OK, let's try and solve some command injection challenges on our own wesp virtual machine.
So what you want to do is make sure everything started versity started, even though we're not going
to use it, but we need it just in case maybe we are going to need it.
Maybe we are not going to need we don't really know that also.
Besides, perhaps it open your overspread machine.
And once you have all that ready, we want to navigate to the overseas day to.
Now, here on August 12, 13, we're going to see under the injection command injection right here and
we can go with any one of them.
Let's go with DNS lookup.
If you open this simple page, so it says, who would you like to do a DNS look upon, enter IP or hostname,
let's say, for example, we type in Google dot com and just so we can see everything better.
And I'm going to zoom this in.
Let's say we type W w w Google dot com and click on Look-Up DNS.
And this is the output that we get and straightaway, just from the output, we should be able to notice
that this output looks quite similar for us.
It almost looks the same as the output from the end look up comment.
And as we already know from our Linux knowledge and its look of command is used inside of the terminal.
So if I typed W..
W. W. Google dot com to DNS lookup, we would pretty much get almost the same response.
So maybe this application is using its system to execute this command and give us the result back,
and whenever this happens, we already know there might be a possible command injection.
So let's type W w w Google dot com semicolon space and then let's type who might click on lookup DNS.
And this is the output that we get.
We have a combined injection, as we can see down here, it executed our WHO and my comment, we can
do the same thing with ALS or any other comment that we can run in terminal.
And it should also run, as we can see right here, our Ellis command gave the output of all the files
in this current working directory.
So this was rather easy.
We found the command injection, but let's take it a step further.
Let's try to establish a reverse shell with the target system, with the help of a command injection.
And if we take a look at these outputs or these files that we got with our allies comment, it seems
that the server is running BHB, which is most common, to be honest.
So most likely servers will be running and maybe we can do something like a reverse shell.
Now, even though we're not codders, this type of one line reverse shells are very easy to find online.
And you just need to Google up one line shell or bash one line reverse shell, and it'll give you a
single command that can be used to establish a virtual connection with our client machine.
So I got one of those commands right here.
It's written right here in my NENO editor.
And all this command is doing is it's running code where it creates a socket object and socket object
in programming language is something used to establish a network connection in the brackets between
the double quotes.
We have our callisthenics IP address.
So this is my callisthenics IP address and here is the port that we wanted to connect to.
The second part of the command is what we wanted to execute once it connects and this entire part simply
tells execute the best shell and make it run as much commands as we want.
So this is the entire thing that this command does.
It connects to our clinic IP on the specified port and it executes the best shell for us so we can execute
the comments.
But in order for the target machine, which in our case is always BBWAA, to be able to connect to our
Kleenex machine, we must listen on an open port for the incoming connections.
And we can do that easily by opening terminal and typing and see, which is not cat dash LDP and then
the port that we want to listen to this dash, it simply stands for lesson on any interface that colonics
has.
So we're not specifying the exact injuries we're pretty much telling, except the connection on whichever
interface that you get the connection from.
So it's NC Dash, BP and then space.
And here we need a port.
And if we go back to our command, let me find it.
In this command, we specify the port.
One, two, three, four.
So we must use the same port inside of our Netcare comment.
So we will type and see that LBP and then one, two, three, four.
And this is pretty much all we have to do.
It says listening on any interface on port.
One, two, three, four.
Now we want to copy this command.
And make sure that you get all of these single quotes and double quotes, right, because otherwise
it will not work and then we want to execute it right here.
So let's go down in time w w w Google dot com semicolon.
And now let's paste the entire comment here.
Click on Look-Up DNS and the first thing that you will notice is that it's loading the page, it's not
outputting anything for us is just continuously loading.
And if we go back to our NetJets window, here it is.
We got our reverse shell opened and we're on that machine currently as w w w dash data user here, we
can execute all the commands without having to go to the web page.
We can just type who am I.
We can type.
I have config, we can type elsewhere.
We can type W.D. to check current working directory right here and we can type anything that we can
run from a normal terminal.
We can even try to, for example, execute one of these files if we want to.
So this is really good because now we have a reverse shell established on the target machine and we
can do anything that we want, including deleting files, creating files, navigating through the system,
downloading files, uploading files and all of that.
So that's really cool.
Even though you can do all of that with just typing in the comments right here, it's much easier once
you have a reverse shell established where you can just type in the command in the command line.
Now that we did that, we covered a little bit of a defense example of exploiting command injection
and in the next video, we're going to take a look at one last example of command injection, which
will be on our TV w a on our virtual machine.
See you in the next video.