And the previous lecture we see and how we can write stuff to the server use and a skill injection used
in the into out file function.
And if the server allow us to write to the web directory to our place that we can browse then we can
just write our reverse show using the same code that we've seen before use and pass through and then
we can browse it and we'll get a reverse shell exactly the same way that we did when we upload the file.
The problem is we weren't able to write stuff to the web directories so we can't actually read the stuff
using the R L.
The only place that we could write to was that VMP.
So you can't actually browse the MP through your l.
Therefore you can't just browse that file.
So I'm going to do today is I'm going to show you a workaround for that problem but for this workaround
to work the same website or the same server has to have a local file inclusion.
This is very important.
The same web server not the same Web site because we see and remember in the first section how we can
discover all the Web sites that are within one server.
So if one of them has an obscure injection and the other has a local file inclusion you can combine
both of these and get a shell and I'll show you how to do that.
So I'm actually going to be doing this on the DVD.
You can do it on Matel day but I'm just doing it here just for a change to show you just another example.
So I'm going to the skill injection and I'm going to put number one here
submitted and then we're going to start doing our injection exactly the same way that we always did.
So we close the quote and we do a union select one to our comment and that's work.
As you can see now what I'm going to do I'm going to write my shell to TNP and then I'm going to browse
that shelf through the local file inclusion.
So my exploit is going to be unique select one to and in one I'm actually going to write what I want
to write to the file.
So I'm going to write a PH code the same ph code that we've been using to get a reverse connection to
my computer and the code is going to be passed through and see bin sh my IP the port which is 80 80
and instead of number two I'm going to put null so nothing will be written to the file.
And then we're going to say into our file
and we'll call this reversed BHP.
So let's just have another look on this exploit.
So what we're doing we're doing a normal Union select and we're doing a normal into our file and we're
saving this in the TNP exactly like we've seen in the previous lecture.
But instead of writing just normal stuff we're actually going to write ph code and we're going to do
a pass through and see bin sh my IP port and what this is going to do it's actually going to try to
connect to this IP using netcat.
So let's exploit this.
And I'm actually going to said the idea here to minus one so that no values come in for the admin and
admin in here in the first name and the surname.
So I just said that to minus one and then I'm going to put my exploit here after the minus one say that
we always do it and enter and it tells us that the file already exists but it actually does and this
is just the normal error.
So this file has been written now to the server.
Now the problem is if if we load this file to somewhere else other than DMP.
So for example if we can actually write this file to say var the WW D-B w a then we'd be able to just
go and browse this file from here.
So all we have to do is just go to the w t to this and then right in reverse the THP and then we'll
be able to see it.
But again we actually don't have permission to write in here.
You can try to write in images for example GBW 8 images so you can actually before you go to this method
you can go ahead and try to find a place or ridable place on the server.
A lot of the time you want.
Because web admins should actually know about this and show you they shouldn't allow you to write stuff
like that.
But if you did then you're lucky you can just go ahead and browse it like this if you didn't then just
continue this video and see how we're going to exploit it.
So now I'm just going to listen for connections use and and netcat.
So I'm going to do and see the LP 88.
And that will listen for incoming connections on port 80 80.
So when we execute this code it'll try to connect back to us and we'll get the connection here.
So now we have the file written and we're listening in on connections.
All we need is a way to browse this file to get it executed.
So we see in that we can't actually write anywhere that we can browse it and because we start this in
time if you managed to run it from anywhere on the web server then you'll have connection and you'll
have access to this website.
So you don't have to find a local file inclusion in the same website.
You can find it in any web site in the same server.
And this is where the information gathering part comes in really handy.
So I'm going to do what I'm going to do now is I'm actually just going to run from within DVD-Video
8 but I just want you to know that you can do this.
Since we started in the TNP you can open it and browse it from within any web site on the server.
So all you have to do is just find a web site on the same server that has a local file inclusion.
Now I'm going to go to the file inclusion and we've used this before.
So what I'm going to do is I'm just going to browse to it passwords first to make sure it works and
it works.
Now we're going to browse to our file that we just uploaded which is stored in DNP
reverse that BHP.
And as you can see now we've got a connection and we can run any commands we want on the server and
very much we have a reverse shell and we can do whatever we want on it.
Now I'm going to listen on AT&T again and what I want to do is I want to show you how you can exploit
this now from anywhere within the server.
So I'm actually going to go to Mattel today instead of DPW 8
and we're going to go to the local file inclusion vulnerability in here.
So we'll try to exploit this now the same way.
So it's five times back
UTC password.
And as you can see we can read the HTC password.
Now all we have to do is just read that VMP.
So this is a completely separate website from DVD-Video.
We found let's assume that we found a scale injection in DVD anyway and then we found a local inclusion
in this combining the two because the two websites are installed on the same server on the same computer.
We can actually get a reverse shell on that server and do that.
We're just going to go to TNP airburst APHC.
And again as you can see we have our shell here where we can do whatever we want on the target's web
server.
So again the idea to take from here is use an into out while you can write stuff anywhere.
If you can write stuff within the web directory then you're lucky you can write your reverse shell and
just browse it through with your file as if you're browsing any file on the web server.
If you can't then look for another Web site on the same server that has a local file inclusion and if
you do then you can just write the file using the SQL injection and then browse it using the local file
inclusion and you have your show.