For a fresh hack, you can start over.
I'm just going to move on with the same request.
So there are several ways to include a file which is stored local or on a remote server, and also there
are several ways to execute the files that are executable.
So.
The first way is to contaminate a log file.
Then include the contaminated log file and the page.
OK, so just send the first request.
Then go to be Bux.
Open terminal and tight tail slash VA slash logger Pache to slash access log.
So this log file contains they get requests that we sent.
So now I'm going to contaminate this file with a script.
So going back to Kelly.
I'm going to paste this code.
And it's a simple Michelle.
It'll execute the value of a command parameter set over the wall as an operating system command.
And send the request.
There's nothing with a request, so go to be box run the same command in terminal.
So here is a code that we sent over your URL.
Now go back to Kelly.
And delete this code and type slash bar, slash log, slash Apache to slash access to log.
Ampersand command equals P W.D..
All right, so, no, it doesn't work.
The command is not executed.
We got a permission denied error, so that just means we need to try something else.
Now, there is a special file in the directory process itself and veteran.
Now, in order to contaminate this file, we need to add this simple shell as the value of the user
agent header.
So I'm going to paste it in here.
Now, send the request.
And have a look at the response.
No, it doesn't work as well.
We got the same error.
So, OK, we can try a different way.
I need a clear request, so I'll go back.
And I will change this payload to a rapper this time.
So it's add BHP Coingate input here.
And now pays the Shell script to the body of the request like this.
All right, so now send the request.
And look at the response.
That's it.
Yeah, this time the command works and OK, so change to the list command.
And it works.
So now let's go a little further and open a net catch, Shel.
And B box, so the first thing we need to do here.
As we need to learn where the net next binary is.
Sometimes it can reside in different directories, so it's not too hard to find just type which percent
signed 20 ency percent saying 20 is the URL encoded space character.
And send it.
And here is that cat under the bin directory.
And here are the Basche commands to open a reverse shell from B box to Colly.
So I'm going to copy the second one.
Now, sometimes it doesn't work because of the difference between the versions of Netcare.
So your version and the version on the target may cause problems.
But in a situation like that, you can always use the third line as a reverse shell.
OK, so I'm going to it here.
And sended.
Hmmm, I think something went wrong.
I don't see a response, there's nothing in it.
OK, so I found it.
Yeah, it's for sure you, Erlend, code problem, so let's open up the decoder tool.
Paste here.
And code is your URL.
OK, copy all of that wild output.
And paste instead of this.
Now, before sending their request open terminal.
And of course, we should listen for the incoming Shell connection and see Dash and AVP four four three.
Now go to burp again.
Now, send the request.
Now, I wait for this empty response pain in a previous attempt, so.
I think we get the shell.
Go to terminal and here is a connection, I.P. address of box.
So this way, Ngarkat provides us a shell interface on PAYBOX.
So now we can execute the Basche Shell commands on Beatbox.
I'd like to see the current user and you can execute every command that your user is able to execute
and what do you know?
We can traverse between folders lissome.
Now, from here on out, it's up to you and your imagination, what can you find?
We are going to exploit the remote file inclusion in the next lesson.