Everybody welcome to the next video.
So in the last video we talked about local file inclusion.
Now in this video we're talking about remote file inclusion.
So just like local where include it use the page include file or a function to actually load a file
from the system.
The page include function can also be used to load a file from a remote file so a remote system such
as whether you are out.
What's important to understand here is this only works when it put when it grabs that you are all that
it provides raw text.
So for example if R if if the DV w a machine goes ahead and we provide it.
Let's say GDP s
Google dot com right.
Go ahead and do this.
We can see we've got Google dot com in here.
But what's important to understand is that this only works when it's the raw text.
So what you're seeing here is the raw text of Google dot coms home page being included.
So there's no page P code being executed here.
But the important bit is that if you're server.
So for example if this Kelly machine right here which is not the same one running this DPW server.
So this Cowling machine right here is hosting a BHP file.
Right.
So we'll do we'll take this as an example.
So we'll do the eye test at BHP
this a little bit bigger for you guys.
So we'll create a simple BHP file here and we'll do ours equal to system and we'll use and we'll do
if config right you can take that and then I go.
So this is going to do is this is going to go ahead and execute if config and why not we'll have it.
We'll have it give us hostname as well just so we can actually the hostname will be the same between
the two machines.
So we'll say if config and we'll do who am I and the current working directory.
Perfect.
So it's going to run those three commands.
If we launch this.
So if we go over to here and we go to our test up BHP we go and run this and look at the source.
We can see this is one dot twenty four as this is not our twenty two which is our DV w a machine and
we can see we are WW data and we are in var WW dot and each team out so that there's no DV W.A..
So this server is different than the one we're looking at.
So come on that this executed.
And the reason it executed was due to this using Apache to actually loaded which Apache loads and uses
BHP but if we go ahead and take this and we include it here what you'd expect to happen for RFI Is that
it would lo it would load and include the test up BHP onto this page and we would be presented with
one twenty twos if config and current directory etc..
However when we run this we go ahead and look here we can see we're still one dot twenty four this is
still WW data and we're not in the DV w a directory.
What's important understand here is that it takes this RFI takes raw text because test up BHP is being
in being actually executed on this server right here we're getting this server's information now it's
important to keep that in mind because you will end up if you do this if you if you have it if you're
hosting Web server for your malicious file which is this guy right here is your counting machine and
you're using Apache to provide this file to this in this payload then you're going to run into a problem
where you end up hacking your own machine and then you start getting a shell on your own machine and
start moving around to realize that it's the same machine that you're already on.
So a quick way to stop this is let's go ahead and move test up he HP to root and we'll do a C.T. to
root so if we go ahead and refresh this page right here we should get nothing.
File not found a perfect and if we go ahead and refresh this we get our file the request failed because
it couldn't find the file which is what we'd expect.
However if we do a python dash simple HDP server would do the same for 80.
No let us do that.
We'll do 80 80.
Then we change this to port 80 80.
Now what we can see here is we get our execution back.
But what's interesting in here is now we have our one twenty two which is our DV W.A. host.
We have our WW data and we have our DV w a directory.
Now this is happening because this file even though it's extension that BHP
us a second.
It's actually written as a text file.
You see here it tries to download it and if we do a viewed source we can see here it's actually our
raw text.
So that's the difference between that and I want you to keep that in your mind so you don't end up rooting
your own machine.
So now that we've got that out of the way we can take a here look we've got our test up BHP right but
what's interesting is we might want to take this a step further and we will go.
We can do actually something very similar to what we did with our current or L5.
So if we do get it we'll get CMT as the parameter.
Right.
So we'll go and echo that out.
So keeping this we should we need to start the server again we should be able to do and CMT is equal
to the last dash out and we can see based on this we do indeed get our DWI machine.
So again we can even take this one step further and we'll create a new tab here.
While that is still running in the background of course we will go ahead and do a net cash dash.
Listen on port for 444 and we'll grab our Python code that we used from the last video and we'll just
plop that in here we'll change this to 1 9 2 0 1 6 8 1 24 and port 4 4 4 4.
So we go ahead and watch that.
You can see the the Web site hangs but if we come over here we now have our shell.
Who am I.
And IBD so we can see our DV w a machine.
I'll bring this up a little bit.
And then if config then we can see we have our one dot twenty two.
So we've gotten our shell again this way.
So it's it's important to the biggest takeaway from this isn't the actual payload itself but understanding
how it works.
So what happens is DPW W.A. runs the include that include then sees it's a web you are.
So it goes ahead and fetches or you issues a get request to that file.
Now if that file is executed on the servers and or your attacking machines and then you're going to
get the raw text of that payload being already executed which is why you need it as the text file.
So when it takes the raw P HP from your web service it will then include that on the page locally and
you can now do whatever you want to the system.
So keep in mind that's in some cases configurations will not allow you to use the system or exact command
so you might have to get a little fancy with how you actually execute payloads and depending on what
you're trying to do there might there's a few ways you can get around it.
But I will leave that to you guys for further investigation.
But go ahead and try to recreate this test it out make sure you understand how edify and RFI work and
the reasoning behind why RFI has that little catch at the end.