Hello, everyone, and welcome to the Swedo.
So you're there is an awesome CV, which is an odyssey even Lability, which is identified into a party
software.
So it is identified into a party, you know, me software, which is basically a pretty odd RC one traveling.
Now, this one liability has been assigned a CV as a score of N, which is critical.
Now, this is because of.
The complete compromise of, you know, means services and confidentiality, integrity and availability,
in addition to allowing the access to underlying operating system, which means basically any unauthenticated
attacker can execute commands onto this Apache software and execute malicious commands.
Now, this basically compromises the CIA tried and you did, which the CBSA school has been assigned
as ten point zero, which is critical.
All right.
So let's quickly see what is this one lability.
So this one's ability lies in sending a specially crafted post request to the endpoint, which is context.
Dot Tewson.
And you can see over here, this is the body which has been sent and into the body.
You can see there is a runtime not get runtime.
Don't execute your any goman that U.S. will be executed onto the target of a Sudworth.
So you we are basically going to create an empty file using the command patch into the directive, which
is temp and the file is PEOC.
All right.
One lability, number two, the same pre autarky venerability is being assigned, but through a different
way.
And here you can see the researcher is able to execute the same command as you can see over here, which
is touch, slash, slash Pewsey within the payload may look like scary, but nothing fancy is happening
over here with the game.
The same thing is being done, which is not get runtime ordered to execute the command, which is touch
to create a blank file into the temp directory.
All right, so I hope you guys understood this.
Now let us try to see some more public policies that started coming up into the wild.
So first, see or hear.
So again, OCB 2020 one three nine four two pillared.
You can see the researcher is able to craft his own payload wherein he is trying to open a calculator.
And what happens if I execute this command?
You can see a calculator successfully gets popped up.
All right.
So this means the attacker is able to successfully execute commands on to the underlying target operating
system.
Let's have a look at the PUC, which has been released by the original finder, our original author.
So the first U.S. agency HDB request.
So this is the HDB request which has been signed.
So let's copy this and let's send the same as TDB request to a target, which I have identified.
So let's go over here.
All right, so I'm going to replace the control here and you can see this is the county lawyer, so
let me just remove the spot and let me hit send.
And you can see I'm successfully able to get a two hundred, OK?
And this is the output button.
You can see the command that I have executed is genome calculator, which means the calculator application
must have opened onto the target server.
And you can see the couple of parameters are available into the response body, which is PROFILET,
S.A.T. profile properties, Shoshan properties, etc..
This confirms the target is one.
If the target gives the error and does not give this output into the response, which means it is not
vulnerable.
But yet in this case, this target is successfully exploitable and one level moving ahead.
As we can see over here, this is another PEOC which has been uploaded and here you can see the same
exact payload, but the command which has been executed is who am I?
So let's try this as well.
So let's copy it from here.
Go to our Bob.
And pasted over here that send a bad request, my bad.
And hit send and you can see and be able to get the same response over here and the executed commanders,
who am I?
All right, so you we can confirm that we are getting a great response based on this.
And this confirms that the target is one.
Now, there are many templates that has been released into the wild for identification of the vulnerability,
as well as many VAFA rules that has been also released to block many of the rules.
So you can see one of the detection rules, if any of the target is if any one is trying to identify
the vulnerability on your target server, you are going to get alerted by this election rules.
Also, if you see the nuclear, then you can see over here what matters is the matched condition is
and match type status 200.
OK, what are these words?
And they are basically doing a regex of profile sition idy properties and segment.
Let's see this profile sessions, idee.
Properties and segment, as you can see, its properties and segment, so this is basically it to conclude
that the target is vulnerable because we are able to get this into our response successfully.
Now, how to identify multiple targets for that, you can simply use search engines like Shodan sensors
also you can use Google Docs.
So I'm just going to show you how you can use sensors so you can just search for Apache.
You know, me and you will be able to see multiple targets as can be seen over here.
Now, you can just come to any of the targets or let's say I go to the first target, which is this
one.
Let's go to Google and let's wait for this to open.
Yeah, so so you can see successfully it has opened over here and this is the default configuration
bit of a party, you know me.
And now you can try basically here you can see this as a Google doc as well.
To identify multiple target, you have to modify your doc to get the right programs.
All right.
Now, I also written a script for you to identify multiple domains.
If you have them, if you have some domain enumerated, a lot of domains for any bug bounty program,
then you can directly put the list of subdomains to this bash script and it will automatically identify
for you if the target is vulnerable or not.
For that, you just need to put your targets into a file, as you can see over here.
And then I'm going to supply this file to my script and let me just hit enter and you can see it has
started identifying if the target is vulnerable or not.
And you can see this IP one, which we have already seen into our pursuit.
Apart from that, all the programs, as you can see, all the domains of subdomains are not Wonderwall.
So this can be helpful to everyone to identify or must kill your bug hunting, because this is a new
CV and you may end up identifying a vulnerable target subdomain program of any bug bounty program that
can be even private because there are many other Redzepi programs that are Ben-Dror.
And you may get lucky to find out one of the subdomains which is not yet patched and which is running
under the outdated version of Apache.
Now, remember, as this is a critical one, it is a remote code execution.
It is a pretty remote code execution.
So the chances are high that you may end up getting a very good boundy in case you identify a vulnerable
target.
Then please do comment below.
I would be very happy that you get benefit out of this video.
So this is it for this video.
I hope you guys like that I'm going to add all the resources into the description section so you guys
can use it without any issues.
Stay safe.
Thank you.