So local file inclusion is really good because it allows us to read files in the server and we might
be able to read files with passwords or sensitive information.
What will be really great is if we can actually gain full access or full control over the target server
using local file inclusion vulnerabilities.
So in this lecture We'll see how we can get a reverse shell by exploiting the local file inclusion vulnerability
that we've seen in the previous lecture.
So because they allow us to read files on the server so we managed to write anything on that server.
Then we can write some malicious code and then browse it and get that code to be executed.
So this is exactly what we're going to try to do.
There is a number of methods to achieve that.
So usually it's done using the log files because the lock files usually register or write stuff that
happens on the server.
So you can try to log in with a user name but instead of putting a user name you put a PH pre-code or
you can try to send an e-mail and then instead of the email put APHC code and then try to browse these
files and the page code will be executed the first method that we're going to have a look on.
It's going to exploit the environed variable.
So this is basically a file that contains an array of information about the current environment.
So let's just have an example of this quickly.
So right here I am on my coffee machine.
I'm not taking anything I'm not on any server and I'm just going to see what's the content of that file.
So this file exists in all Linux operating systems.
So I'm just going to open that file right now using the cat command.
And as you can see you'll see a number of environment variables that relate to the current environment.
So what we're going to do now is we're going to try to open this file here in my browser instead of
the easy password.
So it's going to be in proc self on
OK.
And as you can see again we can see an array of variables about the current environment.
What's interesting here is this variable so we can see that the user agent is being sent and it's being
displayed right here.
Now the user agent basically is the current browser used by the by the person by the user.
So you can see that because I'm using Firefox and the Web site things that I'm using Firefox which is
correct.
And that's because Firefox every time you open a website it actually tells the website what browser
it is.
So this happens on our website so we can see that Firefox is still on the Web site or the web browser
that Firefox 5 and is grown on Linux whatever.
So this is actually sent from the client so we can actually modify this value.
And what we're going to try to do is we're going to modify the user agent value and we're going to place
code that will give us a reverse shell before we do that.
Let's make sure that the code will be executed on the server.
So we're going to send just a normal ph code that will display BHB information so I'm going to turn
on my interceptor now.
I showed you how to set up a proxy so if you don't want to do that go back to that lecture and see how
you can set up a proxy.
So I just turned on the interceptor and I'm going to browse the exact same URL and right here if we
go on the headers you'll see that Firefox is sending the user agent right here and it it's as Mozilla
5 and then the next whatever.
So all we're going to do is we're going to modify this value and we're going to quit BHB code and the
code I'm going to put is very simple it'll basically just display the BHB information.
So it's a function called BHP info.
That I'm going to pay for what this packet
and as you can see the PH BE CALLED get executed on the on the Web site on the target website.
This means if we send malicious code to this website we'll actually be able to gain full access or we
can get our code to be executed.
Now you can literally send any ph record you want.
You can send code to files.
You can send code to upload the file or you can send one of the codes that were used before to gain
a reverse connection.
So that's what I'm going to do I'm going to use the exact same code that we used before and the previous
lectures to gain full control over the target computer.
So I'm actually just going to type it down here in terminal and then I'm going to copy it.
So we're going to be using pass through and we're using netcat
and then we're going to put my IP address and I'm going to use the port which is I'm going to end this.
And this attack I'm going to use 8 8 8 8 and then with the semicolon.
So it's the same as just APHC function.
We use that in the code execution next year.
So I'm literally just going to copy this and I'm going to inject it as the user agent.
Now before I do that I'm going to listen on port 8 8 8 8 4 connections.
So we're going to use the same code that we use before I go in with netcat
and now we're listening for connections.
We have our interceptor on.
I'm going to browse the Web site I'm going to enter and I'm going to modify the user agent.
Again don't forget to put the question marks here because I only put the code there so we have the opening
and closing for BHB and then we put our code which is the pass through code and see bin sh our IP followed
by the report that we're listening on.
I'm going to enter and I'm going to forward and as you can see we get a connection back using the local
file inclusion vulnerability.
Now I can browse files I can do that.
I can do ellos I can do ID and I can pretty much do anything I want on the server.
Now that I have full shell access.
So we were able to convert a local file inclusion vulnerability that can only show you files or can
only allow you to read files on the server.
We were able to convert that and exploited to get full access to the target server.
All these are possible because we were able to write to the proc self and Vire on variable which displays
our user agent and by changing the user agent to our P-H recall we were able to run any ph code that
we want.