OK, now that we managed to execute commands on the server using the low security settings, let's see
if we can set it up to medium and if we can do the same after increasing the security.
So we cover the basic case.
And now I'm going to go to security and I'm going to set the security level to media.
I'm going to submit this.
Then we're going to go back to our command execution and I'm going to put my IP.
Now, I just want to know that my IP is different.
Now, if you notice that the IP of the server right now is two or nine and my machine IP is toits if
I do have config.
You can see that the IPO of my candy machine is too late.
So again, I'm going to try to bring the candy machine.
Let's just first see if we can bring something.
So we're assuming that we don't know this Web site.
And again, this is going from a black box point of view.
So we're not going to look at the source code.
So we're just going to run this website.
Stillness is going to pink stuff for us.
So I'm just going to put the IP of the color and see if the pink works.
So we're just going to put 10.
And as you can see now, the ping command is working now let's see and try to do what we did before.
So we used to do we put the IP and then we use the semicolon to say that run this command and this command
and in the low security settings, this used to work for us.
So we're going to submit this.
And at the bottom, it should show us our current working directory because we have the ability here.
So I'm submitting this.
And as you can see, nothing got executed, so not even the Pinkham got executed.
So, again, looking for a black box point of view, we're going to think, oh, maybe they're using
some sort of filtering on the semicolon.
So they're checking of the command, contains a semicolon.
Then they're going to ignore that command and not run it.
So we're just going to try to use another trick, something similar to the semicolon.
So what we used to do before, we had an example of the one else.
So that's the last command and or and dependability is what was the working directory?
And we can combine these two by doing Ellyse.
Semicolon, and then we do the bloody.
And that will do both.
It will do the allies and the deep so that we used to work for us doesn't work anymore because they're
probably filtering based on this specific character.
So what we're going to do is we're going to use something else available for us in the Unix commands,
which is the pipe.
So piping is really useful when it comes to Unix.
You'll use it a lot.
What it basically does, it means run the first command and once you run that command, send the output
or the output to this command and run the second command on it.
So essentially it'll run two commands in our case.
Now, you can use PI for a lot of things and it's used into projects and things like that for us.
All we want to do is we're interested into getting the second command to run.
So let's have an example of this.
So we're going to do less, which is going to be similar to our ping.
And then we're going to put the five character, which is the vertical bar, and then we're going to
put the second command that the output should be passed to.
Now, Peter doesn't expect any input to be passed to it.
So at the moment when we run this, it'll basically run both.
But it won't show you the result of running unless it will feed it to Peter and show you the results
of Peter.
So when I hit enter, you'll see that Peter got executed.
So in our example, what's happening is we have a ping.
Then we're inputting our IP, so we're going to put our IP.
And then we're going to use the word character and we're going to put the second command that we want
to run, which will be the command that will give us shell on the server.
But for for the testing, we're just going to do a PWP.
And again, as you can see, we don't see the results of the pig.
We only see the result of the pit because again, for the third time, this command, it'll run this
and feed the output to.
So let's try this in here, so we're going to do we're going to put our IP again like we did before
and we used to put findability like that, but I'm just going to put my bar character.
And enter.
And as you can see, the second command got executed and we got our current working directory.
Now we can modify this to get a shell on our computer.
So, again, we're going to use the bar.
And we're going to get it to you.
We're going to use the exact same method that we used last time, so we're going to do a C minus E.
And put my IP.
And then I'm going to put the part, which is 80, 80 now before I execute this, I'm going to listen
on Part 88 for a connection here.
And we're going to use the same command like before using that cut.
So and see the V LP 88.
This is listening, and we're going to connect back from here to the Karlee hit submit and sure enough,
we get a connection here that allow us to run any command we want on the server so we can do this now.
We can list the files, we can get our ID or do anything we want on the current server.
So we basically managed to gain access to that website.