Now let's see how we can upload files to the server so uploading files can be very useful because you
can use it to literally upload anything you want so you can upload any ph rescript that you want.
Ph.D. scripts can be used to do anything you can use it to gain a reverse show.
You can use it to execute commands on the server.
You can use it to connect to the database and browse through the files and you can even use it to exploit
local vulnerabilities such as buffer overflows and code execution.
So the possibilities are endless really.
One thing to note is that now when I check my privileges.
So if I do who am I to check the current user you'll see that the w w w data and the current website
is running under that user.
So basically I can do anything I want on this website because I am the owner of this website at the
moment and a lot of the cases depending on how you gained your access to the Web site your privileges
might be nobody.
So when you do your WHO A-MEI instead of get in WWE The only data you'll be who you'll be nobody.
And when you're nobody you can't upload anywhere you want.
You can only upload to directories that has 777 permissions so to directories that basically allow anybody
to upload to them.
So if you do ls L.A. you can see that we have or all of our files and we see that all of them are owned
by the data which is me.
So this is the parent directory and this is the current directory.
And these are just normal directories and files in the current working directory.
And you can see that all of them are owned by me.
Therefore I can upload anywhere.
But what we're going to do in this lecture we're going to pretend that we can't upload anywhere.
We're going to pretend that I'm nobody.
And if I wanted to upload something while being nobody we have to upload it to a place where everybody
is allowed to upload files and that place which should have a 777 permissions.
So these are the permissions here.
And what they look like is they should look like this.
So there should be no minuses in it and it will basically mean that everybody can do anything they can
read write and execute.
So we can see from the director is here now the director is start with and the permission so he can
see that from the directories is here we have nothing with 7 7 7 permissions.
So we actually have to look around.
I'm sorry I clicked Control-C there so I'm just going to go back and connect back to Evely So again
we're going to do PWT and we're we're in Vire WWE w the VW 8 and where I want to go is we can see our
interesting director here called Haikerwal.
So let's go in it and then let's see what's in there.
So we're going to go into hackable use and see the command.
And then again we're going to do ls l
and again there's nothing really interesting here so let's go back.
And we're going to navigate back again.
And if we list here you'll see that we are in the root directory and we can navigate to different Web
sites.
Now and if you notice we have a directory called drive here.
Now this directory doesn't belong to us it actually belongs to the root user so it doesn't belong to
w w w o data which is us but we can actually upload stuff here.
Why.
Because it has the permissions that allow everybody to upload.
So it has 777 permissions which looked like this.
So we're going to navigate into that place.
So we're going to list to see if there is anything already there and we can see that there is no files
whatsoever there.
So we're going to upload our file and we're going to use a function called file upload
we're going to do the minus like you like usual.
And he can see that the way you use this function is you type in file upload first.
You can use the minus F to force override to overwrite the file if it exists already.
You can specify the file content and you can specify the vector and again the vector is the method of
how the file is going to be uploaded.
And I'm going to keep this to default so I'm not going to use the minus vector.
And then we give the local Poth.
So where the file is stored on your current computer on our Callimachi and followed by the remote path.
So where do you want the file to be stored on the target server.
So the file that I want upload is located in my root.
So if we go to the file manager you'll see that I have the file in the root and it's just called testor
THC it's actually a shell but it's just called test dirty XTi.
So I will try to upload that.
So our local directory is going to be route test the XTi and we want to upload that to the remote path
of the current path.
So if you want to specify the current place the current working directory where you are you just have
to put adult followed by a forward slash.
So this is where we want to upload it and then we have to give it a name.
So I'm going to call a shell or test show uploaded the T XTi just the name so we know that the file
has been uploaded correctly.
So again the command is very simple as file upload.
You specify where the file is stored on your current machine and mine is stored in root and it's called
testor XTi.
And then you specify where you want to upload it.
And I'm going to upload it to the current working directory.
That's why I have added forward slash and then followed by the name that I want to call it.
I'm going to call it a test shell uploaded that the XTi I'm going to hit enter and it can see that it's
giving us a true statement which means that the file has been uploaded.
If we do an ls
you'll see that the file has been uploaded to this particular directory.
So now we can go to our Web browser and we upload it for the file to a directory called Dove and then
we call that test shell uploaded that XTi.
And as you can see now we can see the file has been uploaded and this is the actual content of the file
it's encrypted Chell.
So it has been uploaded perfectly or correctly.
And again we uploaded it to a directory that doesn't belong to us but the main idea is the directory
has to have 7 7 7 permissions.
And that way even if you have a nobody even if you are nobody you can upload to that directory if the
directories have your permissions like the debris there will be data here all these directories we can
upload to them regardless of the permissions they have because we are doubly W.W. data.
So what I showed you here is just an example of how you would upload files if you had nobody permissions.