I mentioned earlier that we really allow us to run a number of very useful functions on the target server
if we managed to upload its shell to that server.
So in this lecture, we'll see how we can convert our basic shell access to a weekly shell.
So I'm going to create a first of all, I actually have connection here coming from my Mehta's floatable
machine and my privileges are just normal w w w data.
As you can see now, what I'm going to do is I'm going to create my wife Michelle first.
So we've done this in the file upload vulnerability.
So it's very simple.
All you have to do is just run wibbly.
And then generate to create a shell or create a backdoor, and then we're going to have to set a password
for that backdoor and I'm going to set it to one, two, three, four, five, six, and then state.
Where do you want to save it?
And I'm going to save it and route.
And I'm going to call a show.
Now, in the file upload vulnerability, we actually created the shell with format.
Right now, I'm not going to create it because I have to download it from the meet exploitable machine.
When HP files are downloaded, the source code will not be downloaded with them.
So if I created a speech and downloaded from the floatable machine, it's not going to work properly
as I want it.
So I'm going to do I'm going to call it as I'm going to create it as Texte and then rename it once I
downloaded ADMET Exploitable Machine.
All I have to do now is upload it somewhere that is accessible by the meter exploitable machine.
So in real life scenarios, you want to be able to upload it to somewhere where you can directly access
the shell.
In this lecture, because we're doing it in our local and our local environment, I'm actually going
to just put it in my Web server, in my coffee machine, which is accessible by Amita's floatable.
So I'm just going to do c.p.
To copy and I'm going to copy, you wrote.
Shelled the text and I'm going to copy it to VAR W. W. w..
HTML, which is my documentary, and Carly.
And I'm also going to start my Web server, so I'm just going to do a service.
Apache to.
Start.
And now Apache's running, so I literally have I basically have a Web server now which contains this
current file.
Let's see if the file exists.
So I'm just going to come here.
And I'm going to go to my local, so pretty much I can just do localhost, but I'm going to put my IPU,
which is 10, 20, 14 to 13, and we call the child the texte.
As you can see now, we can see the code for the actual backdoor.
This is very important.
So when you upload it to a server, make sure that you can access the shell directly like this and make
sure that when you access it, you can see the code without anything on the sides, with no odds, with
no banners, with nothing showing up around it.
So you can literally access the barcode.
Once you do that and you have this yourself, all you have to do is just download it from demitasse
floatable machine.
So at the moment this is my metastable machine.
So if I do a you namei.
Just to confirm, you can see that I'm actually connected and inside demitasse floatable machine, so
all I have to do is download it, but I can't download it anywhere.
I need to download it somewhere again, accessible by my machine so I can connect to it.
So you want to you want to download it somewhere within the document route, within the VA w or whatever
document route your current website uses.
So if I do a.
You can see the inside word w w w w a. vulnerabilities, so I'm going to cede back to go one one step
back.
And if I do, unless here.
You can see the files that we have in this current directory.
Now, let's try to download the file in this current directory now, sometimes you won't be able to
download files depending on your privileges or permissions.
So I'm just going to do a double you get.
And this is the download command.
So you get can be used on Linux systems to download any files.
So you literally just do get and that and then you put the URL that you want to download.
So there you are.
That we want to download is HTTP.
10, 2014 to 13.
And then we call the file shell that.
Now, I'm going to give it some time to download.
And then I'm going to do analysis again.
And as you can see, we have a file called Shell Dot.
Now this file is uploaded on Dimmit exploitable machine inside DVD with vulnerabilities.
Again, if we do, you can see that we have devised a way followed by vulnerabilities.
So let's go and try to browse it in here and make sure that it exists.
10 2014 to 12, which is that's where our division is, and then we're going to go to vulnerability's.
And our file is called Shell, the TNT.
But I didn't put the TV before it.
And as you can see, we can access the file now, which is uploaded inside the vulnerabilities, we
can see our share of the GST.
Now, again, this is not good enough because it's not getting executed.
So now all we have to do is change its extension to again and again.
We're going to do that from our basic shell access right here.
So we're going to do M.V..
Shelled out to.
To shell that BHP.
And then do allow us to make sure that the process was done properly and we can see that our shell is
called Shell, that we now we can connect to the shell using our with the client.
So we're just going to do evely.
Give the shell, you are also our you are all the shell is stored now at HTP.
So this is where you uploaded the shell.
So it's it's exactly the same Yooralla as this, but with that, because we changed the file extension,
I'm actually going to copy this.
And I'm going to read this to you.
And then we're going to put the password, which is one, two, three, four, five, six.
Make sure you put the same password that you said when you created the backdoor hit Enter and as we
can as you can see where inside the Target computer were inside the target.
We can run all the commands that we usually allow us to do, so we can just do it and else.
I, W.D., and all the next commands, plus all the commands that we allow us to do, all the functions
that will allow us to do, which we're going to have a look on in the next videos.