And this lecture, we're going to see another method of exploiting local file inclusion vulnerabilities
and gain full share or full control over the target server.
So in the previous video, we've seen how to do with using the environ variable or environmental variables.
And in this lecture, we're going to see how to do it based on the logs.
These servers have a lot of log files and basically at the moment we can read any file on the server
as long as we have permissions to read it.
So if we can manage to write anything to any of these files, then we can pretty much execute code and
gain control over our target.
So what you need to do is you need to try and read any of the log files and see or think of a way to
interact with this log file so that you can write stuff on it.
For example, if the log files that you're reading or interacting with our mail log files, then maybe
you can send an email with a code and then it'll show up in the log file.
And our example, we're going to be using the VA log of that log.
And this file contains all the login attempts to the target server.
So let's do it and you'll have a better understanding at the moment.
Now, I just have the basic exploit and I'm trying to show it password.
So this is the file that we use in our basic exploit.
I'm just going to remove that.
And I'm going to look for one.
Log.
Northlake.
Now, as you can see, the file is readable and we can read login attempts to the target server.
So what we're going to do, we're going to think now this file displays all login attempts.
So why not try to log in and see if the attempt will be displayed here?
So I'm going to do here.
I'm just going to try to search into the server.
So I'm going to use S.H., as I say, which is just a lot of remote login service that is used by Web
servers.
Pretty much every Web server has it installed.
So we're going to try to access into it.
So we're going to do a search and then we're going to put the username and I'm just going to put a random
username that probably doesn't even exist.
I just want to see if this request will be recorded and the log file.
So I'm just as I'm going to SSA and I'm just going to put a username as random.
And then I'm going to do add and we get to put the IP address, which is 10, 20, 14 to 10.
I'm going to hit enter.
Now it's asking me for a password, obviously, this username doesn't exist anyway, so I'm just going
to put a random password as well.
I am not really trying to use an SS age, I'm literally just attempting to log in.
I'm going to control see now and I want to see if this will be logged in this file.
So I'm going to send another request.
And I'm going to look for my username, so the username was called random and I'll see if that was logged.
And you can see here, it's telling us and the log file, so it was recorded in the server that someone
tried to log in with the username random and it actually has my IP address.
So it's actually recorded my IP address as well.
So now we can read that file and we can also write to the file by logging in with a nonexisting account.
So what I'm going to do now is I'm actually going to try to log in again.
And instead of put in a username, instead of pulling the username as random, I'm actually going to
put the code that we always used to give me a reverse shell or reverse connection on the server.
Now, again, you can use any code you want.
In my example, I'm going to use code that will give me a reverse shell on the target computer.
So before I run the code, I'm going to listen on the part and I'm going to do that using that card
like we always did.
So it's going to be Ngarkat.
Evy l.P.
And I'm going to put my my part, which is eight eight eight eight.
And now we're listening for a connexions.
And I'm going to try to log in again to the target, and in this case, I'm actually going to put my
vehicle.
So same code that we used before.
So my username is going to be I'm going to put two quotes and then I'm going to put my code.
So we're using passthrough.
And then we're going to pass the command, the command that we want to run, and that command is going
to be I'm going to use single quotes here and then my command is going to be Netcare.
E!
Ben S.H..
Then I'm going to put my IP address, which is 10 2014 to 08, then I'm going to put the person I'm
listening on, which is eight eight eight eight.
Now.
With this method, you're only going to get one shot with this code because if you put the code incorrectly,
the whole thing is going to break and the file is not going to be displayed anymore because you have
an error in your code.
So what I suggest is I'm going to keep the pass through as it is, because that's a safe function and
I'm sure that this is going to run correctly.
I just need I forgot to put a semicolon here, so I'm going to put that there.
So I'm sure that this code is going to run correctly.
But I have a lot of minuses in here.
I have a lot of spaces and I have a lot of forward slashes which always have problems.
When you're trying to pass them between the next commands, you can try to skip through these characters.
But what I suggest is you actually encrypt this using base64 and then decrypted at the other end.
So I'll show you how to do that.
First off, I'm going to copy this command.
So this is the digital command that we want to pass through function to run and copied it.
I'm going to go to my website.
And I'm going to go to my decoder here.
We never had to look on the decoder, so this allows you to encode and decode text to different types
of encoding.
So I'm going to paste what I copied.
And I'm going to encode it as base64.
So this text, the net Katherine as hedge, my IP port is converted to this encrypted code, I'm going
to copy this code.
And I'm going to substitute it here into my command, so instead of running it like this, instead of
pulling the text, I'm going to put the base64 code to make sure that there is no special characters
that would interfere with the command, with the bush.
So I have that copied now if I run this this way, so I have my passthrough, which is a function and
I'm telling it to execute this shall command.
Now, obviously, if you copy this text and run it, it's not going to run anything because it's just
gibberish.
So I need to tell it that this is basically 64 code and I'm going to do that using the HP function called
Base64 Decoded.
So I'm going to tell it to decode this this piece of text and then once you decoded, run the pass through
on it.
So I'm just going to type it in here, so it's going to be.
Base64.
Decode, and that's just another function, uh, function.
And then I'm going to put the brackets.
So I'm just going to make this a little bit bigger so we can talk about it more.
And I'm just actually going to copy and run it again just so that we will talk about it a little bit
more.
OK, so first off, we're actually using the username as our code, as the code that we want to inject
because because as we see the user name is being displayed on the log page.
So anything we put in the user name will be executed as BHP code.
So we have that between two quotes here between this and this quote.
Now we have our record that we always use and we also always used the Pass-through function to run Unix
commands on the target server.
So we're keeping that the exact same and we're telling it to run this text.
But before you run this text, I want you to decode it based on base64.
So we have passed through the code, the following code, and this is the code.
So this is the command net cut command that we always use.
We're decoding it based on base64 and then we're telling it to run it using the passthrough function
to execute it as a Basche command.
So I'm going to hit enter now.
And that's asked ask me for a password because it thinks that this is actually a username, so we're
injecting the whole thing as a username.
So I'm just going to put any password, anything random had enter.
Now, this should be stored now and the logs.
So this code should have been injected into the Alstott log.
So we're going to go back now to our browser.
And you can see that I'm already listening here, so I'm just going to hit enter here on the browser
and as you can see, we got a connection back from our Target website.
And if we do it, you'll see that arm into the target website with the data username or user group.
And I can run commands or do whatever I want on the target server.
This is just another method of exploiting local file inclusion vulnerabilities to get a show on the
target computer.
Now, again, this is just an idea and you can try these ideas with different types of log files so
you can try it with the dot log.
You can try it with any other type of log files.
But you need to think about it.
You need to think how you could inject code into that log file.
So, for example, as I said, if it's a male servers and then try to send us an email, if it's the
dot log like we have in this current example, then try to log in using S.H. and see if you can inject
code and if that code will be executed on the target computer.