OK, so we've covered command injection, but you can combine this vulnerability with other tools as
well.
For example, in the last video we managed to establish connection using netiquette and command, addiction
and vulnerability.
But we can improve this by injecting a different payload, such as an interpreter shell or a reverse
shell that we coded in Python.
The process of doing that is the same.
So I will show you how to send an interpreter payload to the target and make it execute with command
injection.
Why would we want to do this?
Well, we always want to have the best payload possible.
So why would we use Netcare when Mr. Peter gives us a lot more useful options to run on the target system?
And to do all of that here, the steps that we must perform, we must first create the payload appropriate
for our target, then we must download that payload to our target machine with the help of command injection
motability.
And at last, we must execute that payload also with the help of command injection vulnerability.
So sounds pretty simple, right?
Let's figure out what payload we should create first.
So to create payload, we need to figure out what do we know about our target?
Well, we know that Anticipatable is a Linux 32 bit machine so we can create a Linux Metropia their
payload.
But for this case, I like Python payload a lot better.
So let's create a python method.
Better shell.
Great thing about Linux systems is it comes default with Python, so Python payload is something that
we can execute on our target without them having to install any additional software.
Let's create it real quick so we'll never get to my desktop directory.
And here I will type MSF one on dash B and double specified that we want to create Python interpreter
slash reverse DCP.
The host is going to be our IP address, so let's check it out real quick.
It is funny to the one that one that nine copied and pasted right here for the outport, we can use
Port six thousand, for example, and we are going to output this to arrows into Testor, that P y.
And I just named the payload tester, but feel free to name it.
Anything that you want.
I will press enter here and this will create our python payload.
Let me go right here over this, and while this is creating make sure that your purpose it is started
up, also make sure that your intercept is turned off and start up your Firefox and your anticipatable
virtual machine.
OK, so once you do that here in just a few seconds, our payload should be done.
And here it is now that we got a payload created, we must figure out how can we deliver it to the target
system?
Of course we will do that using the command injection, but even then, the target must be able to download
our payload from somewhere.
Right.
For this, we're going to use Apache Web server and host our payload.
Their Apache comes with clinics already so we can make it run real quick.
To do that, we must first type pseudo and then service Apache to start.
It will ask us for the password.
We input the password and this will start our Apache to Web server.
What does this mean?
Well, this means that any file that is hosted inside of the HTML directory in our clinics will be hosted
on our Web page to anyone that visits our IP address.
Let's first of all, visit that directory, see if it goes for w w w html type here.
And we got the text from some previous video which we can delete straight away, and this might require
food privileges.
So let us just enter through the accounts to the you and let's delete this shell data.
And now our directory is empty, so no files are being hosted on our web server.
Let's copy our Testor, which in my case is in my home directory, Mr. Hacker and Desktop Tester that
PBI and we want to copy it inside of our W, W, W and HTML.
And now, if we were to go to our clinics machine and visit the IP address of my clinics, which is
192, that 168 ad funded nine, we are going to see this page that has this file available to download.
Great.
All we are left to do right now is to execute this file on target system.
Let's go to our command ejection page on our metastable.
And to do that, we visit the IP address on Anticipatable Navigate.
To do all of this, we already know let us enter username and password and go to the command injection.
But before we do that, change the security level to either low or medium.
Once we do that inside of the command ejection, we can execute the commands as from the previous video.
So if I type right here when I do that, once you see that one, that one and dot and comma and then
else after it, it will ping the IP address and it will also print out the contents of that directory.
But we don't want to ping every time we can just type dot and comma, which will specify that we want
to enter a next command and we can just type callouses after it.
And this will just give us an output of the command and we will have to wait for the command to finish.
Now let's download our payload using W get command and W get is something that you can run from a terminal
in order to download a specific file from the page or link that you specify.
Let me show you inside of terminal first.
So right now I'm inside of the slash home slash Mr. Hacker directory and I don't have the tester pie
right here, but if I run the command w get in then one to the 168 at one that nine, which is the IP
address of clinics and then testor that pie with this link.
We are accessing this page right here and this file right here, which will tell our terminal that we
want to download that file.
If I press enter it will download Tester the API and if I type Altez once again.
Now we have tested that pivo inside of our home and Mr. Hacker directory.
We want to do the same thing on our target machine, so to do that, we can use DOT comment to specify
the next comment and type the same comment w get one or two of the 168 at nine slash tester dot by.
I press submit.
And if I run the last comment once again, now we have one additional file, which is our Paillot.
So it is there it is on the target machine right now with the help of command injection.
The last step we have to do is to set up a listener inside the MSF council.
Let's do that real quick and I have to set up a listener.
We must execute our payload.
And here is the massive console we are already familiar with setting up of the listener.
We are going to use exploit multi handler and we need to set the payload to be python interpreter,
reverse underscore TCP.
If I show options, all we want to do is set the host and outport and that will be the IP address of
clinics and the airport will be six thousand.
The same options that you specified inside of MSF.
Then I will run this and all we are left to do right now is to execute this test to the DPI with the
help of command injection.
So let's see how we can do that.
If I type dot and comma and python tester dot p press enter.
This page will load and these are good news because that would most likely mean that we got the interpreter
shall opened with the help of Pilton.
We executed our Python program on the target machine and it opened our Metropia shell where we can execute
various commands.
As usual, we can run help command to see what else we can execute and we can basically perform post
expectation that we already covered.
Great.
So this is just another way that you can use command ejection to your advantage to spawn a better payload
than just the simple Netcare command execution.
So you can try to test this with our python payload if you want.
Great, now that we cover the command injection vulnerability in the next video, we are going to go
into cross site scripting vulnerability.
See you there.