Narrator: Code Execution Vulnerabilities.
These type of vulnerabilities allow us to execute
operating system code on the target server.
So, if the target server uses Windows,
we'll be able to execute Windows command,
if it uses Linux, then we'll be able to use Linux commands.
Clearly, this is a really critical problem,
that would allow us to do anything we want
with the target, really.
We can upload a PHP shell,
using wget command or upload a payload,
a virus, anything we want,
using the wget Linux command.
You just need to make sure that you're uploading it
to a file or to a directory,
which you're allowed to write stuff to.
Another way of exploiting this vulnerability,
is, to just run OS commands and get a reverse shield
based on these commands.
So, because we can run operating system commands,
we can use the programming languages supported
by that operating system to try and get
a reverse connection on our computer.
So, first of all, let's just assume
that we're browsing here,
and we manage to we're going around
and then we got to a tab in the website
where it allows you to,
for example do a ping.
Now what you should do is, you should always
try to experiment with any input works you see.
Try to see what that input works does
and what can you inject into it,
what can you do to get stuff running.
So, for example, this input works
is telling you its going to do a ping.
And, if you put an IP,
for example I'm going to put 10 20 14 203,
which is my own IP.
Just to see it, to use it as a normal person,
I'm going to do a submit and it's going to go ahead
and ping it for me and give me the ping results.
So, what looks like here,
it's actually executing the ping command,
in Linux systems.
Now, let's see if we can exploit that.
If it's actually executing the ping command.
So, what it's doing is, it's going,
and it's doing.
So, we're sending 10 20 14 203 as the ping.
And then it's going to the web server
and the web server is doing ping, 10 20 14 203.
So, let's see if we can exploit this.
How would we exploit it?
It's taken what we're inputting, right here.
And then, it's doing ping, that.
Now, in Linux and Unix based commands
you can use, the, this sign to execute multiple commands,
on one line.
So, if you do this, for example in your own terminal,
so, I'm just going to go through my terminal, here.
And I'm just going to do LS, which is the list command
and then PWD is what lists,
what shows your working directory.
So, if I do an LS, followed by this sign
and then do PWD, it will execute both commands.
So, it will do this and then it will show
where the working directory is.
So, we can do the same thing with this
and see if it works for us.
So, we're going to put in IP, a right IP,
and then I'm just going to do PWD
and see if it will execute the PWD for me.
If it does,
then this is a code execution vulnerability
and I can execute anything I want on the server.
So, let's see what's going to happen.
I pasted this, and I'm going to hit submit.
And as you can see, we got the ping results,
but at the end,
we got our current working directory.
So, its via wwwdvwa vulnerability is an exec.
So, it executed the PWD that I inserted.
And that means I can insert any commands I want,
in there and they'll be executed.
So, I've inserted a resources file
that you can use to get reverse connection
from the target computer.
Now, there's a number of ways,
a number of commands that would give you
a reverse connection.
All of these commands depend on the programming language.
So, for example, we have commands in PHP,
we have commands in Ruby, you have Pearl commands
and we have the one for Bash.
Bash is the Linux shell command and language.
So, all Unix operating systems will be able to execute
Bash commands.
So, that's a very good way of doing it.
So, most Unix system,
this command should work on most Unix based systems.
So, this would be a really good way of doing it.
Again, most of them would have Python,
so, Python would be a good way.
Netcat, most of them do have Netcat as well.
So, Netcat is a good way of doing that.
And, we're actually going to use Netcat in this video.
So, what I'm going to do is,
first I'm going to listen for connections,
just like we used to do with Metasploit,
when we used to do multihandler.
You can actually use a multihandler for this,
and listen for a connection.
Well, I'm just going to keep it simpler
and show you a new way.
And, I'm going to use Netcat.
So, Netcat.
Netcat is just a tool that allows you
to listen and connect computers together.
So, I'm going to listen on port 80 80.
So, Netcat is the program.
vv is just to see verbose output,
so we can see a lot of output,
anything goes wrong, we can see it.
And, we're telling it to listen,
using the L option on port 8080.
So, I'm going to hit enter,
and that's saying just listening on port 8080,
that's all it's going to do.
The next command we're going to do, is,
we're going to try to connect from the web server
back to my computer, using Netcat, as well.
So, we're assuming the web server has Netcat.
We're going to try it and see if that works.
So, the command is very simple.
It's Netcat and we're telling it to use bin bash.
And we're giving it the IP of my device.
My attacker device, which is 10 20 14.
And, then the port which is 8080.
Which is where we're listening on, right here.
So, I'm going to copy that.
And I'm just going to execute it the same way
we used to execute the PWD
command.
So, the last thing we did, was, 10 20 14 203.
And then we did PWD.
So, what I'm going to do now,
I'm going to remove the PWD
and paste the code that we just created,
which we'll try to connect from the web server
back to the cally machine to the attacker machine.
And, I'm going to come here.
And, as you can see, we got a connection back
from, to us, from 10 20 14 204.
So, that's the tarried computer.
And, if we do a PWD, you'll see that we have
a reverse shell if we do an LS.
If we do an ID, you'll see that we're wwwdata
and you're free to (mumbles) you name A, just to confirm.
That I'm in the Metasploitable and you can see
that I'm in the Metasploitable.
And, I'm able to run any command that I want
on the target computer.
So, basically I have full access to the target computer.