Hello everybody and welcome back.
And let us now add the download and upload function to our reverse shout.
So let us actually first of all to our server since we last time we did first the reverse shell.
So right now let us actually code the part of our server.
We'll have we'll have to add both of these functions in the both server and both our shell so they will
perform three separate tasks.
So for example if I send a download command the target.
That means if we want to get the file from the target so the target will have to open that file and
read the its contents and send its content back to us and we will have to write those contents that
we receive back to a file on our own our own clinic's machine.
That means the same.
Just reverse function for the upload command.
So then we as the Clinton machine will have read the file and send the file contact back to the Target
B C and Target B C we'll have to write to a pile that it will create on the target machine so let us
start off by coding it on our server what we want to do is add another L if statement right here.
So l if and let's actually use our simple use of the command so we will do will just upload and download
as the command for downloading defaults.
So in our server side we will just have to specify download so the empty space and then the path to
the file we want to download or the name of the file.
So let's start off with the Download.
So else if command that we specify and let us count the letters of the download.
So it has eight letters.
So if the first data the letters of the commands are download which basically means this part right
here so equals equals download then that's what our server wants to do is it wants to actually open
the file with the same name as the file that we want to download and we have to wait for the target
to send us back the contents of the file that we want to download and then that content that we receive
we will rise to our file that we open.
So we will use syntax for opening files which is a little bit different than the one we covered in the
basics but it is basically it means the same.
So with open and what we want to open is the name of the Father to specify in the part.
So with open command and then the nine and then on to the end of the command which basically means so
let's say the command is let me just type it right here.
So let's say the command is download image or dot J Peck for example or let's say text not the key the
first eight letters.
This will check if the first eight letters of the command is download then it will proceed with this
command and then it will open a file with the name from the ninth character.
So first date or download the ninth character is the empty space and then promote it fill open a file
with this name which is what we want.
So right now let us delete this and specify the name of the file.
So we open from 9 character we want to write to it since we are the server we want to write to that
file as soon as we receive its contents.
We can name it as file.
So this is basically the same as this command right here.
So file equals open command nine from right.
B This is the same command as this one I just wanted to use this index to show you that you can use
something like this as well so you can use whatever you want.
I will use this one.
Now you might be asking since we didn't cover what is this W B this b basically stands for bytes.
Now why are we using bytes.
Well basically since we want to receive the contents of the file in bytes.
So if we didn't specify this we would for example only be able to download the text files and we will
not be able to download the executable as images and other files.
We want to be able but we want to do that so we want to be able to download any executable from Target
B C any image for Target B C any song from Target b c that's why we specified right here WB so we open
it as file that is the name of our variable which rebel or basically or not all of our file.
And here we want to tab it in a little bit and right now we want to proceed actually the contents of
the file so we will just name it the same as here.
We will name it.
The result the same as in the previous command.
So let me just show you right here what we need to type what we want to type is the same as this.
So the result equals reliable underscore receive.
So what this will do is basically it will let us perceive all the contents of the file and those contents
we want to write to a file.
Now in order for our file not to crash we need to use a library called base64 the base64 library allows
us to actually encode or decode the encoded base64 data and actually write it to a file.
Now I will show you what they mean.
So first of all file dot right type.
Right here we know this command.
We covered it and then we want to use base64 dot Base64 decode and then we want to decode the result
that we received and then put the two brackets right here.
Now you might be asking why are we decoding something that we didn't even encode yet.
Well we will encoded in the part of the reverse cell code.
So basically in our reversal code once we get the download function we will actually first encode the
data of our file and then send it to our server then the server will receive it and then it will write
the file that it will write the decoded data of our result.
So this is basically everything we have we need to specify right now.
Basically we can add the upload function right now but before we do that let us actually add the download
function to our reverse shell.
So you can compare these two and then it will make a lot more sense to you.
So we will open it like this.
Then we will open another window and lasted a little bit.
So we can make it this big go through our Python reverse and now reverse show
in the show part we want to basically perform a similar thing.
So just go right here below the Sydney comment right.
Another L if statement the LV statement will be the same.
So else a command from the from the to the eighth letter.
So we want to specify to the eighth letter equals equals download what we want to do then is basically
right here we want to actually open the file since it is on target b c and the reverse shall will also
be a target b c.
So what we want to do is basically just write with open with open open brackets command and then the
same as right here as in the server code.
But the difference right here is we want to open it for reading since it is our file.
We want to read from it then put the contents that basically send the contents of the reading file to
the server.
So read bytes.
Can we open it.
Same as file.
So it makes more sense.
We have it this in and we want to reliable send the encoded data.
What we will do is we will use base64 and instead of base64 decode we use here base64 encode and what
we want to send we are sending the contents of the data which we can get with this function.
So file dot freed and then we closed three brackets or two brackets.
Let me just see
yeah.
We actually closed three brackets right here so let us compare these two so it can make actually more
sense.
First of all let's go to the server the server sends the download and then the path to some file or
basic more basically the service and download and then the name of some file then where the command
gets sent to the reverse shell the reverse shell opens that file for reading it reads it contents contents
it includes the contents of that file and sends the contents back to the server the server receives
the contents of the file into this variable right here and it has to be called the contents first before
writing is to a file.
So we use the function within a function.
So this function in the brackets will get executed first and then we will write the decoded result to
our file so simple as that.
Let us save both save.
Basically let the save both of these so control and then write here also control.
Then what we want to do right now is also add the upload function.
So we want to upload the files as well.
Let's start off with the server.
So let's add another if statement.
Else if command and then first six letters since that's come up how much chocolate has that equals upload.
Or do you want to do is basically just find this.
OK.
So we want to actually
what we want to do is we want to actually run try and accept rule now why we are writing try and accept
rule is basically sometimes maybe some file won't be able to get downloaded or uploaded.
So we want to actually first of all let us try to open it file since we are right now on the server
we want to open that file for reading so we could send its contents.
So with open and then we perform the same thing.
So command and then from seventh letter.
The reason why we're choosing from seventh letter is because upload and empty space add to the seven
and everything after that will be the name of the file.
And then reading since we are right now on the server and we are not uploading we want to read this
file in bytes and let's call it as Fin.
So this will be the name of our file then what we want to do is perform the same function as in the
previous so reliable send.
And we want to encode the data base64 base64 encode Green Dot create loops are missing a bracket.
But just like this you can see a little bit better
so here is what we are doing is basically opening a file for reading and then setting sending it's encoded
data to their
now in order for us to actually be able to.
Let me just go to the back of this.
In order for us to we actually be able to know if the file was successfully downloaded let's actually
add something a little bit different right here.
So let's let's head and accept rule so accept and we will actually add a variable called Field and let's
actually print that are able to be windows.
Does it really matter just print anything you want that variable so you know that it actually failed
to download a file so failed to upload Artemis not download failed to upload and we want to actually
reliable send base64 not be at 64 encode and then we want to basically send the failed variable to these
targets or failed.
Now the reason why we're doing this is basically if you miss type a name of the file and then set it
to real hand it will basically break the connection since it will try to open a file on your calendar
machine which doesn't even exist.
So it will try to upload a file to the target system that you don't have in your directory and it will
hang on the connection and you will not be able to execute anything else.
So we want to send this and it will basically write to the target this and we will know that the file
failed to download now.
Then we can actually specify the correct name and read the file that actually contains this string failed
to download.
Now since we added this on the upload since we added the upload function to the server we want to also
add the upload function to do the reverse shall not be white.
So let us do the same.
We want to add.
If command from the sixth letter so to pardon me to the six letter equals equals upload
we want to open a file for writing since we are receiving the contents.
So with open command seven from as writing bytes as fin so name it the same as in the server code so
you can actually know what it is referring to.
It makes more sense than what we want to do is basically result equals reliable.
Steve we are receiving the information of the file and we want to write the decoded part of the file.
So call right base64 base64 loops decode and then the result is decoded.
So result
so let me just check if this is it.
Let's try to save it first.
So here let us check.
We open a file for reading and then we said send its contents here we receive its contents and then
we write to the file the
decoded content.
So this should be good.
If the file fails to open or if we specify a wrong end to the file it will write failed to upload the
file that we download that we upload to deliver a show.
So let us see if this will work.
We save both of this.
I hope it works.
So let us just.
We do not need two terminals anymore but this enlarge this one and let us compile our program.
So let's just search for the command.
Here it is.
We compiled the report shall and I just remembered that we actually had the debate 64 library to both
of our programs so we have to actually delete all of this so deleted before we actually compile it again.
Now let's actually add it first to the river shall not be why we have to add the base 64 libraries so
import base 64 we save.
We also have the same to the server import base 64.
Now let's see if we used another library that we need to import.
I don't think so.
We only use the base 64 libraries to save.
And right now we can compile it once again and we should be good to go.
While this is compiling let us plug in our USP drive
and now let us copy the reverse shell to the U.S. speed right.
So let's move reverse shell to the media.
Would you be right.
Remove the shell and we delete everything else
we can run the server right away.
Listening for incoming connection so we listening.
We unplug them as we drive and we open it in our windows machine right now.
Let us copy the file and let us run the file
the file executed.
And right now let's wait for a few seconds in order to receive the connection back.
Now what we will try to do is we will try to download this image right here which is the master ethical
hacking.
Let's rename it so we can specify the entire name.
Let's name it.
Just hacking or hacking Doug pack and we can see if we are if we are going to be able to successfully
download this image from our target system.
So here we have the the shell open.
So let's see who am I.
Now let's type there to see the desktop.
Here we have this hacking the jetpack.
Now let's actually tried to download.
So let's use the function download hacking called J PAC if I press here enter we can see that it executed
normally.
And let's see if we can actually still execute the command.
So the outer shell is still running.
Now let's see where did we download our function.
Part of me our image.
So let's go to our files
we open our files or just go to our places not files so places.
Computer
what tasks that that should be in the root directory.
And then we go to the Python files and just find where they are python programs reverse.
And here we have the hacking that JPEG image we successfully were able to download it from the Target
B C.
Now we do not need to download only the the JPEG files.
We can also try to create the file on Target B C so let us clear the screen look less clearly screen
is not the same as in the Linux so that we just type once again we are the desktop directory.
Now let us echo hello world into the desktop the steam and we type here once again and let us see if
we actually echo the good things.
So test that the 60.
Here it is Halo world.
And now let's try to also download a text file so download has to go to extreme it finished really fast.
Right now we can delete the text of the Steve from our target since we don't need it there anymore as
we can see we successfully deleted it with Dell desktop the extreme and right now if I just close this
and open the places once again and I want to see if we successfully downloaded the text file as well
so let's go once again to the root python programs and the reverse.
Here's the test of the.
We open it and in the text of the 60s we have a string Hello World.
So everything works fine.
We did download comment so we now know that it just see what it does.
We now know that we can successfully download files from Target B C whether they are j peg P G text
dot EMC or basically any other file format.
But right now what we want to check is if the upload function works as well in order for us to upload
a file we need to specify we need to make a file so let us open
another term and also that we just click right here open a different terminal and large this a little
bit while our show is running in the background so C.D. python programs reverse.
Make sure to have a file in the same directory as our reverse is our server that is running.
So first of all we want to delete this test that the steal and hacking since we don't need it on our
director right here.
Now let us nano simple string files so we will call it call it shallow that the extreme loops that exceed.
And here here we will type out is your day going.
We will save it.
We have here.
Hello.
The we can close this right now and let us try to upload below that the sleep we presenter would check
if our shell is still running it's running good it executes the commands we go to our desktop and we
can see a file called Hello.
That's the extent that we successfully upload it and it contains the string that we specified in our
clinics machine.
Now this file can also be either image or executable or basically you can upload a different virus or
malware on anything you want with our rivers show.
It doesn't have to be at the files so it's deleted and right now what we have is a fully working reversal
that can upload download commands that has a persistent running that has self copied it and then basically
performs all the system commands and also performs the connection every 20 seconds.
So we have a political reversal for now but we will also try to add some other functions as well to
it.
So that would be about it for this tutorial.
I hope you enjoyed it and I hope I see you in the next one by.