65" alt=""><figcaption></figcaption></figure>

Upload the fileee

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2F5IiayStXpll75OJvMTeP%2Fimage.png?alt=media&#x26;token=518c5f39-537c-4f96-af36-4945ebaf4207" alt=""><figcaption></figcaption></figure>

Access the filee

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FXbln4FqdEpw5rDrguuXY%2Fimage.png?alt=media&#x26;token=e548df72-0853-44ee-8b68-0994db3df141" alt=""><figcaption></figcaption></figure>

Use dir to see the current path

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FWQZ8nHrqfSIPETWx10si%2Fimage.png?alt=media&#x26;token=11875694-dd02-4af0-a65d-8a9344d4b151" alt=""><figcaption></figcaption></figure>

Then for the second answer just use locate

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2F8velYvqJhLAOfzDw42rG%2Fimage.png?alt=media&#x26;token=fcd022fb-3551-43eb-a0b6-71a20252462e" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2F4Zeop9XrClpvDiQGNkdO%2Fimage.png?alt=media&#x26;token=8b417db7-7441-4804-bfa5-e00663063774" alt=""><figcaption></figcaption></figure>
