Everybody welcomes the next video we're gonna be talking about L.A. Fire.
Local fire inclusion.
So what LFR is their local fire Inclusion is when somebody or an application developer tries to include
a file.
Now this is referring to the include function P. HP.
So I'll leave you guys up to go ahead and search what that does.
But in a nutshell it basically takes the contents of a file plops it onto the page and executes whatever
HP is in there.
Now sometimes people used to use this in the past for they would load up a different file.
So if we look as an example here we see file one.
It loads up file one Hello your IP addresses blah file too.
I need a password of eight characters.
So these are all different files so you see here for example.
This is where I came from.
This is where I'm coming my user age agent IP.
Welcome.
So it's loading files so you can see up here and include that BHP file wound up BHP et cetera et cetera.
Sometimes there's not about BHP extension just says include or file one file too but that gives you
a pretty good idea that inclusion file inclusion is happening doesn't mean it's vulnerable to filing
the vulnerability file inclusion but it's including the file onto the current page.
Now an issue with this again is the sanitization of user input.
So if we're not sanitizing that this is include up HP.
We can tell it to go wherever we want.
So for example if we want know file one fire one up BHP we can load that directly.
So there can be a bit more to this.
So you know how we used to go back directors with dot dot slash in the command line.
Well if local and file inclusion is present we can actually tell it to go back as many directors as
we want and load whatever file so you can see where in slash vulnerability slash fi.
But if we come into a home which is indexed up HP as an example it's just deemed DV W.A. which is the
root so let's say we want to go back to directories so that goes to vulnerabilities.
And this goes back to DPW.
And we do index up BHP as you can see we get an error saying it's already identified as a Web site which
is fine but you can see we've loaded index that BHP onto the page on top of our previous page which
makes it look really funny.
However we come back to file one dot page P right.
We're good.
So what can we do with this.
Well we can load almost any file on the system that the user running the Web service has access to.
So if we went down that slash so a big issue with going back directories is you don't quite know how
many directories back you actually are.
So if you give it quite a few like in this case we've seen from other videos where var w w w dot or
w w w slash H team L but we also have slash DV way such volatility is fi so we only need to go back
to us X amount but we'll just give it a bunch and do see
past B which is our password file.
So if we go out and load that we can actually see we've loaded the password files with the golden view
source we can see here we go we've loaded EDC password so we know exactly who's running on what system.
So this is very very interesting.
So you can use a lot of things with this but what's important here is we can't we don't just have to
load pages.
So for example we might do you know we might go back a few directories.
Let's go back to the Web root it's five vulnerabilities right there.
So if we do a config that BHP looks like there's no directory so as do I and I.
OK looks like we don't have a config in that particular directory which is fine but it's sometimes you
might see where there's a config that I and I or conf that I and I as an example or cough up BHP where
you might find some juicy information but we can take this one step further we can actually compromise
the system directly without having to do this to do anything else.
So what we can do is something called log poisoning.
Now what log poisoning is as you provide some p or some script to the log and then you load that with
local file inclusion onto the web browser and any HP or anything else like that will actually get executed
on the system.
So let's take it let's take a look at the log file right.
So if you go back quite a few directories let's say that you're right about there.
Right.
So if you go var log in this case we've seen that it's an Apache server and we do access logs so access
that log is the standard Apache log file.
But when we run this we'll see failed to open notes that follow directory.
So this might be a different version of Apache so let's try Apache to boom.
There we go.
We can see this is our Apache log file we can see our last entries are down at the bottom so we can
do quite a few interesting things with this.
But one of the first interesting things I want to show you is something called log poisoning which we
just talked about.
So let's go ahead and poison the log.
So if we go ahead and connect on port 80 so now we're connecting to the web service which anything we
do here will be in the access log if we do get slash and let's give it some HP this time right.
So let's give it s Let's see here what do we want to give it.
Let's give it well users will use a little snippet which allows us to run commands directly from the
U.R.L. but it doesn't provide us any output which in some cases is fine in this case it's fine.
So this code snippets important so I'll leave it down in the description below the video so you guys
can keep this in your back pocket it's always a good one to have hanging around.
So we're calling P HP are calling system and we're using the get parameter and we're using CMT.
So essentially want to get request happens to the server.
Looks like it died.
Try this again.
So get slash P HP system.
So what get does is get will use will look for this parameter being passed on a get request which is
a standard request so it's going to this page directly so indexed at BHP that's a get request if you're
submitting input that's a post.
So we go ahead and submit this
we can see it failed but that was our get requests.
So if we go ahead and reload this back up and we go all the way to the bottom we should see.
We don't see it so we can see we have to get a door as an example we have our sequel injection.
But we don't see what we're looking for everybody.
Me from the future here so post edit there is an actual issue with the web server.
So what you're looking at right now it may look a little confusing at this exact second but go ahead
and continue watching the video.
Everything is as is that I'm showing is working perfectly fine.
But the back end web service was freaking out a little bit which I'll go over later in the video.
Once you keep watching.
So just giving you that heads up now because it might look like there's a transition cut here where
it goes from something not working to all of a sudden using a reverse shell.
So nothing really different happened here other than we're taking it just one step further from just
executing commands to actually executing a payload itself.
So don't worry too much.
Now I'm gonna let you go back to the video.
Just continue watching it all makes sense afterwards.
So let's go out and take it one step further.
If you remember a pen test monkeys reverse shell list we're gonna use pythons.
So if we go ahead and come up here and paste this in.
So this is our python scripts we can set up our reverse shell so wanting to dot 1 6 8 1 24 and we'll
do this on Port 4 4 4 4.
So if I go ahead and open up my calling machine once we have this open we'll go ahead and do a listener
and listen very closely on portfolio for four.
Right.
So go ahead and listen to that.
Come back over here.
We're gonna go ahead and launch this with our page with our python script here.
And we did not get a shell.
So let's see what happened here OK.
Looks like the web server was freaking out.
So we're gonna go ahead and reset that.
So I went ahead and restarted the server.
So let's go ahead and perform our get request again.
So the code was actually working perfectly fine.
The web server itself was freaking out.
Little that too much playing around with it I guess.
So we'll go ahead and re add our code here so we've and add that right.
So when we come up here we'll go ahead and read.
We already have our Python code plopped in there.
We're going to run it because we hear the Web site kind of hung there for a second.
So if we go over here we can see we actually got our shell.
So what's interesting about the shell though is that it's only reliant on the browser.
So we see if we kill the browser
in some cases the shell dies looks like it's still up.
So it must be running it in a separate process that does not die when the web server ends.
However keep in mind that your shell may be limited in this way when you're referring to other bits
of information.
So when when PDP runs it has an execution time for only so long.
So when that happens the execution may stop.
Now that's important when you're using a p p shell but because we use the python shell we should be
fine and it should be stable because Python forks to its own process and is not reliant on on the code
itself or on the the web server.
So but keep in mind if you could use a p HP code here you could use a bash reverse shell you could've
used a Perl one a ruby one I used python just for just for the sake of I like Python.
So go ahead and play around with it see if there's other ways that you can get access to the machine
through ELA fi with using DV W.A. without using the Apache logs.
So there's quite a few other ways to do it.
Play around with it.
Get used to finding out different ways to do this.
Take it a step further have it you maybe use the same snippet of for the HP to actually launch code
executions maybe you want to use a W get then you use a change mod then you actually have an execute
an actual executable instead of running a python reverse show.
Maybe you want to interpret or you know you could do a lot of different things.
So play around figure out different ways to do the same thing to get access to this machine and see
what you guys can come up with.
And then let me know in the Facebook channel and chat to see what you guys have come up with that's
a little bit different than what I came up with.