Just like we did before and the last video we put five times back and then we put ATC password to access
the password file.
What we're going to do today is we're going to try to access a file located on a different server.
So if you're doing this Penn test on an actual web server then you need to store the file that you want
to access needs to be stored on a place with a real IP address or with a domain name.
I'm doing this on my local server so I'm going to store this on the on the web server on the Kali machine
on the 10 2014 to 0 3.
This is 10 20 40 into 4 and I'm going to store my file on 10 2014 two or three so that file as I said
can be anything it could be a web shell.
It could be a payload.
Well what I'm going to do is I'm going to create a very simple BHP file.
So this is just a page for you start and end of the file.
And what I'm going to put in the file I'm going to use of a function called pass through.
And in that function basically what this function does.
It executes operating system commands so it executes Windows Linux or depending on the web server it's
going to execute commands related to that so you put the command here between the two quotation marks
and I'm going to use the same command we used with the code execution version of vulnerability which
was the net cat command which allowed us to get a connection or reverse connection from our target.
So going to start here.
So let's just first have a look on this.
So BHP in the end these are just the start and the end of the file of the BHP file pass through is a
function that I'm going to use which executes any command that's inserted between the quotations and
I'm using the same command that we used in the command execution vulnerability which will just do a
reverse connection to my computer.
So this is all good.
Now the next step is the most important step.
And it's stored in this file.
So as I said if your target was a remote web server then you should be star in this file in a place
with a real IP where you can access it from the remote web server.
Now I'm going to be X trying to access this from my meters political machine which is able to access
files stored on the county machine because they're both on the same network and I'm going to be calling
this I'm gonna be storing it in my var w w w hasty AML.
So it's starting.
It's being stored on the county not on the myth exploitable.
And I'm gonna call it reverse and I'm gonna save it as GST not BHP and I'm doing this if I started as
a BHP it is going to be executed on the candy machine.
So it's going to create a reverse connection from the candy machine and I don't want that.
I don't want to have the killing machine I actually already have access to the candy machine the one
that I want to hack is the myth exploitable machine and that one is stored remotely.
So in order to be able to include the IP HP code and executed on the remote machine we're gonna use
it as GST and get it executed are the methods political machine and instead of executed on my tally.
So I'm I'm starting it as a GST and I'm going to say save it and now let's just see here so if I go
to my local host and if I say reverse the THC we'll see our file right here.
So again this is on my local host which is not the most exploitable machine.
It's 10 20 40 into 0 3 and the meter deployable is on 2 0 4.
So how are we going to run this first let me just listen for connections like we did before.
So it's just going to be net cat.
The the LDP 1880 and then right here instead of including a file on the same server I'm going to include
a remote file and the command is going to be hazed TTP.
So it's just going to be the link to this file so we can access the file here as GHC gonna copied and
pasted here
and also in some cases you might need to add a question mark to the end to get this file to be executed
RSP HP.
So I'm just gonna go over this again for one more time including a remote file which is on a remote
server.
Make sure the remote server is accessible by your target and also make sure you start as GST because
if you keep it as BHP this file the reverse file will be executed on the remote server so it will be
executed on the 2 0 3 instead of being executed on the 2 0 4.
And I'm keeping it at 60.
This way it'll be great.
It's gonna be executed on the two or four and it's gonna give me a remote connection to this computer
to the mute exploitable computer.
So if I come back here as you can see we have a remote connection.
If we do a you name a you'll see that this is the meter's potable machine not the tally machine.
So we basically have full access to the most exploitable machine through and a remote file inclusion
vulnerability.
Now if we do an atlas we can do a p WD to see where we are and we can literally run and in the next
command we want.
Now on the machine and do anything we want.
Basically we have full access to that machine.