Hello everybody and welcome back.
Now let us just perform the blind command injection.
Or should I say let me show you how to find out if a certain Web site is vulnerable to the blind command
injection instead of just the command injection.
So now what I mean by blind command ejection is basically as you can see if we go right here to the
website once again.
So let me just.
It says that there is an error.
These folks must send information that will repeat an extensive research re recent whatever I'm not
really sure what's the problem I basically just started recording.
That is just connect once again to the machine.
So when I did it once upon funded six siblings believe was and let us go to the what about web application
once again come on will you connect
so let's just let's just let this connect and let me just finish the blind est in the part made blind
command ejection is basically when you can't really see the output of your command.
So in our previous example we actually could be able to see the output of the ping command and also
the output of the command that we specified after the pinging command now.
In some cases you won't be able to see the output.
It took basically maybe just print to your server was being correctly or something like that.
And you want and even if it is vulnerable to the command execution it might not show it in the output.
So the best way to do that is by pinging your own machine from that server and then opening and inspecting
the packets in the shark in order to see if it pinged correctly.
Now I'll show you what I mean.
Let me just see why this isn't connecting.
Let's see if we are just oh maybe it's because we are still on the virtual machine.
So in order to exit that virtual machine just click your exit and you basically stop the connection
to the to the big machine now.
Just ping our director to see if we are on the Internet and we are.
So the problem is not with this machine.
The problem is with the vector machine.
But as we can see it's loaded.
So let's go to the command execution once again and let's pretend that once you type here one night
that once you get that one the one it doesn't give you any output.
Now here it will give you since we do not have an example of blind command an injection right here.
But let's pretend it didn't give us any output and it ping our outer now in order to check if this is
vulnerable to the blind command execution.
The most common method would be talking to machines.
So 192 that 160 that one that one which is a legit command and it is made and the server is made to
ping and one IP address.
But if we specify another IP address in the next command so ping and then the IP address of our clinic's
machine the server that isn't vulnerable shouldn't be executing this command.
It should only execute this command but if it is vulnerable it will execute both of these command commands
now.
Be careful since this is the our always machine is Linux machine.
And if you just run this command it for keeping your machine forever so you will just basically have
to restart it in order to stop pinging.
So just type here minus C which stands for count and three.
So this basically means it will only send three pinging packets as in this as in D output right here.
So let me just show you.
If we open our terminal and ping when I do that 168 that one that one.
It will ping forever until we stop this program.
But if you type you one ping one I can say that one that one minus C three it will only ping it three
times and it will stop.
Now we want to run that on the target server so be not in our cells forever but before we run that we
you need to run a tool called white shark.
So just type in your terminal virus shark.
The shark is basically a tool that allows us to inspect our packets on a certain network interface now
as soon as you open it you will see a bunch of packets flowing.
Just click here.
Forget this area click here on OK.
And let me just see my interface is age 0 0.
And once you open it you should be seeing some packets right here finisher.
Why.
I don't see them.
Let's just try.
But why doesn't this want to move right.
What are you doing.
Okay.
And here we can see the packet.
Why is there not other packets.
So let me just try to think when I see the posted up on that one.
Oh yes I am.
This is the terminal that I ran my bar shucking.
So this won't work that will just open another terminal and try to pin one idea to this I see that on
that one.
And here we can see a bunch of ICMP packets floating around.
So that is good.
This is the pinging packet as we can see echo ping requests and echo in reply from our outer.
Now that you opened this and went on to your network interface which for me was ITI H.
Oh and now you want to execute this command and basically click here submit months this is finished.
You want see this output that we see since it is blind but you will be able to see if someone pinged
you in by a shark.
Now let's stop it.
So you just stop the capturing packets on this red button right here and you can then inspect all of
the packet that you received intense certain amount of time.
Now these first ping requests are something we ran on our terminal and we ping they were up there but
we can find out that that website or the OS machine is preferable to command execution by these ping
requests right here.
So as we can see there are three ping requests as we specified in the server.
We read D minus C pre comment and we got the reply from the OS with the machine which IP addresses night
that 168 1 6.
So that means if we if you got this ICMP packets right here that means that the website is moral to
the command injection.
Now another thing you might need is for example if you have a bunch of packets floating around there's
a lot of them.
You can filter it out by typing ICMP right here and you will only see the pinging pinging packets that
we just as we can see first four or five four three.
Now first four packets are basically the packages that we used to ping our outer.
And this is the output from our command injection.
So by this we know that the machine is vulnerable and we can proceed with the same process as in the
previous video in order for that permeable machine to connect to our own machine.
Now I just want to show you that in the command injection you will most likely have divisible ones since
it must give some kind of the output.
But before I finish with the command injection I just want to tell you a few things which is the quick
injection first of all it can be done both over get in both requests.
The example that we had right here was the most request I believe.
Let me just check right here.
Let me just check it right here by typing in the IP address of our router and then intercepting the
packets.
I believe this is a post request open.
So here we have and we can see right here.
Yes it is a post request.
So this was an example of post request command execution.
You can also have it as a get request and also would get the get request the user input will be sent
within the link.
So that's how you can differentiate the posts from the get request if it does from the get request.
We will have my this IP address at the top here somewhere in the link right here but since this is a
port request we do not have it now.
As we saw in the port request the IP address was sent within the HDP body.
We can see right here.
Here it is and there are also some of the other values in HDP headers that can be potential threat to
the command injection.
Now some of them are for example cookies use arranged as we can see this right here refer can also be
sometimes vulnerable to the command injection and also as we saw the commander judge can be either visible
or invisible we covered both of those both visible and both invisible.
And I want to show you another very very famous comment.
Injection of vulnerability which is called shell shock now shell shock.
If you were to build your OS virtual machine into life version it would print out the current uptime
of the server which means it executes something similar to the you name minus a comment.
So if we will not cover that right now since it is very similar to this to attacks but if you were to
put this machine into the live version you would see once you visit the IP address of that machine it
would print out the uptime of that machine for example the machine is running for three hours now.
That means that it executed some kind of a command in the terminal in order to show us that option which
means it could be potentially vulnerable to the command injection
but if you want to call if you want to check out the shell shock you can switch it on the internet and
read more about it and you can also if you're familiar with the MSF console you can also use its module
in the MSF in metal plate framework.
I believe it is called something like exploits.
It should be a patch mode.
I'm not really sure.
Let me just check out right here.
Once the MSF console opens up
now we'll show you.
Now we didn't cover the Mets point yet but just follow up with what I'm doing right now.
It shouldn't be that hard to do so as we will not be exploiting I will just show you some of the options
that shellshock has or this module in that slide show.
We want to use exploit multi CTP I believe and then Apache modes and then I just had to complete this.
So once you use that you can type your show options and it could give you some of the options that you
need to specify in order to use this vulnerability as we can see the possibility e 2014 6 2 7 1.
Now the ad as I told you the part of the header that it is attacking is the user agent part.
So it will send the that caused by a shark since we don't need it anymore.
It will send the mobility command the vulnerable command to the user agent field in the HDP header.
The method that this uses is get method.
We need to specify the our hosts which is the victim machine which is in our case our OS machine.
You also need to spend a specified the target you are I and you do that by basically just going to the
target's IP address once it is booted into life mode.
And after you do that you can also set the target and you can just type here exploit and it should run.
Now I didn't specify anything so this one front for me.
I will just close it right here on the close.
Max.
I just want to show you that it exists as well
and that would be basically about that all about the command ejection and in the next video we'll start
off with the actual injection which is the number one more on Web sites.
And if you encounter something it will probably be the fuel injection.
It is very dangerous and very common especially in these small websites as they do not filter their
user input that well.
And we will do that and I will show you all of the practical ways to attack that in the next few lectures
and I hope I see you there and take care by.