Now let's see how we can upload files to the server, so uploading files can be very useful because
you can use it to literally upload anything you want so you can upload any script that you want.
Scripts can be used to do anything.
You can use it to gain a reversal.
You can use it to execute commands on the server.
You can use it to connect to the database and browse through the files.
And you can even use it to exploit local vulnerabilities such as buffer overflow and code execution.
So the possibilities are endless, really, one thing to note is that now when I check my privileges,
so if I do, who am I to check the current user?
You'll see that the W w w data and the current website is running under that user.
So basically I can do anything I want on this website because I am the owner of this website at the
moment.
And a lot of the cases, depending on how you gained your access to the website, your privileges might
be nobody.
So when you do your who am I?
Instead of getting the data, you'll be who you'll be nobody.
And when you are nobody, you can't upload it anywhere you want.
You can only upload to directories that has seven seven seven permissions.
So two directories that basically allow anybody to upload to them.
So if you do Ellas.
He can see that we have all all of our files and he can see that all of them are owned by the data,
which is me.
So this is the parent directory and this is the current directory.
And these are just normal directories and files and the current working directory.
And you can see that all of them are owned by me.
Therefore, I can upload anywhere.
But what we're going to do in this lecture, we're going to pretend that we can't upload anywhere.
We're going to pretend that I am nobody.
And if I were to upload something while being nobody, we have to upload it to a place where everybody
is allowed to upload files and that place, which should have seven, seven, seven permissions.
So these are the permissions here.
And what they look like is they should look like this.
So there should be no minuses in it, and it will basically mean that everybody can do anything they
can read, write and execute.
So we can see from the directories here now, the directories start with Eddie and the permission,
so we can see that from the directories here, we have nothing with 777 permissions.
So we actually have to look around.
I'm sorry I clicked control see there, so I'm just going to go back and connect back to Evely.
So, again, we're going to do this and we're we're in via the WWE.
And where I want to go is we can see an interesting director here called Hackable.
So let's go in it and then let's see what's in there.
So we're going to go into hackable.
Using CD command and then again, we're going to do Lizelle.
And again, there is nothing really interesting here, so let's go back.
And we're going to navigate back again.
And if we listen here, you'll see that.
We are in the root directory and we can navigate to different websites now.
And if you notice, we have a directory called the here.
Now, if this directory does not belong to us, it actually belongs to the root user.
So it doesn't belong to the data, which is us.
But we can actually upload stuff here.
Why?
Because it has the permissions that allow everybody to upload.
So it has seven, seven, seven permissions which looked like this.
So we're going to navigate into that place.
Dove, we're going to listen to see if there is anything already there, and we can see that there is
no files whatsoever there.
So we're going to upload our file and we're going to use a function called file upload.
We're going to do the minus like you like usual.
And you can see that the way you use this function is you type in file upload first.
You can use the minus F to force override to override the file if it exists already.
You can specify the file content and you can specify the vector, and again, the vector is the method
of how the file is going to be uploaded.
And I'm going to keep this the default.
So I'm not going to use the minus vector.
And then you give the local path, so where the file is stored on your current computer, on our Calli
machine, followed by the remote path.
So where do you want the file to be stored on the target server?
So the file that I want to upload is located in my route.
So if we go to the file manager, you'll see that I have the file in the route and it's just called
Testaccio.
It's actually a shell, but it's just called test the text.
So we'll try to upload that.
So our local directory is going to be route.
Testaccio.
And we want to upload that to the remote part of the current path, so if you want to specify the current
place, the current working directory where you are, you just have to put a dot followed by a forward
slash.
So this is where we want to upload it and then we have to give it a name.
So I'm going to call a channel or test.
Show.
Uploaded.
The text just to name so we know that the file has been uploaded correctly.
So, again, the command is very simple as file upload, you specify where the file is stored on your
current machine and mine is stored in route and it's called Testor Text.
And then you specify where you want to upload it, and I'm going to upload it to the current working
directory.
That's why I have a dot forward slash and then followed by the name that I want to call it.
So I'm going to call a test.
Shall uploaded the text.
I'm going to hit enter.
And you can see that it's given us a true statement, which means that the file has been uploaded if
we do analyze.
You'll see that the file has been uploaded to this particular directory.
So now we can go to our Web browser and we uploaded the file to a directory called Dove and then we
called it just Shel uploaded the text.
And as you can see now, we can see the file has been uploaded and this is the actual content of the
file, it's an encrypted shell, so it has been uploaded perfectly or correctly.
And again, we uploaded it to a directory that doesn't belong to us.
But the main idea is the directory has to have seven, seven, seven permissions.
And that way, even if you have and nobody, even if you are nobody, you can upload to that directory.
If the directories have your permissions, like the data here, all these directories we can upload
to them regardless of the permissions they have because we are the data.
So what I showed you here is just an example of how you would upload files if you had nobody permissions.