Narrator: Just like we did before, in the last video
we put five times back and then we put ETC password to
access the password file.
What we're going to do today is we're going to try to
access a file located on a different server.
So if you're doing this pentest on an actual
webserver then you need to store the file that you want
to access, needs to be stored on a place with a real
IP address or with a domain name.
I'm doing this on my local server so I'm gonna store this
on the webserver on the Kali machine, on the 10.20.14.203.
This is 10.20.14.204 and I'm gonna store my file on
10.20.14.203.
So that file, as I said, can be anything.
It could be a web shell, it could be a payload.
Well what I'm going to do is, I'm going to create a very
simple php file.
So this is just the php start and end of the file.
And what I'm gonna put in the file, I'm gonna use
a function called passthru and in that function,
basically what this function does it executes
operating system commands.
So it executes Windows, Linux or, depending on the webserver
it's going to execute commands related to that.
So you put the command here between the two quotation marks
and I'm gonna use the same command we used with the
code execution vulnerability which was the netcat command
which allowed us to get connection, a reverse connection
from our target.
So I'm gonna paste that here.
So let's just have a first a look at this, so php
and the end, these are just the start and the end
of the file, of the php file.
Passthru is a function that I'm gonna use which executes
any command that's inserted between the quotations.
And I'm using the same command that we used in the
command execution vulnerability which will just do
a reverse connection to my computer.
So this is all good, now the next step is the most important
step and it's storing this file.
So as I said, if your target was a remote webserver
then you should be storing this file in a place with a real
IP where you can access it from the remote webserver.
Now I'm gonna be trying to access this from my
Metasploitable machine which is able to access files
stored on the Kali machine because they're both
on the same network.
And I'm gonna be calling this, I'm gonna be storing it
in my var, www html, so it's being stored on the Kali,
not on the Metasploitable.
And I'm gonna call it,
reverse and I'm gonna save it as txt not php.
And I'm doing this, if I store it as a php,
it's going to be executed on the Kali machine.
So it's gonna create a reverse connection from the Kali
machine and I don't want that, I don't wanna hack
the Kali machine, I actually already have access
to the Kali machine.
The one that I wanna hack is the Metasploitable machine
and that one is stored remotely.
So, in order to be able to include the php code
and execute it on the remote machine, we're gonna use it
as txt and get it executed on the Metasploitable machine
instead of executing it on my Kali.
So I'm storing it as a txt and I'm gonna say, save it
and now let's just see here.
So if I go to my local host
and if I say
reverse .txt we'll see our file right here.
So again, this is on my local host which is
not the Metasploitable machine.
It's 10.20.14.203
and the Metasploitable is on 204.
So, how are we gonna run this?
First let me just listen for connections like we did
before, so it's just going to be netcat
bvlp 8080.
And then,
right here instead of including a file on the same server,
I'm gonna include the remote file and the command
is going to be http, so it's just going to be the link
to this file.
So we can access the file here as txt,
I'm gonna copy it and paste it here.
And also in some case, you might need to add a ?
to the end to get this file to be executed as php.
So I'm just gonna go over this again for one more time.
Including a remote file which is on a remote server,
make sure the remote server is accessible by your target.
And also make sure you store it as txt because if you
keep it as php, this file the reverse file, will be executed
on the remote server.
So it will be executed on the 203 instead of being executed
on the 204.
And I'm keeping it as txt, this way it will be,
it's gonna be executed on the 204 and it's gonna give me
a remote connection this computer,
to the Metasploitable computer.
So if I come back here, as you can see we have
a remote connection.
If we do a uname -a
you'll see that this is the Metasploitable machine,
not the Kali machine.
So we basically have full access to the Metasploitable
machine through a remote file inclusion vulnerability.
Now if we do an ls, we can do a pwd to see where we are
and we can literally run any Linux command we want now
on the machine and do anything we want.
Basically we have full access to that machine.