All right, so in a previous lesson, we exploited the local file inclusion and we got a shell from
the target.
And if there are no extra checks, including a remote file into the current page is also very possible.
So in this example, we're going to use the same page.
Here's the language parameter in your URL.
And it's very easy to validate if the application is akin to RFI, so.
Delete this here and write a website address.
I'm just going to use IMDB dot com.
And in just a moment, it will appear and yes, indeed, this is the arvi.
So now let's think of how we can take advantage of this, hmm, what do you think?
All right, so let me read you down the garden path.
Open your terminal lists the files in the Web directory of Carly.
Now, see, I have two files here.
So let's restart the Apache service.
And sure enough, a patch is running now.
So what do you suppose a plan is?
I will serve a page on my local server on Kouy.
And then I will include that page in into BW.
So I started the Apache Web server.
So then let's go to the browser again and change the language parameter to HTP Coingate one nine two
dot one six eight two zero four one two eight slash index dot html and go.
OK, so the index page is displayed by the application, so now instead of this page, we can provide
a shell.
To go to terminal.
Now has some web shells to use in these wonderful situations.
And you can view them just like this.
Now I'm going to use the P version of Szell's.
So copy both the back door and the reverse shell.
And pasted into the Webroot directory.
So go to the Web root directory.
And the page files are here, so I'm going to use the back door first, so let's view the code to see
what it is.
Yeah, it's a little bit hard to read the code, but.
Yeah, there's nothing to change here, so exit and go to the browser.
And type HTP Coleman's last the last one nine two down one six eight two zero for that one to eight
BHP Dasch back door that BHP and go.
Yeah, so be Web loads, the remote page on Kouy.
So this is a sample show.
It also has a few bugs.
But the upload feature is great, so let's browse to upload a file.
Uh, I choose this one.
And type here, the directory to upload a file.
Upload admin directory.
And I think we've already uploaded so go to Reeboks.
Was the admin directory.
And there is the uploaded file, as you can see here.
So this can be any executable as well.
OK, you don't believe me, go back to Kelly now, use the reverse shell.
And let's give you the code.
So I think this code is a little bit more readable than the previous one.
But we do have something to change here right at the beginning of the file.
So change the IP variable to IP address of Caleigh.
And to the port, to any port that you want to listen, for example, it's jus 443.
And there is one last thing to do, change the extension to a text file.
Because sometimes the content of the reversal can be truncated, so to be sure, we can change.
But sometimes, you know, I try it without a change and it works as well.
OK, sorry, that might be a spoiler.
So remember to restart Apache.
And before leaving terminal, I am going to start Nat Cat listener on Port four three.
So I just go back to the Web browser and call this show.
I think the shell is included, so the terminal.
And here is a pretty Basche shell.
And you can type commands.
All right, so that's a lot of fun and you can have a lot more fun with it, but for now we are done
with file inclusion vulnerabilities.