Code execution vulnerabilities, these type of vulnerabilities allow us to execute our operating system
code on the target server.
So if the target server uses windows, will be able to execute Windows commands.
If it uses Linux, then we'll be able to use the next command.
Clearly, this is a really critical problem that would allow us to do anything we want with the target,
really, we can upload a shell using the will you get command or upload a payload, a virus, anything
we want using the W w get Linux command.
You just need to make sure that you're uploading it to a file or to a directory which you're allowed
to write stuff to.
Another way of exploiting this vulnerability is to just run all these commands and get a reverse based
on these commands.
So because we can run operating system commands, we can use the programming languages supported by
the operating system to try and get a reverse connection on our computer.
So first of all, let's just assume that we're browsing here and we managed we were going around and
then we got to a tab and the website where it allows you to, for example, do a thing.
Now, what you should do is you should always try to experiment with any input box.
You see, try to see what that input box does and what can you inject into it.
What can you do to get stuff running?
So, for example, this input box is telling you it's going to do a ping.
And if you put an IP, for example, I'm going to put 10, 20, 14, two or three, which is my own
IP, just to see it, to use it as a normal person.
And I'm going to do a submit and it's going to go ahead and ping it for me and give me the ping results.
So what looks like here, it's actually executing the ping command.
And Linux systems.
Now, let's see if we can exploit that, if it's actually executed in the Pinkham on.
So what it's doing is it's going.
And it's doing.
So we're sending 10 2014 to 03 as the dipping and then it's going to go to the Web server and the Web
server is doing ping 10, 20, 14, two or three.
So let's see if we can exploit this, how would we exploit it if it's taking what we're importing right
here and then it's doing that now in Linux and Unix based commands, you can use the this sign to execute
multiple commands on one line.
So if you do this, for example, in your own terminal.
So I'm just going to go to my terminal here and I'm just going to do less, which is the last command.
And then WD is what lists what shows your working directory.
So if I do, unless followed by this sign and then DPW deal, it'll execute both commands.
So it will do this and then it will show where the working directory is.
So we can do the same thing with this and see if it works for us, so we're going to put an IP Arite
IP and then I'm just going to do it and see if it'll execute deployability for me.
If it does, then this is a code execution vulnerability and I can execute anything I want on the server.
So let's see what's going to happen.
I pasted this and I'm going to hit submit.
And as we can see, we got big results, but at the end we got our current working directory, so it's
worth w D.V. w A is an exec.
So it executed DPW that I inserted.
And that means I can insert any commands I want in there and they'll be executed.
So I've inserted a resources file that will that you can use to get reverse connection from the target
computer.
Now, there's a number of ways, a number of commands that would give you a reverse connection.
All of these commands depend on the programming language.
So, for example, we have commands and we we have commands a ruby.
You have Perl commands and we have the one for Bash.
Bash is the.
The next shall command language so all Unix operating systems will be able to execute Basche commands,
so that's a very, very good way of doing it.
So most Unix system, this command should work on most Unix based systems.
So this would be a really good way of doing it.
Again, most of them would have Python, so Python would be a good way.
Netcare, most of them do have nice cat as well.
So in that case, it's a good way of doing that.
And we're actually going to use that cat in this video.
So.
Well, I'm going to do is first I'm going to listen for connections, just like we used to do with me
to exploit when we used to do multi handler.
You can actually use a multi handler for this and listen for connections.
Well, I'm just going to keep it simpler and show you a new way, and I'm going to use that.
So in that cat.
Not is just a tool that allows you to listen and connect computers together.
So I'm going to listen 880 so that Kattis the program, which just to see verbals output so we can see
a lot of output.
Anything goes wrong, we can see it and we're telling it to listen using the EL option on Port 880.
So I'm going to hit enter, and that's saying it's just listening to 88, that's all it's going to do.
The next commander we're going to do is we're going to try to connect from the Web server back to my
computer using that card as well.
So we're assuming the Web server has notecard.
We're going to try it and see if that works.
So the command is very simple.
It's not cut and we're telling it to use the bin bash.
And we're giving it the IP of my device, my ataca device, which is 10, 20, 14.
And then the port, which is 80, 80, which is worth listening on right here.
So I'm going to copy that.
And I'm just going to execute it the same way we used to execute the dependability command.
So the last thing we did was 10, 20.
Fourteen to three.
And then we did.
So what I'm going to do now, I'm going to remove the possibility and paste the code that we just created,
which will try to connect from the Web server back to the candy machine to the attacker machine.
And I'm going to come here.
And as you can see, we got a connection back from two to us from 10, 20 to over.
So that's the target computer.
And if we do a deal, you'll see that we have a reversal.
If we do, unless, uh, if we do an I.D., you'll see that whatever the data and if we do a you name
a just to confirm.
That in the exploitable and you can see that among the missile exploitable and I'm able to run any command
that I want on the target computer.
So basically I have full access to the target computer.