Narrator: In this lecture,
we're going to have a look
on File Upload Vulnerabilities.
These are the simplest type of vulnerabilities
because they allow us to upload any type of file.
So for example if the target computer can understand php,
then we can upload any php file or a php shell
and get full control over the target computer.
Now, as the target computer or the target server understands
Python or any other language,
then you can just upload Python code,
Python shell or Ruby shell.
You can create these shells using
Veil-Evasion or Metasploit,
or you can use your own php or Python shell.
What we're going to do today,
we're going to have a look on a tool
called weevly that generates php shells
and allow us to gain access
and do a number of cool things on the target computer.
So, first of all, I have my DVWA here.
And usually when you are trying to plan test a website,
what I recommend is,
before trying to use any tools or anything,
after you do your information gathering,
is you just go in and try to browse the website.
See what you can see, just get a feel of the website.
See what's installed on it and all that.
And try to exploit any features you see.
So for example, lets say you went on everything,
and then you reached the upload.
We can see that this website allow us to upload a file.
Now this sometimes in your penetration testing tasks,
it could be a website that's allowing you to upload
a profile picture, a picture, if it's a classified website,
maybe it's allowing you to upload pictures of cars
or whatever you're trying to add in the website.
So, as you can see here, the website expects you
to choose an image and upload an image.
So let's see if we can upload an image first.
So I'm gonna go on my downloads
and I have a picture here in the resources.
Just a picture of a car.
I'm gonna upload it and see if it gets uploaded.
And we can see that the upload was successful
and it's stored in this particular location so
its ....
which means two directories back and then this file name.
So let's see if the picture has been actually uploaded.
So I'm taking away two directories,
I'm taking away the vulnerabilities and upload.
I'm only using that.
And then we're gonna get this location on the server,
just to see if the picture was uploaded properly.
And as we can see the picture has been uploaded,
so that's all good.
Now the next thing we wanna do,
let's try and upload a php file.
And to do that, we're going to use a tool called weevly
as I said,
to create a payload or a shell if you wanna call it.
And it's obviously gonna be a php shell.
You can use metasploit as I said
to create a php payload
but we're gonna be just having to look on a different tool
that's designed for web application penetration testing.
So the tool is very easy,
we're gonna put the tool name, which is weevly.
And then we're going to put generate,
because we want to generate a payload or a shell file.
Then we will put a password for that file,
so that only us can access it and control the website
when we upload it to the website.
So my password is gonna be 1-2-3-4-5-6.
And then I'm gonna say where I want to store it.
And I want to store it in root
and I'm gonna call it shell.php.
So very simple, weevly is the name of the program.
Generate is to generate a shell.
The password that the shell is going
to authenticate us with,
and its gonna be stored in root/shell.php.
Gonna hit enter and it's created now,
if I'm already in my root so I just do ls I should see it.
And we can see it right here.
So, the next thing is we're just gonna go back
to our website and try to upload that shell.
And I'm gonna look for shell and here it is.
And I hit on upload.
And as you can see now it's telling me
the file has been uploaded successfully
and it's in the same place that the picture was.
So all we need to do now is we're going to use the same link
and we're gonna use weevly again to interact
with that shell that we uploaded.
Now let's first of all see if the shell exists
and its been uploaded properly.
So I'm just gonna browse it through my browser.
Shell.php and you can see that you get a blank page
so we're not getting 404 file not found
which means that the file has been uploaded and it's there.
So we're gonna try to interact with it from weevly.
To connect to it, we're gonna type in weevly,
and then we're gonna put the URL where the shell is.
So this is where our shell has been uploaded.
And then we're gonna put the password.
So my password was 1-2-3-4-5-6.
Very simple, weevly, the URL where the file is
and 1-2-3-4-5-6.
This is very similar to when you use
your multi-handler waiting for connections
or connected through your backdoor.
So we're literally just going to connect
to the backdoor that we uploaded.
And as you can see, now we're in the file system,
so from weevly, from this place,
you can actually just type in any Linux command.
And you'll be able, it will be executed
on the target computer and you'll see the result here.
So if I do a pwd,
you'll see that I'm in var/www/hackable/uploads
and if I do an id,
I'll see my user at the moment which is www.data.
And if you do a uname -a
just to confirm that this is the metasploitable machine
you'll see that this is the Linux metasploitable machine.
Now we can do anything we want.
We can list the files, we can navigate.
You can do any Linux command that you wanna do.
Now we have changed, our place has been changed.
Weevly also offers much more features than just this.
So it actually allows you to do a number of cool things.
If you type in help you'll see all the cool stuff
that you can do with weevly.
So you can try to escalate your privileges.
Execute SQL queries and a lot of cool stuff that is just
designed for web application penetration testing.
For now I'm gonna leave it at this.
And this just shows you how to use
File Upload Vulnerabilites.