Now we actually have complete bash shell so we can run any bash commands we want the exact same commands
that we've seen in the Linux basic section at the start of this course.
So when we go on about how you do man and how you do help to see how you use the commands I'm going
to skip through that and I want to show you a few commands that are useful when you first gain access
to a server.
So the first thing you want to check is what's my privileges at the moment and the privileges depend
on how you gained your access.
So it depends on the page that you're getting your access through.
So we got our access through this current page so dependent on what privileges This page is run and
as we will get the same privileges when we get our first shell.
Same goes for us.
Same goes for everything really.
So I'm going to do my
and as you can see now my privileges are W.W. data.
So I'm not rude.
I'm not admin.
I'm not MSF admin MWW data.
And this is very important because when you're rude you can do anything you want on the server.
When you are another user then you have less privileges or less permissions to do stuff on the current
web server.
So another thing that you want to check is the kernel version of the computer so you can do you name
a.
And this will display a lot of information other than the kernel version.
So you see the computer name and you can see the version of the kernel.
This is important if you're trying to run a local exploit to escalate your privileges to a higher privileges
or maybe even get root privileges which will give you access to do anything you want on the on the whole
server not only on this website.
Now as I said you can run on and you know the commands that we learn so far.
So you can do allow us to list the current files and we can see that there is help and index and source.
You can do P.W. data to see where you are and we are currently at var w w w w o a vulnerability is an
exec.
So you can navigate through this exactly the same way you'd navigate with a normal index system.
So we can do a CD that data go back do a PDB needed and we're at vulnerabilities again she did that
and another she did that that.
Now if I do a PDA you'll see that as var W W W and this is the document root at the moment.
So if I do an l s l to get more information and note we can see here the permissions and before the
permissions.
Now if you see if you notice that there is a deal here that means that this is a directory it's not
a file.
And when you don't see that the that means it's a file.
And here now you can see that we have access to all the other websites so we can access decie wiki website.
We can also access demitted Today Web site and you can access the DVD right here.
So what this shows you is if you managed to hack into any web site then most of the time you can actually
navigate to the same websites on the same server.
And this is what I said in the information gathering section I said it's very important because sometimes
your target web site will not have any vulnerabilities but you might find something on the same server
and from that you can navigate to your Web site.
So for example we gained our access through DVD.
And let's say Mattel today was our actual target but we couldn't find anything in it.
So we hacked into the server through DVD.
And I can navigate now to Mattel day so I can just see the Mathilde they and then I can do an ls l to
see the files so you can remove files using the r.m command you can delete files you can do anything
you want really now.
And the other web site in Matilda even though we never actually got access to him until we got our access
through D-B W.J..
Now one of the very important commands is cat which allows you to read files and one very important
file that you always want to read is the easy password.
Now we actually try to read this used in the local file inclusion vulnerability.
But I want to show you now.
So if you do a cat it is password you can see that we can read all the content of this file right here.
And what this file has it shows you the users installed on the current computer and it shows you the
directory for these users.
Now in this particular set up all the Web sites are stored in wire w w w So they are sold and bar them
with W and then you can put divi W to access the DVD website or you can post Matile a day to access
Matilda.
Most of the time you won't see this in most websites.
They actually create a user for each website and the user usually corresponds to the website name.
So for example let's say your example your target was Facebook then the user would be called Facebook
or Facebook user or something similar to that.
So what you want to be doing is you want to go through this file and see the path for that for your
target website.
So let's say you hacked into this Web site through Google and Facebook is on the same server.
Then look for a user called Facebook and then just navigate to that file.
Now you can see that the deputy the readably data user right here and you can see that it has its directory
stored at bar w w w.
Again if you open that you'll see all the Web sites in here.
So if we just do see the bar then we can list whatever you want.
So take a lesson from this is that on a reverse shell you can basically run any command any linux command
you have dependent on the privileges that you have the privileges depend on the page or the source that
gave you the access.
So whatever privileges that resource is running you'll actually get the same privileges the same permissions
and once you're in a server the server is just a computer.
So once you gain access to that server you can increase your privileges.
You can escalate them and try to access other websites on the same server.
How you access the other web sites is in the ATC password you listed.
And you see the user corresponding to your target website and just open their directory using the CD
command I'm going to attach a list of the bash commands that you can run so that you can go through
them try them and see how they work for you.