Just like we did before in the last video, we put five times back and then we put a password to access
the password file, what we are going to do today is we're going to try to access a file located on
a different server.
So if you are doing this test on an actual Web server, then you need to store the file that you want
to access, needs to be stored on a place with a real IP address or with a domain name.
I'm doing this on my local server, so I'm going to start this on the on the Web server, on the candy
machine, on the 10, 20, 14 to three.
This is then 2014 to 04.
And I'm going to store my file on 10, 20, 14, two or three.
So that, far as I said, can be anything, it could be a Web show.
It could be a payload.
Well, what I'm going to do is I'm going to create a very simple file.
So this is just the start and end of the file.
And what I'm going to put in the file, I'm going to use a function called passthrough.
And in that function, basically what this function does, it executes operating system commands.
So it executes Windows, Linux, or depending on the Web server, it's going to execute commands related
to that.
So you put the command here between the two quotation marks and I'm going to use the same command we
used with the code execution for vulnerability, which was the net cut command, which allowed us to
get a connection or reverse connection from our target.
So going to that here.
So let's just first have a look on this.
So in the end, these are just the start and the end of the file of the file pass through is a function
that I'm going to use which executes any commands that's inserted between the quotations.
And I'm using the same command that we used in the command execution vulnerability, which will just
do a reverse connection to my computer.
So this is all good.
Now, the next step is the most important step, and it's starting this file.
So as I said, if your target.
Was a remote Web server, then you should be stored in this file in a place with a real IP where you
can access it from the remote Web server.
Now, I'm going to be trying to access this from my transplantable machine, which is able to access
files stored on the candy machine because they're both on the same network.
And I'm going to be calling this I'm going to be storing it in my bar w w w html.
So it is being stored on the Karley, not on the floatable.
And I'm going to call it reverse and I'm going to save it as to not be.
And I'm doing this if I started as a viewer, it's going to be executed on the candy machine, so it's
going to create a reverse connection from the candy machine.
And I don't want that.
I don't want to have the machine.
I actually already have access to the candy machine.
The one that I want to hack is demitasse floatable machine, and that one is stored remotely.
So in order to be able to include the code and execute it on the remote machine, we're going to use
it as texte and get it executed or demitasse floatable machine and instead of executing it on my calendar.
So I'm I'm studying it as a text and I'm going to say Sabor.
And now let's just see here, so if I go to my localhost.
And if I say.
Reverse the text, will see our file right here, so again, this is on my localhost, which is not
the floatable machine.
It's 10, 20, 14, two or three, and it's floatable is on to offer.
So how are we going to run this?
First, let me just listen for connections like we did before, so it's just going to be notecard.
The LP 80 80.
And then right here, instead of including a file on the same server, I'm going to include a remote
file and the command is going to be TPE.
So it's just going to be the link to this file so we can access the file here as I'm going to copied
and pasted here.
And also, in some cases, you might need to add a question mark to the end to get this file to be executed.
So I'm just going to go over this again for one more time, including a remote file, which is on a
remote server.
Make sure the remote server is accessible by your target and also make sure you started it, because
if you keep it as this file, the reverse file will be executed on the remote server.
So it will be executed on the two or three instead of being executed on the two or four.
And I'm keeping it this way.
It will be it's going to be executed on the two or four and it's going to give me a remote connection
to this computer, to demitasse floatable computer.
So if I come back here, as you can see, we have a remote connection, if we do a you name A, you'll
see that this is the Mehta's portable machine, not the candy machine.
So we basically have full access to the floatable machine through and a remote file inclusion vulnerability.
Now, if you do, unless we can do a deal to see where we are and we can actually run and in the next
command we want now on the machine and do anything we want, basically, we have full access to that
machine.