Welcome back.
Let's try to solve these challenges inside of our command injection task.
Now, this is something that we do as a bonus, it has very little to do with the vulnerability itself.
It's more like what you're going to do after you find a vulnerability.
And we're not going to be doing all of these challenges and try to hack the platform.
However, we might do a few of them just to see whether we can solve them.
So navigate to your command injection, which is task number five, make sure it's command injection
practical.
The requirements for this is that if you want, you can read through this and this part right here.
And also you should have watched the previous video where we performed the command injection.
Right now, let's use that command injection to solve these examples.
Let's go with question number one.
It asks what strange text file is in the website root directory.
Well, we already know how we can do this to list all the files in that directory, all we can do is
type URLs so we can type something like test to finish off the first comment, even though it's not
necessary for this virtual machine.
However, we just do it for practice and then semicolon and then we can type URLs.
This will list all the files in the current directory.
And let's get to the question again.
We're searching for a strange text file.
Let's go back.
And pretty much the only text file that we have right here is Dr. Pepper.
That's the text.
So let's copy that name.
And specified right here as a first enter.
OK, it's correct answer.
Awesome.
Let's go to the second question now.
It asks how many non root and non service non diamond users are there?
Well, this might be a little bit tricky because for this we can do something like this, so test semicolon
column and then we can get at sea and then pass that folder in order to see all of the users that the
system has.
Now, we are searching for nonvote and non service users.
And if you take a look at this output that we get right here from the ETSI stability folder, well,
pretty much we don't have any personal user outside of all of the other users tied to a service such
as proxy, such as no log in, such as network and all of that.
So the answers to this should be zero.
Let's submit it.
And that's also a correct answer.
Awesome.
The third question is the one that we already performed in the previous video, which is what user is
this app running us so well, we did this in the previous video.
We can type test semicolon and then who am I?
And it will tell us the user that's currently running this Web application.
In our case, it's w w w dash data.
Let's copy that and submit it for the third answer.
The fourth question is, what is the users shall set us?
Now, this is something that you can also try searching inside of the Etsy past upload folder.
Let me show you what I mean once you get the Etsy.
Stability folder.
It will give you this output and all you want to do right here is try to find it w w w dash data user
and if we go and scroll a little bit, it's all right here.
At the end of that users line, we should be able to find a path that says user has been no longer.
Let's give it a try.
Let's hope that this is the path that we get.
And if I set it right here, let's see whether it's correct and it indeed is correct.
So all we had to do is create the stability folder, find it w w w dash bayti user.
And at the end of the line you will have the path.
That is the answer to the question of what is the user's shall.
OK, awesome.
Now the fifth question is what version of a Bonta is running?
And most of these questions are something that we can actually Google if we don't really know.
So, for example, let's say that we don't know what command can we use to discover the Ubuntu version?
We can try something like this.
How to check open to version.
Press enter and we can visit first or second link.
It doesn't really matter.
Let's go with this one.
How to check your Ubuntu version.
And ideally, we want a command that is used to do that.
So let's scroll a little bit down and it says, use the LSP, release a command to display the Ubuntu
version, so let's give it a try if we copy this command.
And we run it inside of our evil Shell Subtests column and then let's paste the comment.
OK, so we do get the output here is the Ubuntu version and which format are we looking at?
We're looking at a no doubt.
No doubt, no.
So it's pretty much this 18 dot 04 dot for copy that this is the Ubuntu version and paste it right here.
Awesome.
Now, the last question is the trickiest, because it says print out the emoted, what favorite beverage
is shot?
Not pretty much.
99 percent of you are going to take a look at this question and wonder what even these retasking.
But I advise you to straightaway go to hint.
So the hint tells us zero zero dash header, and this sounds like a foul perhaps, or something like
that, so we can start off with that if we can try to locate a file that has this inside of the name.
How can we do that?
Well, we can use a locate command that most Linux systems support so we can test and then CENTCOM.
And by the way, just so you don't get confused, you don't need to type test every time you can type
anything.
So pretty much anything at all, you can type test one, two, three.
The word that you type before this column is really not important in this case.
So you can type pretty much anything and then semicolon and then comes the important comment.
So you want to locate.
And what are we locating once again, we're locating zero zero dash.
Let's copy that name.
And let's paste it in our comment, click on Submit.
And we get this output, which sounds like a path which is under the slash at sea slash update, emoted
Dotti slash zero zero header.
So let's try to cut this, but let's make even more complex command.
Let's type test semicolon and then let's Khedive to slash Azzi slash update dash and all the.
And let's get another comment, which we can do by typing two of these signs right here and then we
can type Cat zero zero dash header.
So here we are actually trying to execute three commands, the first command, which doesn't really
matter what it is in this example of this virtual machine, you don't even need to use it because it's
specifically made to execute commands.
But in real life, you will have a first command that should be normal Web application usage.
Then after that comes our command injection where we execute our first command and in this case, we
at another command.
After we said to this directory, we want to get the content of this zero zero dash header.
Let's submit this.
And this is the output that we get.
So now let's go back to the question.
What favorite Berridge is shop?
Hmm.
Let's go all the way down.
And if we scroll, we're going to see something interesting right here that says Dr Pepper makes the
world taste better.
We can copy this.
Go back here and paste it right here.
So let's try it like this.
Now, that doesn't appear to be the answer.
So, oh, we should just copy Dr. Pepper, if I'm not mistaken, not the entire sentence.
So let's go back and let's paste Dr. Pepper.
And here it is.
That's the correct answer.
So this was just a little bit of a bonus video where we covered these tasks right here using different
commands.
And in the next video, we're going to take a look at how we can run a reverse shell with the help of
a command injection on our always be able to machine.
See you in the next lecture.