Hello everyone and welcome back to part 24 of my learned ethical hacking course in this.
We're going to look at the upload download execute how to edit files and also a few directory commands.
So Leading on from the following video or following on from the following video we talked about the
directory commands.
And once you've got your payload execute on their computer and essentially have hacked their computer
then it stores it in a location on the computer see drive in a random directory so if I type Alice this
is where the payload is currently stored.
As you can see back toward the exit.
And this is the target computer so let's imagine they've opened this.
We've basically unleashed a payload on their system and we've taken it over.
So now we've got an attempted secession we can execute commands on their computer such as see their
web webcam.
But what happens if you want to explore the computer's hard drive and the way it's set up.
So what I mean by that is so you can see files you could see maybe even private information.
You got the idea.
But as you can see right now we're currently in the C drive.
The users are using the app data and then local.
And it's a random directory.
This is no good to us because we obviously can't see any files.
The only file we can actually see inside this directory is our payload so that's useless.
But what we can get from this which is quite useful is that we already know we're in the C drive so
the C drivers where the users are stored.
So that's a good bit of information now.
This could be the f drive.
It could be the G drive.
It doesn't really matter.
So I guess you can find the user's profile or the user's directory then inside users we already know
now that there's a user called a user.
So that's useful information to know.
So if you type C D you should be familiar with this from the previous video but you type C D and we
want to go straight to the C drive.
So just straight to the C drive what you do is you type C colon and then two slashes so it's important
to remember that when changing drives.
So say that have five different drives and drive G drive a drive etc. Then when changing drives you
need to add two backslash as if I just had to one.
It wouldn't work.
So you definitely need to click enter.
Nothing will happen but it will change the directory because if you type less to list everything as
you can see now we're listing everything in the C drive so we can see program files.
So we could go inside that if you wanted and delete the whole system.
But the most important part here is users.
So we want to go inside the users and because we already know that there's a user called user will go
to their desktop.
So there's a few different ways you can actually go about this.
And it's important to know.
So if you type C D to go into a different directory and then just type users you notice we don't need
any forward slash box lashes or anything like that you can just click enter and it will take you straight
there.
So we're moving forward in directories.
So you have a starting point and you go into a lot of folder another folder and another folder the a
c d Come on where you don't need any backslash is the only time you do need them is when going from
one folder say like right at the start to the last folder if that makes sense.
So think about going from the C drive straight to the user's desktop.
So I'll just show you this way first.
So now we're inside the user so you can list everything inside the user's folder and we know we already
know that piece of information that I use exists so we'll go Inside the folder.
So to do so you just type C Are you user click enter now.
Kim it's not case sensitive so as a matter as you can see they used to lowercase you but it doesn't
matter because of a type alert so you can see now where and so the user's directory
so we can see this person's desktop now they might have many different users but in this case this let's
just pretend this is the main user.
So now we can go to their desktop because we couldn't see here.
So you need to do is type seedy desktop press tab and sometimes it also completes before you click answer
and we'll go straight to the desktop.
Now we can list everything on the desktop and I didn't have much but as you can see they've got secret
files.
So this is a folder with secret files.
So this is just for demonstration purposes only.
Obviously as you can see I've created this folder on the target computer.
But you wouldn't be able to see everything on their desktop from their computer because obviously not
using their computer if that makes sense you can't just click on their file explorer and have a look
at their directories.
The only window you've got is this.
So when you've got your target computer set off this is a good way to land.
How did the directory set up because now you know they've got Secret Files folder you wouldn't know
this or otherwise from the very start.
So now we can go inside the secret files folder and this is important because I've noticed this is got
a space in between a so there's a few things you need to do differently.
You only need to include two speech marks around the name of the folder to be able to enter it because
this base is actor as a character.
So you need to come see for them with wildcards.
So let's say we want to go inside the secret folders or secret files folder so you type CDE and then
you need to add a double quote type the name with the space and then close double quote.
So it's just two double quotes around the name of the folder click enter.
Give it a second and then you can type less.
So now everything's listed inside here so you can see there's a text file called blank.
So this could be useful information to have.
Now we can go onto the upload download and execute a professor I want to show the other method of the
directory because it's important to.
So we already know that we can go straight into this folder so to speed or you can just copy this and
say you type seething go back to the C drive.
So now we go all the way back to the C drive again on the back slashes.
There we go.
So straight back to the C drive again but we already know this directory exists because we've already
been there but we'll just copy and paste it for speed.
But if you remember from the start it said that you're going from one folder to the last folder so you're
skipping directories.
This is the only point where you need to include double backslash as you can see there's one in between
each one here.
So you need to add to it's the only difference so it depends which method you prefer.
Obviously you need to know the directories to be able to do this one.
It's like a shortcut because you go from one folder right to another within their system but you need
to know the directories and the only way you can do that is by going through each one individually type
and C.D. then the name then go on through it like.
So this is just for speed.
So if we want to get straight to the user.
Oh you would need to do is type up to there and you will get straight into the users folder.
Well we already know that secret files exist where inside the C drive and you click and to give it a
few seconds Oh apologies I forgot to add the double quotes.
So you need to just add the double quotes around the file with the space in between.
So this essentially is for spaces symbols et cetera.
Now I don't think symbols are allowed but it's spaces now because not every folder is going to have
just one word.
So it's important to remember the double quotes.
So quick answer again apologies about the click in fact type Ellis was straight back in the Secret Files
folder.
So it's important to remember when jumping directories you need to add double slashes and when going
through them individually to find out where directories and folders are you can just type C.D. desktop
C.D. uses C D or C drive C.D. uses C D the users accounts then see the desktop like we done in the beginning
but now we can just jump directories if you know them.
So from the start here go back up I could just jump straight into the users folder because I already
knew it exists.
The user by copying and adding to back slashes and typing CDE at the start.
Exactly like it on down here.
Except we went straight into the secret files so it's important to know that just remember them certain
things.
But now we've got this bank text.
So let's get on with actually uploading download and executing.
So if you wanted to read this folder is it.
Sorry this tax document type cut than the name of it.
With the extension kick cancer as you can see it basically dumps everything inside the tax documents
so account number 6 9 6 9 6 9 password my secret password and pin.
So we go to our target computer.
We open this folder as you can see everything corresponds so you can read files without them knowing
it doesn't open the tax documents or anything on their computer either.
So that's how to read a file say we wanted to upload something to this directory.
Now the same thing applies again with uploading downloading and executing.
So because we're already inside this directory.
Similarly with C.D. just desktop users without any backslash is the same thing works with upload.
So let's see if I've got any files that we can upload to their computer so let's just click on.
Let's see what I can use here.
I'll just click on resources.
Go to home.
Let's see what I can upload right.
I'll upload this picture.
So this is a screenshot of the webcam from my live hacking demonstration so I'll just upload this picture
into the secret files folder so they won't even know that it's been uploaded to them.
So you just need to tape upload and this is because we're already inside the directory of the secret
files so there's no need for any backlashes.
However if you were in C drive and you wanted to upload this file directly to the secret files then
you would need the backslash as it is exactly the same here.
We wanted it to basically go directly to the same secret files folder so upload in the name of the files
to picked up J pack and you can just click enter
there we go to upload it.
So if you go to our in fact we can type Alice and as you can see now this picked out JPEG.
So we go to our target computer and openness as you can see now picked out JPEG as being uploaded and
they wouldn't even notice.
So that's how to upload files.
Now it can be up to any file sorts of thing it can be.
Application PDA.
Just make sure you type the right extension.
If you were in the C drive so I'll show an example just to make sure you understand because this can
be a little bit confusing at first but let's go back to the C drives a C D we'll go back to the C drive
sorry.
There we go.
Click enter.
Now we're back on the C drive just to prove we are but will appear one on the C drive.
So let's say we wanted to upload the pic again but we need to rename it because it's already there so
I'll rename this to pic to Judge J pack and I'll copy this directory again in fact I will copy.
Whereas in this one because it's already got the double quotes on it.
So say we're in the C drives who are folders behind think these are just folders and you go through
one folder to the next to the next to the end but where in the first folder and we want to upload it
to one that's right at the end.
So we're skipping loads of folders if you think about it because we're skipping the users folder.
The actual user's account folder then the desktop and then that folder and upload it within that one.
So when the C drive you type upload and then I'm going to piece tuxedo command and remove the C D and
then you need to type click to dodge a peg or whatever your file is called Search j peg.
So UPLOAD PIC to Doc j peg.
And now we need the C then we need the actual double slashes between each folder then because obviously
secret files it's space need to add the double quotes.
The differences obviously appear when I just typed upload and picked JPEG is because we were already
inside this directory.
But in this case down here were not.
So as you can see the same thing as X with a just and directories and the same thing works for uploading
click onto give it a second.
David guy was so bloated so let's go back to this directory put looks and type either click enter type
allies and there we go.
This pick just pick one that was the first image we uploaded through the just the simple command.
So may I prefer to use C D all the time and what I mean by that is this one up here because when uploading
and downloading files it makes it so much easier and you already understand the directory so I wouldn't
worry too much about understanding which bit is it.
All of this but it's just a short course essentially.
I prefer to do the very first thing we on which is to go through it step by step makes it much easier.
Like so if you don't understand it just go through a few more times it does it.
The more you go through it and practice the easier it becomes.
So then we go have uploaded.
So let's me.
Let's say we want to download this banked text so what you type is you just type download because we're
already in the directory.
We don't need to tape any backslash as it's just so much easier just like bank or text download banked
of text click onto so we're essentially just copying and downloading to our local directory our local
server their secret information is banked or text so you can download actually any file on the desktop
as long as you know the directory of it and you're inside the folder which it is in.
So there could be PDX in there could be multiple folders or files on the desktop just make sure you
in the right directory when clicking download.
Like I said before if you're in the C drive and you want to download something that's on a user's desktop
then you would need to include the double quotes between each one.
But this isn't very common because not many people will know the directory.
Like I said download banked or text so it downloaded it.
Let's see if we can find it.
There we go.
Get it all downloaded files will go into your home directory and as you can see we've got a new bank
text file double click and there we go.
So we just downloaded it from the computer.
So that's the download.
We've got the upload.
Next is the execute so all we need to do is execute their CND.
Now it doesn't matter where you are in the directories.
I'm just going to go back to the desktop.
So I'm just going to type C. They go to the C drive and go straight back to their desktop.
So I built a user because I already understand how it works so that directories are set up search the
strings of the desktop.
So they go straight into the desktop.
It's a good idea to use both of these methods together for speed.
Like I've just shown you it's very easy to move around now.
So we're in the desktop and all you need to do is type execution.
It's important to note that you can type hyphen hate next to the command.
Sorry spell it properly and you get a help guide.
So the same thing will work for upload and download.
I'd say this is only important execute though because you need to execute a few additional commands
with such as capital H and I.
So you can see what I actually do so we interact with the process.
After creating it and we also create a hidden from view.
So this only works with applications so let's say we want to execute the CMT she types execute CMT vaccine
make sure you out the extension to execute the CMT and we want to hire different views so they don't
know it's actually running on their computer because if you don't type half and hate each it will actually
open open us a window on their computer and that's not a good idea because then we'll see CMT is opened
and it looks a bit suspicious and we also want to interact with it.
So if you type hyphen H with a capital hate in the hive and I click onto
keep spelling it wrong for some reason I will go click enter oh sorry you need a hyphen f at the start
it just shows you how long I've used this command in so it's executed hyphen f CMG dot the XY hyphen
H hyphen Hi circular cancer there we go we've executed the command so now we're basically using the
C M.D. and as you can see we're inside the directory and it looks exactly like Sam D what essentially
is TMJ but now we're using it not terminal window so you can type alas again you can take D I are sorry
desire to list the directory and this is exactly the same I've CMT will work and they will not know
that we're using their CMT because there's no window open because we included hyphen Hage
so let's see what we can do here so we're already on the desktop because when we open the CMT or executed
it we were already in the user's desktop from up here as you can see so not one in the desktop so we
don't need to fill with the directories anymore so let's say we want to go back into the secret files
so we'll see these in secret files again and what we'll do is even though if you do the execute will
edit a file to see these secret files we're inside here now so we should have banked or taxed let's
say we want to edit this bank to text or in fact will create a text file.
So this is creating a file now.
So what you do is you want to type echo and then you need double quote and then type what the text should
be included in the file.
So this in this case it's going to be a text file so whatever you type in between the double quotes
is what will appear in the text file.
Hello.
I have being created with CMT
terminal.
I don't know just anything with Carly.
And then you want to end with the double quote.
The reason I'm typing all these symbols wrong is because the keyboards American.
So I need to change the settings within Carly Lennox.
But let's just change this.
You need a space between the last letter.
There we go.
So it's essentially echo then a space with the double code then space again type what you want inside
the text file and then just at the end what you need is a space again then a.
Well I think it's a great alarm.
I think it's a greater than sign.
I'm not too sure though let me just try.
There we go yeah.
Is.
So it's Grace it on and then you need the name of the final.
So it's let's just call this hack the text.
Now this could be quite scary to people because there will be files to be created on a computer without
them even knowing.
So it's echo.
Hello I've been creating it same day.
There we go click enter.
There we go it's echo day back out and being created.
Now you can only use the echo command within this CMT terminal not the meta exploits so that's important
to note.
So if you go to our target computer secret files those are pictures on these hacked text Hello I've
been created with CND on terminal Kali and there's the double quotes.
So there's many different things you can do with this.
They are the most common or the most powerful commands I think within this meta space.
You want to exit out of the C.M. determinant you just type exit.
Then we're back to mature proto type alas we're on the desktop again.
So you can do multiple different things now you could download the whole Secret Files folder if you
wanted but you get the idea.
So I think that'll be it for this part.
Apologies about it being very long but it's important to know this.
It's got to really understand and useful.
So I'll leave it there for now.
Please subscribe.
Leave a comment if you stuck with anything.
I'll be happy to help subscribe for future content and I will see you all in the next video.