Now, we've already discovered this you URL, so I'm passing those things and we will find an alibi
for this version of Ask Your Manager, but doesn't mean there can't be any other vulnerabilities.
So why don't we go ahead and open exploit DBI, dotcom.
And there is a remote code injection for this version that we have in box.
Now, the content of the export code is here.
I'm sure that you don't need this file, you can accomplish it manually, so don't download it, just
open as you like, manager interface, and then you can start by creating a new database.
So I'm just going to name it Shell and I'm going to save it.
Shell, that BHP.
OK, so now quick ask you, Will, from the menu.
And we will see this code pain, so this is where we're going to inject our payload.
So I'm going to paste this school code and a code creates a table and adds a value.
But the value is a bar code that executes operating system commands and it looks for net cat's directory,
then execute.
And the value was added, so if you click table one, then click display, you can view the entry.
Now, you may wonder where this file is, so click Shell or your database name click options.
And the location property will show the path.
OK, then open this path from Firefox.
And here's a result.
Now view the source.
So this is binary data and here is our result.
OK, so now I go over to the manager interface.
Display the table one again.
And edit the entry.
So instead of this input, use this one.
The one line reverse net catch shell.
Then save.
Go to Sheldon.
Oh, I forgot to open that listener.
OK, so that's done.
Now refresh the page.
And Beatbox connects back to Kelly.
So now you can type of Linux commands and.
Hostname.
Or quite convening a pace, this python code to get a bash style show.