Hello everybody.
Welcome back.
And let us continue with exploiting our command execution more ability.
So in the previous video we basically tried out this Web server by typing in our IP address and then
typing in another comment to see if it will execute it.
Now you divide two terminal commands with dot and comma.
I can assure you that it works in your terminal as well.
So if you type here I have config.
And then dot comma and then who am I.
It will basically print out the config output and also it will print the whole my output.
So you can do a bunch of the commands like that.
So I have config.
Who am I.
And it will print out all of these commands with their output as we can see.
So now that we know that we need to find the best way to use this vulnerability in order for us to gain
access to that machine so let us try out to see for example if we type one end to the 160 that one that
one and then for example you name minus K let's see if it will execute that and as we can see it does
execute it.
It gives us the version of Linux and the name as we can see always BW A I now know that we know that
we need to we can certainly do better than this.
And then just gathering information.
Command by command we can actually try to make a connection with this machine to our own machine.
Now in order for us to do that we will use a tool called Net cat.
Now net cat is basically just let me just clear the screen with net cat.
We can actually connect to another P.C. with just two simple commands which for our own P.C. we need
to set up the listening port and that listening port for our example will be one two three four five.
Now on the listening port we will listen for the inter coming connection from any P.C..
And in this case that P.C. will be our memorable O W to a machine since we will run the command in its
own terminal since it is vulnerable to a command execution.
So here we want to type here.
This command and C and then minus LV BP.
One two three four five.
Now if you want to check out before running that if you want to check out some of the options to just
see what is the syntax here you can see what our P stands for and you can see also some of the other
options here as you can see minus L stands for listen mode for inbound connections we will use that
minus three stands for both use tries to be more verbose we also use that and minus p let me just find
it is port so we specify the port to be one two three four five you can specify any port as long as
it is not in use so but in this case I will use and C minus l BP for a listen verbose and port and port
number one two three four five.
Now if you run this it will say listening on any one two three four five this any means on any interface
on any networking interface.
So once we receive the connection we will be able to execute commands to divert the machine from here
to the victim machine from here so let us just open up our Firefox and now what we want to do is make
these machine connect to our Cal Linux machine we knew that so we can simply type one to that once 160
that one that one suite performs the pinging of that machine and then we put the dot and comma in order
to run our next command which will be and see traditional and c dot and then traditional and then minus
key and then we want to go to the bin bash in order folder in the victim machine.
And after that we want to specify the IP address of our clinic's machine.
So this will basically mean the two to which machine should it connect.
And we wanted to connect to our clinic's machine.
Now in order for me to check that you just type your config so I don't specify wrong port.
So we want to connect to this port from the victim machine.
Pardon me for this IP address from the victim machine.
So we type here our clinic's IP address and then we type the port that we are listening on which is
one two three four five.
In my case if you specified any other port just type here that port after the IP address of the clinic's
machine.
Now what this command will do is first of all it will ping the hour outer and then it will execute the
next command which is netiquette and it will connect to our carrier Linux machine on this port.
And this bin bash basically allows us to execute commands on that machine.
So if we type here submit you will notice that it basically will just being I believe it won't give
any output right here or maybe it will just stay here loading.
Let's check that out.
Yeah it will probably stay here loading but if we open our terminal you can see connect to 192 that
168 that one that 5 which is us from 192 that 168 that's six.
We can see that someone has connected to our listening port and it is basically it.
It won't say anything it will just give you this output and it will wait for something.
Now what it waits for is the command ship retype here.
Who am I Mike perhaps or am I.
You will see that we get the output BBB minus data type here you name minus I we can see that we are
currently running commands on the Linux system on the our victim system.
We made a reverse connection we made it connect to our own Cal Linux machine which basically means we
exploited it.
Since now we can type here else in order to see files we can change directory and type palace here again
and we can see all of the files on that machine.
We can also check the I.P. address so you can see that it really is that machine.
So if it out here has been and then slash have config it will say that the IP address is 192 that 168
that one that 6 which is the IP address of our victim machine.
And I will show you that if I type right here I have config you can see that the IP addresses do match
my right to the weapons here.
The six and 192 that once said that 1 that 6 so that's about it for this exploitation of the command
injection.
You can basically now navigate your way and then try to find something useful.
If this was a real machine but since this is perhaps the most vulnerable machine I wouldn't be actually
trying to find something right here since I know there really isn't anything special and in the next
lecture I will show you how you can actually do the same thing.
But on the blind command injection now I will explain what blind command ejection is in the next material
and I hope I see you there by.