Okay now that we managed to execute with commands on the server using the low security settings.
Let's see if we can set it up to medium and if we can do the same after increasing security.
So we cover the basic case and now I'm going to go to security and I'm going to send said the security
level to medium.
I'm going to submit this then we're going to go back to our command execution and I'm going to end with
my IP.
Now I just want to note that my IP is different now.
If you notice that the IP of the server right now is 2 0 9 and my machine I used to identify with Conficker
you can see that the IP of my candy machine is true.
So again I'm going to try to pin the Callimachi.
Let's just first see if we can fix something.
So we're assuming that we don't know at this website.
And again this is going from a black box point of view so we're not going to look at the source code.
So we're just going to run this website still is going to pink stuff for us.
So I'm just going to put the IP of the Calientes if the big works.
So we're just going to put 10.
As you can see now the ping command is working.
Now let's see and try to do what we did before so we used to do with the IP.
And then you use the semicolon to say that run this command and this command and in the low security
settings this used to work for us.
So we're going to submit this and at the bottom it should show us our current working directory because
we have the PWT here.
So I'm submitting this.
And as you can see nothing got executed so not even the pin command got executed.
So again looking from a black box point of view we're going to think oh maybe they're using some sort
of filtering on the semicolon.
So they're checking if the command contains a semicolon then they're going to ignore that command and
not run it.
So we're just going to try to use another trick or something similar to the semicolon.
So what we used to do before we had an example of doing ls.
So that's the last command and.
The PWT is what shows the working directory and we can combine these two by two and Elvira's so called
on.
And then we do the APBT and that will do both it'll do the allies and the PWT so that we used to work
for us doesn't work anymore because they're probably filtering based on this specific character.
So we're going to do is we're going to use something else available for us and the Unix commands which
is the pipe.
So I think is really useful when it comes to Unix you'll use it a lot.
What it basically does it me is run the first command.
And once you run that command center the outputs or pipe the output to this command and run the second
command on it.
So essentially it's one two commands.
In our case now you can use pi for a lot of things and it's used into rejects and things like that for
us all we want to do is we're interested into getting the second command to run.
So let's have an example of this.
So we're going to do ls which is going to be similar to our ping and then we're going to put the five
character which is the vertical bar and then we're going to put the second come out that the LS output
should be passed to.
Now PWT doesn't expect any input to be passed to it.
So at the moment when we run this it's all basically run both but it won't show you the result of running
ls.
It all feeds to PWT and should be the result of PWT.
So when I hit enter you will see that PWT you got executed so in our example what's happened is we have
a ping then we're It was an hour eyepiece so we're going to put our IP
and then we're going to use debark character and we're going to put the second command that we want
to run which will be the command that will give us shell on the server.
But for further testing we're just going to do OPW.
And again as you can see we don't see the results of the ping.
We only see the result of the PWT because again for the third time this command will run this and feed
the output to PWT.
So let's try this in here so we're going to do.
We put our feet again like we did before and we used to put them already like that but I'm just going
to put my bar character and enter
as you can see the second command got executed and we got our current working directory.
Now we can modify this to get a show on our computer.
So again we're going to use the bar and we're going to get it to you.
We're going to use the exact same method that we used last time so we're going to do a C minus the and
with my IP and then I'm going to put the port which is 88 you now before I execute this I'm going to
listen on port AT&T for a connection here and we're going to use the same command like before using
them.
So and see the LP 88 This is listening.
And we're going to connect back from here to the Kalli hit submit and sure enough we get a connection
here that allow us to run any commands we want on the server so we can do that.
Now we can list the files we can get our I.D. or do anything we want on the current server.
So we basically managed to gain access to that Web site.