I mentioned earlier that we really allow us to run a number of very useful functions on the target server
if we managed to upload its shell to that server.
So in this lecture We'll see how we can convert our basic shell access to a weekly show.
So I'm going to create a first of all I actually have connection here coming from my as floatable machine
and my privileges are just normal WW data as you can see.
Now what I'm going to do is I'm going to create my weekly shop first.
So we've done this in the file upload vulnerability.
So it's very simple.
All you have to do is just run willy and then generate to create a shell or create a backdoor and then
we're going to have to set a password for that backdoor and I'm going to set it to 1 2 3 4 5 6 and then
state where do you want to save it.
And I'm going to save it en route and I'm going to call the Chell now and the file upload vulnerability
we actually created the shell with PH pre-formed.
Right now I'm not going to create it in PHC because I have to download it from the meta exploitable
machine when P2P files are downloaded the source code will not be downloaded with them.
So if I create it as BHB and downloaded from the Matthias bloater will machine it's not going to work
properly as I want it.
So what I'm going to do.
I'm going to call it is I'm going to create it as the XTi and then rename it once I downloaded dimittis
profitable machine.
All I have to do now is upload it somewhere that is accessible by dimittis floatable machine.
So in real life scenarios you want to be able to upload it to somewhere where you can directly access
the shell in this lecture because we're doing it in our local and our local environment.
I'm actually going to just put it in my web server in my Callimachi machine which is accessible by me
to exploit people.
So I'm just going to do C-p to copy and I'm going to copy it
Shell dirty XTi and I'm going to copy it to Vire w w w Hastey Emma which is my document through it.
And Kelly and I'm also going to start my web server so I'm just going to do a service
Apache to
now Apache is running so I literally have I basically have a web server now which contains this current
file.
Let's see if the file exists.
So I'm just going to come here.
And I'm going to go to my local host so pretty much I can just do local host when I'm going to put my
IP which is 10 20 14 to 13 and we call that shell that takes the as you can see now we can see the code
for the actual backdoor.
This is very important so when you upload it to a server make sure that you can access the shell directly
like this and make sure that when you access it you can see the code without anything on the sides with
no odds with no banners with nothing showing up around it so you can literally access the barcode.
Once you do that and you have this you're out.
All you have to do is just download it from the meatiest floatable machine.
So at the moment this is my potable machine.
So I do a UNAMI just to confirm you can see that I'm actually connected and inside the political machine.
So all I have to do is download it but I can't download it anywhere.
I need to download it somewhere again accessible by my Tele machine so I can connect to it.
So you want to you want to download it somewhere within the document root within the VAR.
W W W or whatever document through your current website users.
So if I do a b w d he can see the inside wired w w w w a vulnerability.
So I'm going to see the back to go one one step back and if I do an ls here you can see the files that
we have in this current directory.
Now let's try to download the file and this current directory.
Now sometimes you won't be able to download files depending on your privileges or permissions.
So I'm just going to do a double you get.
And this is the download command.
So you get can be used on Linux systems to download any files.
So you literally just do you get that.
And then you put the you are all that you want to download.
So do you are that we want to download.
Is Hastey keep.
Turn 2014 into 13 and then we called the file Shelder ATX the.
Now I'm going to give it some time to download and then I'm going to do an Ellis again.
And as you can see we have a file called Chell that XTi.
Now this file is uploaded on dimittis floatable machine inside DVD DVD.
A vulnerability is again if we do the melody you can see that we have DVD.
Followed by vulnerabilities so let's go and try to browse it in here and make sure that it exists.
10 2014 to 12 which is that's where our DVD is.
And then we're going to go through vulnerabilities and our file is called Shell go to the but I didn't
put the DVD right before it.
As you can see we can access the file now which is uploaded inside DVD vulnerabilities.
We can see our shell that the XTi.
Now again this is not good enough because it's not getting executed.
So now all we have to do is change its extension to PH HP again and again we're going to do that from
our basic shell access right here.
So we're going to do the Schelde TXU to Shelder BHP
and then do allow us to make sure that the process was done properly and we can see that our shell is
called Shelder ph.
Now we can connect to the shell using our weekly client.
So we're just going to do Weili give the shell.
Are also our you are l the shell store now at Hastey therapy.
So this is where you uploaded the show.
So it's exactly the same as this but with Dot ph because we change the file extension I'm actually going
to copy this
and I'm going to said this to BHP and then we're going to put the password which is one two three four
five six.
Make sure we put the same password that you said when you created the backdoor hit enter.
And as we can as you can see we're inside the target computer we're inside the target and we run all
the commands that we allow us to do.
So we can just do an ls IP W.D. and all the next commands plus all the commands that really allow us
to do all the functions that we be allowed to do which we're going to have a look on in the next videos.