And this lecture, I'd like to show you how we can use Eskil injections to read any file in the server,
so even if the file exists outside the W-W route will be able to read it exactly like a file disclosure
vulnerability.
And we will also see how we can use it to write files and upload them to the system, just like a file
upload vulnerability.
So the first thing we're going to have a look at is the reason the file and I'm going to set everything
to null here.
So I have my statement here and I'm going to set select one.
I'm going to need leave number two, because I'm going to do stuff in that and we're going to do another
three nosier.
So no.
No.
Now, so we have selected not something.
No, no, not so five, because we have five records when we did the order by and instead of selecting
something, remember in the third video, we did select database.
For example, and it showed us the current database, what I want to do now is I want to do another
function and that function is called L'Etoile.
And in here, I'm going to set the file that I want to load and I'm going to use the same file that
we had the look on in the file inclusion vulnerability.
And it was etsi password.
So we're trying to read that file and our statement is unions select that file and that's it.
So I'm going to copy this.
And I'm going to inject it here and I'm going to add my percentage 23, which is my comment.
And as you can see, we managed to read all the information, all the content of ETEK password, even
though it's not in the webroot, so it's stored in ETEK password.
So we can read anything in the server from other websites, from other files, anywhere in the server.
We can read it by specifying the full part of the file.
The next thing I'd like to show you.
His writing to the server, so we're actually going to write stuff to the server and this is very useful
because you'd be able to write any code you want.
So, for example, you can write the code for a script.
You can write or write a code for a shell, a virus or a code to get a reverse connection to you.
So it'll basically just act like a file, upload vulnerability.
And to do that, I'm going to write the code that I want to do here, and I'm going to call that, for
example, just an example.
Example.
And we're going to use a function called outfalls, so we're going to do into.
I would file and then we're going to specify where we want to store that file now, in best case scenarios,
you'd be able to write to your webroot and that would mean that you can access the file through the
browser and execute it so you can upload a file and then connect to it and do stuff like that.
So let's try to do that first.
So we're going to do it inva.
W w w and that's our webroot, so we'll be able to access things through it, or you can put it even
via w w w and then put Mattilda after it to start in their.
So the math is very simple again, union select, make sure you set everything to know also that nothing
gets written into the file except what you put in here.
And I, for example, example, and it's going to be stored into a file and via w w w mattilda and recall
that example.
The steep.
Let's try to run this and see if it works.
Now, this didn't work, and if you come down here, you'll see that.
Askew or my Ezekial is not allowed to create or write to this directory, so the problem is, were not
the permissions that we have, don't allow us to write to this particular location.
So just to test this exploit, I'm going to change this location to Tempe, which is the temp, and
you'll see that you can actually write to temp.
So in real life scenarios, it depends.
You can try it and see if you're able to write stuff or not.
And this we're trying to write to temp now.
And if we read in temp.
If we clear that and then Ellas and.
And you'll see that we have something called example, and if you try to read that, you'll see that
it contains obviously it contains the content of what we did before, which was.
The normal selection that you'd see, so what you see for putting the stuff for admin and then showed
us what's in there, which is example, example, which is what we wanted to write to the file.
Now, you can obviously get rid of the admin and the admin stuff by just putting around username and
nothing is going to be displayed here.
So the only thing that you'll see is the output, which is example, example.
But again, this is only useful if you're able to write to your Web server so you can access it and
then use your shell or use your payload and further exploit the system.