So we already seen in previous lectures how we can run Linux commands on the target server or you have
to do is just literally type in the command for example we can type in W.D. to see where we are.
We can navigate back see the dot we can list what we have and we can do anything we want on the target
server.
Unfortunately this isn't always the case in many cases you might gain access upload your shell and have
weekly work.
But every time you run a command you want see the result.
Or you might get permission denied.
And this will happen because the server is configured in a way to prevent you from running commands
on that server.
So what we're going to do is we're going to use a function that comes in with we believe.
So let's first type in help to see all the functions or the Kamaz that we can use and the function that
we're going to use is called Shell SH.
And as you can see in the description it says it allows us to execute shell commands so using the function
is very simple all we have to do is type in Shell SH and then type the command that you want around
so you can type in again PWT and you'll see the current working directory.
Now this will just use the default way that we've been using so far anyway.
So if the default way doesn't really work this will probably not work for you either.
What I want to show you here is what this function allows you to do so it actually allows us to run
Linux commands using a number of methods.
So it's very similar to the idea of the ATC passwords when we read in it and in this case if you can't
run commands on the target server then it's probably because your user is configured in a way that's
not allowed to run bash commands.
So what this function allows to do is run the command through a PH function or through a Python function
or through a perl function.
So this way you're actually not running the command directly.
You're running a PH function.
And then the function itself runs the command.
Therefore if you don't have permission to run commands directly you'll be able to bypass this by running
the command through APHC function so to see all the vectors or all the methods that we can use to run
the command.
We're going to do Shell S.H. followed by SH And as you can see the first thing you see is the general
way of using the command.
So you type in Shell SH And then you type where you want the command to be displayed.
This is the redirection and we're not going to mess with that because we want it to be displayed on
screen.
After that you specify the vector.
So this is what we're talking about.
This is the methods that you can use to run the shell commands and you can see that you can run it using
System.
So this is the default way of running the commands.
You can also use a pass APHC pass through function.
So this is the one that we used to use when we were executing commands using P.H..
Remember in the code execution vulnerability is again you have a number of BHB functions.
So if one of the functions is disabled you can use the other one.
You can also run commands using Python through the python interpreter and you can run functions using
the perl interpreter.
So to use this we're going to use the same command shell SH followed by minus b just like we see here
in the template so something else.
First thing you type in is the command followed by the vector.
And we're going to choose a vector to use and for the first one let's try the Perl system.
So we're going to use ferral system.
So this is the actual function that will execute the command that we specify and you can see here and
the template so it's show SH followed by the vector followed by the command that we want to run.
And let's run this time we're going to try to run who am I hit enter and as you can see this doesn't
work.
So we're going to go back and we're going to change the vector and let's try to use pass through and
we know pass through works because we used it before.
So again we were using passthrough as a vector and we're on in the command do I might hit enter and
as you can see now the command got executed on the server.
So again in our particular case here this doesn't seem very useful because we could run commands normally
just we can just type in who are my but in our real case scenarios.
You want to be able to run commands directly like this and using this function with the vector could
be very useful.
So all you have to do is just use the shell S.H. and experiment with all the available vectors until
one of them works for you.