Welcome back everybody.
And let start off by the command dejection now in the previous video I told you a little bit about the
command ejection.
But let us actually get the practical uh method of using that attack.
So the command ejection well as I said some web applications can use parts of their operating system
to do something as and as I gave the example for example pinging now usually the command injection itself
will run the command on the same server but depending on the architecture of the server itself it can
also execute the command on another server as well.
Now what I mean by that is let's say the same example as before which is the pinging the machine.
So you go to the website which basically pings the machine.
Let me just actually try to find that Web site so I will turn the BRB suit on our open another terminal
for me and at this actually try to find the legit Web site that pings another machine or another Web
site I believe there are lots of them online.
So we will just find one of them.
So let me just turn on the Richard
and while this is turning on.
Let me enlarge this terminal.
OK.
So this is with this.
Let us just turn off the intercept and once we turn off the intercept let us go to the Firefox so let
us just try to search for the simple pinging Web site.
Maybe that will work maybe it won't.
I just want to show you that those Web sites do exist
now.
Our Firefox is a little bit slow because of the groups it so let us just wait for it for a few seconds
or maybe it's better free pink test to ping your server or website.
So we just click on the first link.
And let us see what kind of Web site this is as we can see here is the web server name.
So this is the type of web site I was talking about.
So basically here you just put your web server name and it will being your server in order to check
if it is online or not.
Now what I was talking is that if for example this Web site was vulnerable to the command injection
we could possibly run any command that we can run in our own terminal.
Also right here and it will process the command in the servers terminal but also it can send the command
to another server and we could actually execute this command to the to another server as well so let
us start off with a Web site that we can actually test.
You shouldn't be testing any developed any of these Web sites you'd not own.
So even if this one is vulnerable which I doubt it's enforced first and probably one of the most famous
ones it probably isn't more vulnerable to the command ejection.
But we will use our Web site that is vulnerable to the command ejection so actually I don't know why
I closed Firefox.
We need to go visit our virtual machine which is our always bashing.
Let me just check the I.P. address of it should be not one but nine.
No it's not six.
OK.
Let us go one night to that 168 that found that six
now.
Once you are here what you want to do is go to the Dan vulnerable application I believe we did not go
here before.
So just click on this.
Now what this will ask you is the username and password.
Now you can just type here the user name and password which is admin admin.
But let us actually try to practice some of the uh one of the attacks that we covered before.
And one of those attacks is the Hydra.
So let us actually brute force this a log in page.
It is a good practice as we did cover this before.
So what we want to do is open our terminal and we will do it fast.
I won't cover any of the any of the syntax since I covered in it in previous videos.
You can check that out if you want to.
What we basically want to do is type Hydra and the syntax is similar.
So as in the previous videos.
So we type the IP address we are posting the form so HDP form post which now before I type this section.
Let me just show you.
I do have the same files as before which is the user not to extend passwords or to 60.
So we will use the same lists as in the previous video.
So let us start again.
We type here the the IP address and then the platform.
So HDP form post and then we specify the link.
Now in order for us to check out the link let us go right here and we can see that the link in the the
path is TVA log in that Peachtree.
So let us copy that and let us paste it right here.
So once we do that we want to specify the user name and password.
And we want to say to click on the Submit button and we want to specify a string that it will give a
for every incorrect log in.
Now in order for us to see what string it could give let us just type here something random and see
what it gives us is an error.
So it keeps us log in fail.
So we will use this string in order to specify the correct from the incorrect log in credentials.
So now that we want right now what we want to do is inspect element.
So let us inspect the element in order to find out the name of the user name and the name of the password
log form.
Now what I mean by that.
Let me just show you as we can see form action log in the PSP method POST we click here on arrow down
field sets in order to find out and we.
Here we can see a label for user user name the name for user name the name for this field is user name
which is most likely always going to be something like that or user or something like that.
So we will cover this and we divide these two we did two dots.
So you type your user name equals the upper arrow then user the upper.
Another arrow they sign.
Let me make this larger so you can see the entire command OK.
So then after that we want to see what is the name of the password field which is probably going to
be the password.
Name password.
So the named password field is password.
So we specify right here.
Password equals again a.
Pass upper arrow.
And then we want to specify the log in button which is called Log in as we can see right here.
So as we can see the submit we should type here which type here submit equals logging or logging equals
submit since name of the button itself is logging.
And the action is submit.
So let us just type that log in equals submit and then we specify another two dots which means to divide
these sections and we specify the string that we get.
Once we provide from user name and password which is log in field so to just copy it is pasted right
here close our apostrophe and then specify the lists and the list of usernames and the list of passwords.
So capital L users at 60 and then capital P S 4 so quickly and let this run it should find the password
and username which is admin admin let us just see right here.
And as we can see it finished and it found one way available user name and one available password.
Now if you wanted to you could just type here and skip this part.
It is good always to have a good practice of something that you learned in the previous videos.
So we do not want to say this.
Let's just call this and once we are here what we want to do is we want to go to the command execution
part so click on the command execution part and you will see the similar website as the one we visited
before which is the pink for free.
So basically just type here as it says the IP address and it will ping it.
Now we can try it.
Let us ping my router since it is online of course I wouldn't be able to access the Internet if it wasn't.
And we can see the pinging results so it performed three ping scans and we can see that it received
three packets.
So that's good.
But let's say for example you were uh.
You think that this is vulnerable possibly for the command execution and you try a simple command which
is 192 that 168 that wanted one where we specify our router IP address and we type here to just find
where is it on my keyboard.
The DOT and the comma in order to divide these two commands and we type here for example.
Who am I.
And we did cover this command to give the key account on the terminal on this web server.
If it is vulnerable to the command execution so we submit that and we can see that it executed the pings
can.
And it also gave us the output who is running on that server which basically tells us that this server
is vulnerable to the command injection.
We were able to execute the command on the server that isn't only the pinging command now we will continue.
I will continue to show you how to actually exploit this.
Now for now we just ran a simple command in order to find out whether it's vulnerable or not.
And in the next video I will show you how to exploit this and make that server connect to our own machine.
So that's about it for this lecture.
We'll continue the next one and I hope I see you there.
By.