In this lecture we're going to have a look on file upload vulnerabilities.
These are the simplest type of vulnerabilities because they allow us to upload any type of file.
So for example of the target computer can understand GHB.
Then we can upload any BHP file or a BHP shell and get full control over the target's computer now as
the target's computer or the target server understands Python or any other language.
Then you can just upload Python code python shell or Ruby shell.
You can create these shells Use Anvil evasion or meta exploit or you can use your own BHP or Python
Shell
what we're going to do today we're going to have a lock on a tool called Wheatley that generates BHP
shells and allow us to gain access and do other a number of cool things on the target computer.
So first of all I have my DV W here.
And usually when you're trying to paint us the Web site what I recommend is before trying to use any
tools or anything after you do your information gathering is you just go in and try to browse the Web
sites you see what you can see.
Just get a feel of the Web sites see what's installed on it and all that and try to exploit any features
you see.
So for example let's say you went on everything and then you reached the upload we can see that this
Web site allow us to upload a file.
Now this sometimes and in your penetration testing tasks it could be a Web site that's allowing you
to upload a profile picture a picture if it's a classified Web site maybe it's allowing you to upload
pictures of cars or whatever you're trying to add in the Web site.
So as you can see here the Web site expects you to choose an image and upload an image.
So let's see if we can upload an image first.
So I'm gonna go on my downloads and I have a picture here in the resources just a picture of a car.
I'm gonna upload it and see if it gets uploaded and we can see that the upload was successful and it's
stored in this particular location.
So it's dot dot dot dot which is which means to directories back and then this file name.
So let's see if we can if the picture has actually been uploaded.
So I'm taken away to directories and taking away the vulnerabilities and upload them.
I want to use that and then we're going to get this location on the server just to see if the picture
was uploaded properly.
And as you can see the picture has been uploaded.
So that's all good.
Now the next thing we want to do let's try and upload a BHP file and to do that we're going to use a
tool called.
As I said to create a payload or a shell if you go if you want to call it and it's obvious it's gonna
be IPH Richelle you can use me to ask asteroid as I said to create a BHP payload but we're going to
be just having a look on a different tool that's designed for web application penetration testing so
the tool is very easy.
We're going to put the tool name which is we Lee and then we're going to put generate because we want
to generate a payload or a shell file then we will put a password for that file so that on the US can
access it and control the website when we upload it to the Web site.
So my password is gonna be one two three four five six and then I'm gonna say what I want to store it
and I want to store it in route and I'm gonna call it show that BHP so very simple We've Lee is the
name of the program generators to generate a shell the password that the shell is going to authenticate
us with and it's going to be stored in rude shell that BHP gonna hit enter and created.
Now if I am already in my roots or if I just do allows I should see it and we can see it right here.
So the next thing is we're just gonna go back to our Web site and try to upload that show
and I'm going to look for shell and here it is going ahead on upload.
And as you can see now is telling me the file has been uploaded successfully and it's in the same place
that the picture was.
So all we need to do now is we're going to use the same link and we're gonna use Waverly again to interact
with that shell that we uploaded.
Now let's first of all see if the shell exists and it's been uploaded properly.
So I'm just gonna browse through my browser jailed with BHP.
And you can see that you get a blank page so we're not getting 4 0 4 file not found which means that
the file has been uploaded and it's there.
So we're gonna try to interact with it from need to connect to it.
We're gonna type in we've weekly and then we're gonna put the URL where the shell is.
So this is where our shell has been uploaded and then we're gonna put the password.
So my password was one two three four five six.
Very simple really.
The URL where the file is and one two three four five six.
This is very simple it's similar to when you use your multi handler waiting for connections are connected
to your back door.
So we're literally just going to connect the back there that we uploaded and as you can see now we're
in the file system.
So from we've lived from this place you can actually just type in annually next command and you'll be
able it'll be executed on the target computer and you'll see the result here.
So if I do a p WD you'll see them that I'm involved w w w hackable uploads.
And if I do an idea of I'll see my user at the moment which is the re WW data and if you do you name
a just to confirm that this is the methods exploitable machine you'll see that this is the Linux with
exploitable machine.
Now we can do anything we want we can list of files we can navigate you can do any Linux command that
you want to do.
Now we have changed our place hasn't changed.
We've also offers much more features than just this.
So it actually allows you to do a number of cool things if you type and help you'll see all the cool
stuff that you can do with Waverly.
So you can try to escalate your privileges as execute Eskil queries and a lot of cool stuff that is
just designed for web application penetration testing.
For now I'm going to leave it at this and this just shows you how to use a file upload inabilities.