And this lecture I'd like to show you how we can use a skill injections to read any file on the server.
So even if the file exists outside GWW root we'll be able to read it exactly like a file.
Disclosure vulnerability.
And we'll also see how we can use it to write files and upload them to the system just like a file upload
vulnerability.
So the first thing we're going to have a look at is the reason the file and I'm going to set everything
to know here.
So I have my statement here and I'm going to set select one I'm the Live number two because I'm going
to do stuff in that.
And we're going to do another three here so no no no.
So we have select not something.
No no no.
So five because we have five records when we did the Order By.
And instead of selecting something.
Remember in the third video we did select database for example and it showed us the current database.
What I want to do now is I want to do another function and that function is called Load file
and in here I'm going to set the file that I want to load and I'm going to use the same file that we
have the lock on in the file includes vulnerability.
And it was.
If you see password so we're trying to read that file and our statement is union select that file and
that's it.
So I'm going to copy this and I'm going to inject it here and I'm going to add my percentage 23 which
is my comment.
And as you can see we managed to read all the information all the content of it password even though
it's not in the webroot So it's stored in it is the password so we can read anything in the server from
other websites from other files anywhere in the server.
We can read that by specifying the full path of our file.
The next thing I'd like to show you is writing to the server.
So we're actually going to write stuff to the server.
And this is very useful because you'll be able to write any code you want.
So for example you can write the code for a PH script you can write it write a code for a shell a virus
or a PH We code to get our connection to you.
So it's basically just act like a file upload vulnerability.
And to do that I'm going to write the code that I want to do here and I'm going to call that for example
just example example.
And we're going to use a function called outfight.
So we're going to do into I would fall and then we're going to specify where we want to store that file.
Now in best case scenarios you'd be able to write to your Webroot and that will mean that you can access
the file through the browser and execute it so you can upload a weekly file and then connect to it and
do stuff like that.
So let's try to do that first.
So we're going to do it in our W W W and that's our web route.
So we'll be able to access things through it or you can put it even Varda WW and then put Matel day
after it to store it in there.
So the command is very simple again Union select make sure you set everything and also that nothing
gets written into the file except what you put in here.
And I put the example example and it's going to be stored into our file enviro Debney WW Matel day.
And we call that example.
The.
Let's try to run this and see if it works.
Now this didn't work.
And if you come down here you'll see that you out or my skill is not allowed to create or write to this
directory.
So the problem is we're not the permissions that we have don't allow us to write to this particular
location.
So just to test this exploit I'm going to change this location to GMP which is the time and you'll see
that you can actually write them.
So in real life scenarios.
It depends.
You can try it and see if you're able to write stuff or not.
And this we're trying to write now.
And if we read in term if we hear that and then ls and
10 you'll see that we have something called the example and if we try to read that you'll see that it
contains.
Obviously it contains the content of what we did before which was the normal selection that you'd see.
So what you see for putting the stuff for other men and then it showed us what's in there which is example
example which is what we wanted to write to the file.
Now you can obviously get rid of the admin and the admin pass stuff by just putting a wrong username
and nothing's going to be displayed here.
So the only thing that you'll see is the output which is example example.
But again this is only useful if you're able to write your web server so you can access it and then
use your shell or use your payload and further exploit the system.