Hello everybody and welcome back.
And right now let us actually start adding some additional functions to our show.
We made a fully functioning river shell that can both Execute commands that can change directory that
can make a persistence and run every twenty seconds in order to perform a connection.
We also created a function that can actually download and upload files and read.
Now let us create something or basically another option for our reverse shell that can download the
files from the Internet.
Now what I mean by that is that you should actually differentiate the download function that we used
in order to download files from the Target B C and to download and the download fashionable code right
now which will be used in order to download any file from the Internet.
So we always had what we need to specify is actually download command or basically download and then
the URL and then we should receive whether the download function worked well or not.
Now it might be a little bit confusing at the start but I will show you right now what we want to do
is import a library first and then we will code a simple download function which will take it and your
role as input and it will write the contents on Target B C so for example I will run a file on my Apache
web server on my laptop and we will try to perform or basically will try to add a function to our reverse
shell that will download that file from the Apache web server on my laptop to the Windows 10 machine.
So first of all let me go to my laptop right now.
We have the.
I have our file called shelled out the AKC but right now I will make it the text files.
We can actually recognize it once we download it.
So I will remove the Shabab the extreme.
You can see what I'm doing since I'm on my laptop but I will just make a file on my Apache web server
called test not the extremes in that file.
It will say this is our secret backdoor so if we manage to actually download to make our windows stand
down the function from our third P.C. which is our laptop that will be great.
That means that we can also download the files from any other Web site.
For example if you wanted to you could download the green right to the target P.C..
Not really sure why you would need to do that but you can do it if you want to.
So let's get started.
Just let me close it P.C. right here and right now what we want to do is open up our reverse Shell first
of all since we will be coding it first.
After that we will also need to add the function to the target or part me to the server and what we
want to do right now is go to the shell part social function right here and we want to add another L
if statement.
But since we want to differentiate it from the previous one which was the download which we use to download
the files from Target B C right now we want to make it a little bit different so the command is in the
same.
Otherwise our program will break.
Let's call it the get comment.
So every time you specify get and then the URL in server the target will download the file from the
you are out.
So let us type here.
Else if command and then this right here so three we use three because get on has three letters and
then we specify equals equals get we want to first of all always try to run try and accept rule since
we don't want our program to break.
So all we have to do right now is let's first of all try to execute the download and we will do that
with the Download function.
The table code upper in the upper part of the code.
But right now let's just call it download.
We still don't have it but we'll code it.
So download and what we want to download is the file from the url.
So what we want to py paste to this function as a state as input in the brackets will be the URL but
the URL will always be the command and then the basic command cut from the fourth letter so command
four and then two dots.
Now why I say from the fourth letter so let me just type in right here.
If the server types in this command so she should DP for example then two slashes and then basically
some IP address item don't even.
It will look something like this and then the test dot the extent then we will paste this part right
here to the download function which will perform the download of this test dot the file.
This can be linked to any website as well.
So I don't know Google and then for example let's imagine that Google had our directory we did not the
file you will be able to download it with this comment.
So since we won't get any output once the target downloads the file we want to send ourselves from this
from the target to the server that the download finish successfully and how we will do that we will
do that basically with reliable send and all the.
And what we will send is just a simple string so let's call it like this with a plus.
So it means it it the correctly download that file from a pacifier your out and let's have the explanation.
So this will mean that we actually successfully downloaded a file known to accept road.
We want to specify another reliable sense so reliable.
Send estimate two exclamation marks failed to download file.
And we also need to specify it as a string right here.
So our program doesn't crash.
And right now this is what we will have in the LS If statement and all they have to do right now is
called the download function since this download function doesn't really exist.
We have to code it ourselves and we will do it right now.
So go to the upper part of the code and wherever you want you can add the download function which will
call right now.
I will add it after the reliable receive so I will add some spaces right here and then I will the death
download which will take as an input.
Are you URL which is specified also in the if statement.
Now in order for us to be able to download this we need to use a library which is called requests library.
So go up to the upper part of the code and import library called requests after report after you import
the rival record requests.
We are good to go and we can actually code our function right now which is rather short.
So we will type it like this.
So get response.
Now we used to get responses we are actually getting that you are out.
We want to get that file from that euro and we will use a function in the requests library called requests.
What requests dot get and we specify that you are out.
With will get all the contents from the you around file which is specified in a dollar function.
So it will use the same URL in this function as well.
It will give it to these variable right here that we named it get response then we want to specify the
file to where it should write the file that it downloads so the file name underscore name let's call
it like that equals the file name should be D.
Basically the last part of the url.
So if we for example have the let me just type of trend here once again.
So this year LIHEAP slash slash wanted to state that one of 15 slash test at the extreme.
We only want to name the file the last part of the url.
So we do not want to name it the entire url.
So in order for us to do that we can do something like this Your URL which is this basically that will
go into the function dot split.
This is a function that we can use and then we want to split it on the last Slash.
So just specify a slash in the brackets and then these square brackets minus 1.
This means it will split the U.R.L. every time it has these slashes and then it will use as a file name.
The last part or basically the last the string before the last Slash.
So we only select this part right here which is what we want.
So let me delete this since it is not a part of the code and let us continue with this.
So we made the the variable which will get the file.
We also made the file name which will contain the name of the file that we are downloading.
All we have to do right now is write the contents of this variable to our file.
So we do that we open a file first or with open file name.
This means that it will open this file name as the name of the file.
We want to write bytes since we are on our reverse shall not be Y which means we want to download to
the target the files.
And let us write it as out on the score file this is just a name or file that we will write.
And right now we want to write the contents of the file that we download it so that they'll do that
out file dot right.
And then we write the get response and reuse the function in the requests called content.
And this is the entire function basically.
This is all we need to do on our reverse shall not be y in order to perform the download on the target
system.
So every time we on servers send the command get and then space and then you know it will download that
file from the URL so let us control all this and let us go to the server to see if we need to code anything
so it doesn't crash.
Let us now the server that be y and basically let us think about it first.
So if you send to get comment right here
let me just think about it.
So if we send to get command and then we download that file we will be receiving if the file code it
successfully if the file downloaded successfully or if the file failed to download.
So we really don't need to code anything right here since we will send the command and it will go to
this statement right here which is the last one which it goes always as it goes always to here when
none of these statements is fulfilled.
So if you go to here it will wait for the reliable receive and it will print the result.
And our result in this case will be if that will be that string whether the file downloaded successfully
or it didn't.
So we actually don't need to code anything right here so let us say this we didn't change anything right
here.
Now let us actually compile our program so let us go to the wine road dot wine and then we go drive
seed by 27 pi installer loops.
Scripts are the main one in the scripts first by installer that the AKC and then the name of the file
which is reverse shall we want to use one file and then no console
so we let this compile in valid syntax loops.
Yeah.
So we need to.
Let me just first ladies we have a syntax that is not valid.
So let me just delete this since you didn't compile well enough.
So we have the syntax in the L if command equals get so we forgot to add the two dots after to get.
So let's find where that is.
Right here.
We need to add this right here.
So right.
Right now let's try once again.
Let's try to compile the file again it seems to be working now so I believe there are no more syntax
errors in the reverse shell.
And let's see if it will work.
So completed successfully.
Good.
Right now before we actually continue let me just show you what file I will be downloading so if I go
right here to the Firefox open up the Firefox go visit my Apache web server on my laptop.
There should be a test dot the file so lets type in the IP address on my laptop.
Let's delete this first.
So I know it's two that's 168 that 15.
And here you can see we have a test out the file so if we specified for example slash and then test
the 360 once again you can see that this is our secret backdoor.
This is the file that we will try to download from our laptop on our windows 10 machine so let us close
this.
Right now what we want to do is clear the screen and go to the lowest since there is our executable
standard plug in our use B Drive and then copy the executable to use be it right.
So unless more reverse shall go to accede to the broad media music media
I wanted to tell it.
Let me just check it once again some more road media
can't seem to find the media so let us maybe I specified something wrong let me just check it out right
here.
You just go right here and see if the file if we successfully plugged in the US b drive so let's wait
for this to open.
Kelly live
right here.
So let me first of all open the terminal to see in which directory Oh it's media road so.
Okay let's first of all delete it previous one.
Lax it is terminal.
And what I specified wrong is basically I specified this difference so we what we need to do is move
to the media.
And then the road and then the name of our Kelly.
That's right.
But I need to move our reverse shell so I can move nothing so media road and then to our U.S. speed
right.
We move the executable then we can close this and also close the USP we can enlarge this and we can
run our server dot B Y
just two runs first.
So this is running.
This is task manager.
And what I need is basically this.
So what they want to do is copy the reverse shell right here run it
and we get failed to execute script in the reverse shell.
Now this can be from two reasons either re specified something wrong in the file or our by installer
it doesn't have the requests library installed in it.
So in order for us to fix that first what we need to do is close our program so we close the program
then what we need to do is run a simple line command in order for our Python 27 that is installed in
defined folder to have the requests library.
So let us see how we can do that.
We can do that with his comments a line that we specified the path to the to the python in our drive
folder.
So Python 27 and then Python that the exceed which is the executable for Windows that we installed then
we need to specify minus 10.
And then pip install requests I believe that was the name of the library if it's not I will have to
check it out.
Once you click you enter it should install the requests library for our Python that you see file in
our road or basically in our wine drive see folder so we can see collecting requests
this shouldn't take more than a few seconds.
Now you will have to do this for every library that Python not to exceed doesn't support on the vine
folder.
So we'll have to download all of these libraries that we will import later on in order to make your
program work on Windows machines so we can see everything work successfully.
So we have the request library installed so let us compile once again intersperse delete the previous
one.
So our.
And this minus SA power and build dinosaur are in reverse shouts back.
Now let's find the compilation command.
Here it is.
Want to compile it once again.
And while it's compiling that has deleted the file from the reverse show from the U.S. B drive now let's
try to run this once again.
I believe now it should work.
So everything is compiled successfully.
And right now if we plug in the use be drive like it then clear this go to test and then we want to
I didn't want to open that I just want to move the file so that I just wait for this so I can close
it.
OK.
We want to move the reverse shell to the media route and then Caroline.
We move the file.
We go on directly back and we run the server at resulted in news.
Let's restart the terminal once you get the desired solve these used.
You need to restart your terminal and all will work.
Good.
So so men C.D. Python can reverse run the server and listening for incoming connection.
So we have to do is run our commercial shell right now so continue without scanning paste it right here
because we have this.
Let's delete this and not right now paste the file and run it as we can see right now we are not getting
any error.
So our reversal executed successfully and we should actually receive this shell prompt right here in
a few seconds then we can try to execute the get command that we actually coded in this video.
So here it is.
We check it with simple their command so everything works good.
My work is good.
Our minus say or commandment.
Good.
So let's now let's try to download the test Delta 60 file from our laptop so get HDP double slash 1
Add to that 168 that one that 15 slash test not to exceed.
Now let me just see if I don't already have something called test.
See I have the test folder.
So right now if I press enter right here if we gave have we got the string downloaded file from specified
you out.
So let's see if it really did.
We have the test data Steve.
And if you downloaded it.
Good.
We have this is our secret backdoor.
Good.
So right now let's also try to download another file that isn't on our laptops you can see that basically
any file will be able to be downloaded in our number.
We understand machines.
Let's try to find downloads download in LA for example.
You can try to download any other file if you want to
let's go and find any website where we can download
movies and download and support.
Let's click on their it doesn't even matter which version are we running.
All we have to do download Vin raw click right here
let me just see from a CPS run dot com and all we have to do is type here this link I believe and then
this path right here says this is actually downloaded from the next site to not want to do that.
So what we want to do.
Let me just see the version of it.
So download Vin Ras where we can actually go on our v understand machine and try to find a link.
So if I go to maybe understand machine go to the VIN Ras download with raw download Vin Ras it will
start downloading it so we can see that the EMC right here work.
So let us specify the name and see if this is really link.
So when RA minus X 64 minus 5 7 0 might not the exceed if I just type right here.
Well it doesn't seem to be that command.
So
for 64 bit it doesn't even matter.
Basically once you find a link this one right here is kind of giving us a little bit of problems right
now but it doesn't matter.
What you can do is just find a link through your burps suit and then after you find a link to a brb
search you can download any file to the target P.C. from the internet so you can try it out play with
it if you want to.
It should work.
And that would be about it for this story.
It was a rather longer tutorial and we will continue in the next section to adding more functions for
our live show.
Hope I see you there and take care.
Bye.