Welcome back.
Let's see an example of command injection on our TV w a page, so open up your own up and navigate to
the TV w a here we are going to log in with our credentials and make sure, as usual, that intercept
is turned off so we can navigate between the pages.
Now, once we get to this page, we want to go to this part right here that says command execution.
It's essentially the same thing as command injection.
They just named it differently.
Let's go there.
And for this first example, make sure the security level is set to low and we'll be checking out security
level low and security level medium.
I believe in these newer versions of the high security level is actually not vulnerable.
And it's an example of how the code should look like once the input is not vulnerable or wants, the
input is filtered properly.
So right here it tells us being for free, we can enter an IP address and it will ping that IP address
here.
I typed in the IP address all my router and it's performed three ping requests and it outputted the
results right here.
So already by seeing these results, we can imagine that the page is performing something like this
ping one to that one, 68 at one point that you see for the count, and then three, then it pings the
router three times and it outputs this result back to us on the page.
So this page is interacting with the system.
Now, let's try to inject our comment so we'll type in the IP address.
And by the way, this IP address most likely won't work for you.
This is just my routers IP, so feel free to try with a different type instead, whether it's external
IP address or a local IP address inside of your network.
And now let's type semi column and let's type let's submit this.
And here is our command injection, it executed the second command as well, so simple as that, we
manage to run our command injection and now we can do pretty much anything that we performed in the
previous videos, such as running reversal, such as taking a look at different accounts and passwords
and all of that.
But this is not why we performed this example.
We want to see how we can also perform command injection on security level medium.
So to change the security level on a page, navigate to hear that says to a security and change from
low to medium.
Click on Submit.
And go back to the command execution and down here, you should see that now the security level is set
to meet.
So let's try the same thing.
Let's go with the IP address first, just to see what type of output do we get and we get pretty much
the same output as before.
Now, let's try to execute our comment by typing Semih column space and then El's.
Nothing happens.
And you will notice that on this TV page, we do have the source code to how this input is filtered,
this source code is written in.
And we're going to take a look at it just so we can see why our command injection doesn't work now.
So let's open the source code.
As I mentioned, it's written in B, even though we don't really need to know.
We can try to guess what this code is doing.
So this is the IP address that we input or should I say the command that we input.
And now it performs this part right here, or should I say this part?
This is the important part for us.
It creates an array that uses these characters.
And if we can see our semicolon right here.
So pretty much every time in our command that it sees semicolon, it will change it to nothing.
Same goes with these two sides.
And by the way, these two sides are also used to conquer different commands.
Let me show you, in terminals, you can type something like pink one to the 168 of one, one dash C
three.
And then you can use these two sides to also run URLs right afterwards, as you can see right here.
So semicolon is not the only way that we can concat commands and we can see both of these ways are filtered.
It will replace them with nothing in this line right here.
And that's why our command doesn't work.
So does this mean that the input is not available?
Well, not really.
There are more ways that we can concat comments.
For example, we can typing one or two that 168 at one, fantasy three.
And then instead of using two of these signs, we can just use one of that and it will still work.
Let me show you if I type one sign and then else.
Here it is, it printed out both of these things that it just did this first comment straight away and
the second comment right after, but it did perform both of these comments.
So can we try something like that right here?
As we can see, it's not filtering just one of them.
It's filtering once it sees two of these signs.
Well, let's give it a try.
Let's try to ping one or two to the 68 that want that one and use one of these signs and then tell us,
let's submit this.
Oops, it actually won't work because we typed pink, so we just need to type an IP address and let's
see, who am I?
Let's type who am I this time?
Just by using one sign to separate the comments.
And we do get both of the outputs back, just the whole my output is somewhere in the middle of this
comment.
That is because once you type only one sign and not two of them, it actually executes both command
simultaneously.
And whichever output comes first will be printed out right here.
And currently we got the output of who am I in the middle of the pink comment.
But we did run our command injection on medium security level.
And in reality, you don't really have the source code right here, you wouldn't be able to see the
code.
However, you would try all of these signs, you would try semicolon, you would try both of these signs.
You would try one of the signs.
You can also try the pipe character in order to conquer different commands.
And all of those things could be filtered or maybe most of them are filtered.
But you do manage to find one sign that isn't that will allow you to perform command injection.
So you just try all of them and see whether any of them works.
Now that we covered command injection in the next section, we're going to cover another big set of
abilities that is called broken authentication.
See you in the next lecture.