And the previous lecture, we seeing how we can write stuff to the server using an Ezekial injection,
using the into outflux function, and if the server allow us to write to the Web directory to our place
that we can browse, then we can just write our every show using the same code that we seen before using
the pass through.
And then we can browse it and we'll get a reverse shell exactly the same way that we did when we upload
a file.
The problem is we weren't able to write stuff to the Web directory, so we can't actually read the stuff
using the URL.
The only place that we could write to was the top.
So you can't actually browse the top through the URL, therefore, you can't just browse that file.
So what I'm going to do today is I'm going to show you a workaround for that problem.
But for this workaround to work the same website or the same server has to have a local file inclusion.
This is very important, the same Web server, not the same website, because we see and remember in
the first section how we can discover all the websites that are within one server.
So if one of them has an actual injection and the other has a local file inclusion, you can combine
both of these and get a shell and I'll show you how to do that.
So I'm actually going to be doing this on the TV.
You can do it on Mattilda, but I'm just doing it here just for a change to show you just another example.
So I'm going to the ESKIL injection and I'm going to put no one here.
Submit it and then we're going to start doing our injection exactly the same way that we always did,
so we closed the quote and we do unions select.
One to.
And our comment.
And that'll work, as you can see now, what I'm going to do, I'm going to write my shell to top and
then I'm going to browse that shelf through the local file inclusion.
So my exploit is going to be under select one to.
And in one, I'm actually going to write what I want to write to the file, so I'm going to write a
code, the same page because that we've been using to get a reverse connection to my computer.
And the code is going to be passed through.
NCEA.
Ben S.H., my IP.
And the port, which is 880.
And instead of number two, I'm going to put NUL so nothing will be written into the file.
And then we're going to say into our file.
And we've called this reverse that BHP.
So let's just have another look on this exploit, so what we're doing, we're doing a normal union select
and we're doing a normal into our file and we're saving this in the top exactly like we've seen in the
previous lecture.
But instead of writing just normal stuff, we're actually going to write code and we're going to do
a pass through NCEA been S.H., my IP port.
And what this is going to do, it's actually going to try to connect to this IP using that card.
So let's exploit this.
And I'm actually going to set the idea here to minus one so that no values come in for the admin and
admin in here and the first name and the surname.
So I just said that to minus one.
And then I'm going to put my exploit here after the minus one.
Same way that we always do it.
And enter.
And it tells us that the file already exists, but it actually doesn't this is just a normal error.
So this file has been written now to the server.
Now, the problem is if if we load this file to somewhere else other than top, so, for example, if
we can actually write this file to say var w w w D.V. w a, then we'd be able to just go and browse
this file.
From here.
So all we have to do is just go to the W to this and then right in reverse that and then would be able
to see it.
But again, we actually don't have permission to write in here.
You can try to write in images, for example, DPW images.
So you can actually before you go through this method, you can go ahead and try to find a place or
writable place on the server.
A lot of the time you want, because if Web admins should actually know about this and show you, they
shouldn't allow you to write stuff like that.
But if you did, then you're lucky.
You can just go ahead and browse it like this.
If you didn't, then just continue this video and see how we're going to exploit it.
So now I'm just going to listen for connections using net cut.
So I'm going to do Essive VLP.
Eighty.
And that will listen for incoming connections in Port 880.
So when we execute this code, it will try to connect back to us and we'll get the connection here.
So now we have the file written and we're listening on connections, all we need is a way to browse
this file to get it executed.
So we see that we can't actually write anywhere, that we can browse it.
And because we saw this in temp, if you managed to run it from anywhere on the Web server, then you'll
have connections and you'll have access to this website.
So it doesn't you don't have to find a local file inclusion in the same website.
You can find it in any website, in the same server.
And this is where the information gathering part comes in really handy.
So I'm going to do what I'm going to do now is I'm actually just going to run from within DPW.
But I just want you to know that you can do this since we started in the top.
You can.
Open it and browse it from within any website on the server, so all you have to do is just find a website
on the same server that has a local file inclusion.
Now, I'm going to go to the file inclusion, and we've used this before.
So I'm going to do is I'm just going to browse to.
It is password first.
To make sure it works and it works now, we're going to browse through our file that we just uploaded,
which is stored in Tempe.
Reverse.
That BHP.
And as you can see now, we've got a connection and we can run any commands we want on the server.
And pretty much we have a reverse shell and we can do whatever we want on it.
Now, I'm going to listen on AT&T again, and what I want to do is I want to show you how you can exploit
this now from anywhere within the server.
So I'm actually going to go to Mattilda instead of W8.
And we're going to go to the local full inclusion vulnerability in here.
So we'll try to exploit this now the same way, so it's five times back.
XY password, and as you can see, we can read the password now, all we have to do is just reach the
top.
So this is a completely separate website from the way we found.
Let's assume that we find an ESKIL injection in DPW.
And then we found the local inclusion in this, combining the two because the two websites are installed
on the same server, on the same computer, we can actually get a reverse shell on that server.
And doing that, we're just going to go to Tampoe, reverse we.
And again, as you can see, we have our shell here where we can do whatever we want on the target web
server.
So, again, the idea to take from here is using into out while you can write stuff anywhere.
If you can write stuff within the Web directory, then you're lucky.
You can write your reverse shell and just browsing through the URL as if you're browse in any file on
the Web server.
If you can't, then look for another website on the same server that has a local file inclusion.
And if you do, then you can just write the file using the actual injection and then browse it using
the local file inclusion.
And you have your Warshel.