Let's say I am pentesting a Windows webserver and somehow get a PHP shell. Now, the owner of the Apache server is not System, so I want to elevate privileges somehow. I try to run a binary file in the target machine, containing a meterpreter payload, which I compiled from the C code:
// Our Meterpreter code goes here
unsigned char payload[]="<shellcode>";
// Push Meterpreter into memory
int main(void) { ((void (*)())payload)();}
Where <shellcode> refers to the code obtained from msfvenom to initiate a meterpreter bind tcp handler on the target machine, which will listen for incoming connections.
But as I try to run this binary file, I notice that I don't have enough privileges to run it, and there is no folder in the server from where I can run it. So then I notice the server has Perl installed and I wonder, if I run a script in Perl which behaves the same way as the compiled C code I tried to execute, would it be possible to create the backdoor directly from the script?
So my main question here is: is there any way to emulate the cast ((void (*)()) in Perl to push the payload into memory?
