Greetings, I'm Professor Kay, and you you a video presentation.
We're going to take a look at how we go about completing the walk through for the Capture the Flag exercise
sequel injection to show.
And this video walk through, you will be showing how do you sequel injection to help in the creation
of a reverse TV show?
The lab requirements for this CTF are one installation, a virtual box, one virtual install of County
Lining's one virtual install of the Target sequel injection to Shell.
And before we begin to walk through, make sure that both of your machines, your Caleigh and your target
are up and running.
You need to also ensure that both of your machines are on the same network and that they can see each
other.
So the first thing we've got to do is discover our target machine.
Now, to do this, I'm going to use net discover.
So I've typed in net discover space dashi, which stands for Interface Space.
Now I'll give it the name of the interface that I want and that discover to use to discover all the
available machines or devices on this network.
And go ahead, hit enter.
And after a short scan, it comes back up and it tells me the results that it has found on my network,
I cannot control see to break the sequence.
I've got a couple of IP addresses of interest here, but the one that I'm really interested in is the
10 year old to 13.
And that's going to be our target now that we have discovered our target.
Let's go ahead and scan before any vulnerable ports or services that may be running on that device.
So at the prompt, I'm typing in maps based dash capital, a space that small the space, the IP address
of my target.
I want to go ahead and hit enter.
And what I like about this dash capital ace, which is that it launches the end map scripting engine,
and you can see here that it ran one hundred and fifty one scripts and it ran those scripts against
that target.
And here's what it came up with.
We can go down here and we see that we have.
And we can go down here and you can see that we have a couple of ports that are actually vulnerable.
We have the S.H., but we also have our HTP running on Port 80, and that's going to be our low hanging
fruit.
And that's where we're going to start.
Let's go ahead and close out our terminal and let's bring up a Web page, go here to the application
launcher and I'll click on Web browser.
In the address bar of my browser, I'm going to type in the IP address of the Web server that we discovered
running on my target machine.
And now that we're here at the home page for this, my awesome photo blog, you see that we have a number
of additional URLs that we can click on.
We have Home Test, Roxxon 2010, all pictures and admin.
Let's click on Test.
And up your address bar at the very front of it, let's type in a single quote.
Now, what this does, it's going to tell us whether or not the secret database is vulnerable.
So we've got that done now.
We're just going to hit enter and down here.
It says you have an error in your SQL syntax.
And that's what we were looking for.
So you take away from this little exercise should be that by just adding a single quote to the front
of our Yahel, we can determine if the sequel database is vulnerable to a sequel injection.
So let's go ahead and minimize our webpage and let's bring up another terminal.
For this next step, we're going to see a map to show us all the available databases that are currently
running on this installation of school.
So I've typed in school maps based there, Deshu who who stands for you following you URL.
And then we have at the end we have the dash, dash GPS space dash, dash back.
Go ahead and enter.
Give it a second.
And down here, you see that we found two available databases.
Now, the one that we're interested in is going to be that photoblog.
So now we're going to see Comac one more time.
But this time it's going to show us the contents of the photoblog database.
So we're telling them to dump all and give us a batch of everything that's inside of this database.
What we're looking for are course are usernames and passwords.
Let's go ahead and hit enter.
So Siecle was able to use a dictionary attack and crack those LMDs five hashes that were currently hiding
all the passwords, and it was able to discover that the admin account had a password, a password that
was spelt Capital P, the number four small letter SS, small letter W, number zero, small letter
R and D.
We can now log on to that Web server as admin with the admin password.
So let's bring back up our website on the target and this time just click on Over Here, which has admin
in the log and type in admin and then type in that password that we captured for this particular website.
Let's hit Enter and you see on this next page that we have the capability of uploading a picture.
So we're going to leave this right here and let's go ahead and minimize this, because what we're going
to do next is upload a reverse shell script.
So back over here on your county desktop, just open up your file system.
And a scroll on down to we come to the USA directory, open it up, up inside the USA director.
Let's click on the share directory once we're inside of the Shell directory.
We're going to scroll on down until we come to the directory marked Web Shel's.
Go ahead, double click that now inside the Web shells, you have all of these scripts now we're going
to be looking for a script, so go ahead and open up your folder.
And the script that we're looking for is the reverse shell.
Go ahead and right.
Click on this script and we're going to open it up with mousepad or you can use any text editor you
want.
Inside of the script, we're going to scroll down just past the comments until we come to this first
section and we're going to insert the IP address for our county and the port that we want to listen
on.
So I'm a go ahead and change this here.
To the address of my calling, she.
I'm then going to change the port over to four four four four now when I have all that done and I know
that it is correct, I'm going to go up here to file and I'm going to do a save as on his next screen.
I'm going to click on the desktop.
And up here where it says Dash, reverse, dash, shell, I'm going to change that to just Shell and
once I'm ready to say that to my desktop, I'm just going to go down here to the lower right and I'm
going to save my clothes out the script, close out my filesystem, and they're on my desktop is the
script that we just saved to our desktop.
Now, the next thing we have to do is open up a listener on our Caleigh machine to establish the reverse
shell.
To do this, I'm just going to open up a terminal.
And I'm going to use Netcare to establish that listener that we need for when I launch that reverse
shell script from my target.
So I've taken ency for a net cash splash, dash L and P space.
Forty four, forty four, which is the port number.
So the small letter L stands for listening.
The small letter V stands for Verbose.
The N stands for no DNS domain.
Look up and the P stands for port.
And once you have that typed in correctly, just go ahead and hit enter and now Carly is standing by,
listening for that connection over to the target once we launch that reverse shell script.
Go ahead.
Minimize your terminal.
Now, let's return back on over to our Web page, so I'm back over here on the Web page of The Target.
Now, we need to upload that script to do this.
I'm going to use this, add a new picture feature that's on this admin page.
You see it right here.
Go ahead and click on that.
And now I'm going to browse on over to my desktop.
And I'm going to find that Shell script to double click it and then I'm going to click the ad button,
there is a error and it says, no, Pull-Out, that's fine.
Let's go and minimize our website.
Let's go back to our Caleigh desktop and let's right click and rename this Shell Dot script.
So I'm going to right.
Click on it.
I'm going to go to rename and I'm going to call this small letter P Capital Letter HP just like that.
Let's go and rename it now.
Let's go back on over to our Web page.
And again, we're going to use the back button here.
And again, we're going to browse on over to our desktop and attempt to load that shell one more time.
So I've got the shell ready to load.
I'm going to click the ad button.
And now that was successful.
Problem is, I don't have any way to launch it.
You see that I can launch these other images here, but I can't launch this HP script.
So what we're going to have to do is figure out where I uploaded this script to.
Now, to do this, we're going to go ahead and minimize one more time our Web page.
Let's open up another terminal.
And again, I'm going to use another tool called Dirch to find all the directories that are on the target
Web site.
And I should be able to discern from all those directories where my HP file was actually uploaded to.
So once again, we're looking for all of the directories that are available up on this Web server to
do this.
I'm going to use dirt and I've typed in dirt, which is the command space, followed by the URL of the
website.
I'm going to go ahead, hit enter.
So once NRPs has completed a scan, you'll see that I have a directory.
It's up on the Web server inside of the admin folder.
It's called Uploads and that's going to be our target.
So we're going to go ahead and assume that my my reverse shell script is inside of that uploads folder.
So let's go back on over to the website.
So back on over here at my Web page, I'm going to type in the IP address, the correct IP address.
And I'm going to hit enter to get up inside the upclose directory.
Now, once you're up inside of the upclose director, you'll notice that the shell that filed that we
uploaded is present.
Now I have to do to get this reverse shell established, this double click, that grip and reverse shell
will be completed.
Let's go ahead and do that.
So while I'm up here, I'm just going to double click it like that.
And you notice that you get this error message on the next page.
That's a good error message.
So now I'm just going to go back over here to my shell and you'll see that the reverse shell has completed.
So now you're able to type in Unix commands and communicate from your Caleigh machine over to the target
machine using this reverse shell so I can type in LS and that's going to list all the directories and
files that are currently available under w w w dot data.
I can also type in lsh dash l a and that's going to show us all the file permissions that are currently
assigned to the directory and files under route.
Now if you'd like to know who you're logged on as, you can just type in Who am I and enter and it comes
back and let you know that you are currently logged on as w w w dash data.
So the purpose of this particular CTF was to you sequel injection to give us enough access so that we
could establish a reverse shell from our target over to our cash machine.
It was not to establish route, but if you would like to continue on with the process of trying to gain
route access, by all means do so.
And so that's going to conclude this short video presentation on how we go about completing the walk
through for the CTF sequel injection to Shell.
So if you have any questions concerns, don't hesitate to reach out.
Contact your instructor and I'll see you in my next video.