Hello everyone and welcome back to possibility of my land.
Ethical Hacking course in this part we're going to look at code execution vulnerabilities so open up
your column Linux machine and also open up your meet disputable to server.
Now let me just reboot this to open so we go.
Typing I have config on your meter splitsville server copy the IPA m sorry the IRS address and go back
to the copy machine and connect to it.
So citing the previous video we connected to it just type the IP address of your meta replaceable machine
and you should see something like this then go on DV w way and lock in.
So it's atonement for the username and password for the password.
So then we need to go to security change it from high to low because we're still on low.
Like I said once we progressed throughout this course will change it to high or medium than high.
Good to command execution and this is what we're going to try and pin test now this is a vulnerable
web app so it already has the vulnerabilities within it.
But typically some websites might have something like this some genuine Web sites out there may have
a feature like this so it could be it may not be like ping or an IP address but it could be like lookup
an IP address or find the IP address of a Web site.
So if we open up a terminal window now I'm using Terminator.
You can use terminal and if you type ping and then type an IP address now or you in fact you can type
in a Web site you are out.
So I'm going to type Facebook dot com click into and as you can say it pings.
So essentially what it's doing is it's just pinging the server to make sure it's life on if it gets
a connection back signal back then it's it basically receives a pocket as you can see here.
This is the IP address of Facebook seven.
This might be different for you because it depends on your location in the world.
This is the closest one to me.
So that's why it's 31 13 19 38 for me.
But essentially the servers live Facebook is Facebook is live so it's it's online but that is essentially
what this web application is doing it's execute like terminal commands.
So if we type an IP address in now it says enter an IP address so we're not going to a Web site because
when you're using Web sites essentially a DNS domain name services what translates an IP address into
a euro that is readable so like Facebook dot com because without it would have to remember the IP addresses
of every single different Web site.
It would get annoying because you know you can't just type in the name.
But anyway let's just enter an IP address.
No I'm going to enter an IP address that is my IP address of my copy machine and enter any IP address
she wants but I'm just going to add to my wants so I'm going to type I have config and just copy my
IP address and paste it right in there and then click submit
and then we go.
So they executed with the command it looks normal it's ping dates don't matter exactly what it says
it will do.
And we've got a packets received so it pings it three times make sure it's live which my computer is
and then it receives the packets.
So yeah it works the web applications fine but there is a major vulnerability within this.
So when I talk about shells and I'm going to be talking about them quite often now a shell with a Web
site or a server.
Think of it like gaining access to the directory.
So if you're a developer or a worker on a massive server and for example even a Google employee for
example Shelly could you uses SS H.
Now that's very secure because it has your own private keys.
Maybe you'd get help before then you should be familiar with it.
If you have if you've been employed to work on a project then you'll all use SS each to connect to the
directory of the project and then you can all make changes to it.
And SS H is just a gateway to being able to connect to that project.
Think of it like a way of accessing the files.
So a shell you probably use them before.
The best one like I said is get help going to have a look.
Ghetto by the way is just a Web site where you can upload code and there is SS each on the ball.
We can use something called a reverse shell which is basically the opposite a shell.
Think of the shell we are trying to connect or gain access to the server.
Once that Shell is being created and connected successfully then we have access but a reverse Shell
is basically listening for a connection and telling the server to connect to our attacking computer
whereas the shell is just a server listening for a connection from our computer.
That's why shells are so dangerous because if the server does connect to our listening computer then
we have access to the director of the server.
So let's start off with a basic command.
So if you type TWD as you can see that tells us where we are currently in the directory or in the terminal.
So in the root directory so if I type alas that's where exactly where we are.
But let's go back to this command.
This web app type in your IP address again this time at the end of the IP address at a semicolon then
put a space and then type WD P WD while I've just shown you.
And if you click submit you can say pings the IP address again which it should do but then it also executes
the p WD command.
So if you can see here.
Var Toby Toby w DV Toby Ray vulnerabilities and then X in execute so that's currently where this is
stored and that's correct because if you look up here you can see DV W.A. vulnerabilities E X you see.
So we know that commands work because it says it right up there and we already know where in this directory.
But this is where we can create more of a shell because it's actually execute commands.
So the safe is reading these two separate commands and it's executing the first one which is ping the
IP address which it does and then it's also executed the PDB D but this is where we can actually put
our reverse shell into this.
So if it goes to the link in the description for my website you can get this text file and essentially
these are all reverse shells you can all use you can use each one of these one pen testing a server.
So if you're an employee to pen test them then you can find out what the server is running so if it's
Linux then you could use bash you can use pel Python page or Ruby it doesn't really matter.
So typically Linux systems like Kelly Linux or just Linux itself or fedora they typically use bash pythons
also used on most servers.
Page Pate I know Facebook uses peach but not so much.
Oh not many different Web sites use P2P anymore.
There's also Ruby which has gotten quite popular.
And then there's net cat
so what we're going to use is now net cost is quite popular as well.
So we're going to use Net cat for this example open up a terminal window.
I'm just going to take clear to get rid of a lot.
I'm going to actually just listen out for a connection now because remember instead of reverse shell
it's always listening for a connection from the safe and not the other way round.
So we're going to listen for connection using that cut.
Now this is I think that this is like using me to split when you listen for a connection when you type
exploit say you use a payload of reverse TGP and you type exploit and listen for connection.
That is what we're essentially doing care but we're going to use that cat instead.
So always use that cut when using these reverse shells because if you use like meat's disposable then
you have to use the specific payload and say use the bash script.
So you create a bash script Save this script inside of it and then create the meta deployable listener
for connection.
The only problem with that is then that the file will have to be executed on the server and obviously
you can't do that remotely.
So we're going to look at ways of around sort of that sort of thing later on in the course when it gets
a little bit more complicated but for now we're just going to use a simple net cut script.
So type NC for that cat then hyphen v v for outputs then hyphen Al hyphen P for the port.
So we'll listen on the port eighty eight.
Click and send as you can see it says listening on any 88.
So it's listening for connection from back from the server and because we know we can execute commands
on this.
What we can do is if we just open this text document though like I said the link in the description
for this just click on it and download it or copy it into a new tax documents.
I want to copy this and paste this here gonna remove all of this and then type the IP address in apologies
and when to remove that because that's an IP address of an old device I've still got on this.
So remove that.
Basically what it says IP of attacking machine that we IP address of your colleague the machine will
go.
So I'm just going to type it here.
So it's 1 9 2 1 6.
I don't want to end up 1 2 way to believe.
Let me just check.
I've already forgot the IP address of this.
I know that many different IP addresses.
I completely forgot.
0 1 3 1 so 1 3 1 There we go.
So essential what we're doing here is we're executing this rebase shell to make the server listen out
for connection.
Sorry not listening for connection.
Try to make a connection with our computer that's listening for connection but we can't just add this
in and click submit because we need to enter an IP address.
So we need to just enter an IP address knowing when to enter the same IP address it could be actually
in the IP address here.
But just just for the sake of it I'm just going to add hours or my won't.
This is the IP just to kind of machine as well.
And then I'm going to type a semicolon.
So now it's going to execute this command and then also.
Are a shell.
So if I took some mis look at our terminal it's listening for connection there we go.
We got connected to from unknown.
Now it doesn't say anything else and it just starts blinking.
The cursor starts blinking.
So it looks like it's still nothing even though it says it's we've got a connection oh we've a shell
is connected but we can take command.
So p WD as you can see we're inside the directory we can go back to the VAR WW DV w way less.
And there we go.
So now we're back to our index page.
People got full access to Web sites.
We can upload files or delete them type help we can find out so commands so you can upload files.
Let's try and find something.
So there's the PDB today anyway and that's what we used to test a holy.
All the commands or the useful ones will be in the description
but essentially we've got access here.
So we're on Linux.
And basically that's it.
So we've used our reverse shell we've got access to server.
We can do whatever we like to and there's some extra commands here.
Let's have a look.
This kill we can kill.
These are just basically blocks commands.
But like I said there'll be an inscription.
So I think we'll leave it there.
I don't want to go on too long for this video but that's the general idea.
Hopefully understand a little bit more of what a shell is now uninvolved you got to mention up with
these you can use any one of these with the neck cut.
So when you type and listen for connection from a server using the net cut which is this it's just a
short version of net constancy.
But you can use any one of these depending on what the server is using.
So if you think back to when we started this Web up pen testing and we looked at technologies used and
we looked at my Web site used as BHP so obviously them would look at pen testing with the page piece
script so hopefully you get the idea of what you can do with this course.
I'm going to leave this video here.
Just remember that you can use any one of these with the neck cut.
And this here is separate from this.
So this command here I'm going to add this to the script as well and I'm going to put to listen for
connection.
Use that.
So you can change the port but leave everything else the same.
This just using neck cut.
And this is also a neck truck neck cut reverse shell.
This is a ruby reverse show page piece so I could of use the for example and copy and paste that in.
I just want to mention that because I don't want any confusion because when I first learned that I thought
you could only use the net cut with the neck cut listening but you can't say if I executed it that would
also get a connection but you got the idea.
So I'm going to leave it there.
If this video did help please leave like comments if you stuck with anything I'll be happy to help subscribe
for feature content and I will see well in the next video.