Code execution vulnerabilities these type of vulnerabilities allow us to execute operating system code
on the target server solves the target server uses Windows will be able to execute Windows commands
if it uses Linux then we'll be able to use the next command.
Clearly this is a really critical problem that will allow us to do anything we want with the targets
really we can upload a PH reshelve using them when you get command or upload a payload or virus or anything
we want using didn't really care that we get linux command.
You just need to make sure that you're uploading it to a file or to a directory which you're allowed
to write stuff to.
Another way of exploiting this vulnerability is to just run OS commands and get a reverse shield based
on these commands.
So because we can run operating system commands we can use the programming language is supported by
that operating system to try and get a reverse connection on our computer.
So first of all let's just assume that we're browsing here and we managed we're going around and then
we got to a tab and the Web site where it allows you to for example do a thing.
Now what you should do is you should always try to experiment with any input box you see try to see
what the input box does and what can you inject into it what can you do to get stuff running.
So for example this impuls box is telling you it's going to do a ping.
And if you pull it out if you for example I'm going to put 10 2014 two or three which is my own IP.
And just to see it to use it as a normal person and I'm going to do as I've made and is going to go
ahead and think it for me and give me the pin results.
So what looks like here it's actually executing the ping command and Linux systems.
Now let's see if we can exploit that if it's actually executing the pin.
Come on.
So what it's doing is it's going on and it's due in.
So we're sending 10 2014 to all three as the paying and then going to the web server and the web server
is doing paying 10 2014 to 3.
So let's see if we can exploit this how we exploited.
If it's taking what we're put in right here and then it's due and paying that now in Linux and Unix
based commands you can use the design to execute multiple commands on one line.
So if you do this for example in your own terminal.
So I'm just going to go to my terminal here and I'm just going to do ls which is the list command and
then PWT is what lists what shows your working directory.
So if I do on Elyas followed by design and then do PWT it will execute both commands.
So it will do this and then it will show where the working directory is.
So we can do the same thing with this and see if it works for us.
So we got an IP right IP and then I'm just going to do PWT and see if it'll execute the PWT for me if
it does that this is a code execution vulnerability.
And I can execute anything I want on the server.
So let's see what's going to happen.
I'll paste this and I'm going to hit Submit now as you can see we got the results for the end.
We got our current working directory.
So it was the only W.W. DV w able ability as an exec so it executed the PWT that I inserted.
And that means I can insert any commands I want in there and they'll be executed so I've inserted resources
file that will that you can use to get a reverse connection from the target computer.
Now there's a number of ways a number of commands that will give you a reverse connection.
All of these commands depend on the programming language so for example we have commands and BHB we
have commands.
Ruby you have perl commands and we have the one for bash bash is the linux shell command language.
So all UNIX operating systems will be able to execute Passhe commands.
So that's a very good way of doing that.
So most Unix system this command should work on most unix based systems.
So this would be a really good way of doing it.
Again most of them would have Python so Python would be a good way netcat most of them do have netcat
as well so netcast is a good way of doing that.
And we're actually going to use netcat in this video.
So what I'm going to do is first I'm going to listen for connections just like we used to do with me
to exploit when we used to do what we have learned.
You can actually use a multi-hundred for this and listen for connections.
Well I'm just going to keep it simpler and show you a new way and I'm going to use netcat so and I cat
as just a tool that allows you to listen and connect computers together.
So I'm going to listen on port 88.
So that's got the program DVDs just to see us out so we can see a lot about what anything goes wrong
we can see it.
And we're telling it to listen using the L option on port 88.
So I'm going to hit enter and that's saying it's just listening on port 80 80 that's all it's going
to do.
The next commander we're going to do is we're going to try to connect from the web server back to my
computer using netcat as well.
So we're assuming the web server has netcat.
We're gonna try it and see if that works.
So the command is very simple it's not cut and we're telling you to use the bin bash and we'll give
it the IP of my device my attacker or device which is 10 20 14
and then the port which is 80 80 which is we're listening on right here.
So I'm going to copy that and I'm just going to execute it the same way we use to execute dPw dPw did
come up so the last thing we did was 10 20
14 2 0 3 and then we did PWT.
So what I'm going to do now I'm going to remove the PWT and paste the code that we just created which
will try to connect from the web server back to the Callimachi into the attack machine.
I'm going to come here.
And as you can see we've got a connection back from two to us from 10 20 40 to 0 4.
So that's the target computer.
And if we do have EWG you'll see that we have a reversal if we do unless we do an I.D. you'll see that
we're we that we data and if we do a you name just to confirm that I'm going to be exploitable and you
can see that I'm an dimittis portable and I'm able to run any command that I want on the target computer.
So basically I have full access to the target computer.