Okay here is where we ended in the
previous demo. So we were able to fetch the
sensitive data from the database like passwords of
different users. It was very cool. But now let's
do even more cool thing. So instead
of dash dash dump, I will put here.
and dash dash OS -
shell
and I will hit enter.
right
and what say can
I see here? I'm asked which web
application language does the web server support the
default is PHP. And and
yeah, he indeed I'm gonna choose it.
And now I've got a question.
Where I want to install my back
door and the default location is as
you can see Slash VAR
slash. Www. Yeah, that's
that. That's the good place. So let's do it. I will
hit enter.
And now the process is underway, right?
Oh, is it just finished right now? Can you see
OS shell nice. Let
me show you that indeed works. So for example,
I will put lsla and I will
see the kind of
files in in the in the directory. Yeah,
I can see different PHP files
out there.
This one is very nice.
This one because this is the configuration file
right of the WordPress a
VP Dash config.php.
So yeah.
The Next Step I'm going to fetch the
content of this file. Why not? So cat VP
Dash config?
dot PHP, right
Yeah, here is the content very
nice. Let me go a little bit.
Up. What? Can I see here? Mmm, very
nice.
I see the user of the database is
root. And I've got the password Here
Right P capital E free
pm and so on
so forth.
Very nice. I can just do whatever I want. This
is just an example. I'm reading the content of of
very sensitive file because I can
do it.
I've got always shell.
And always shall access right you can
do arbitrary Command right now, for example, you name?
- A
and and you will see here the
details.
about
a the operating system kernel version
stuff like that. So it's just I could
figure out right now tens or hundreds
of different commands. But now it's up to
your imagination. I just want to show you
that the back door.
Has been indeed installed and I've got remote
code execution. This is how it works. And and now whatever
comes up to your mind. You can put here and you
will be executed because now you can execute arbitrary
code.
Okay. I hope you really like
this demo.
Let's go to the next subject because right now
you are the master of
exploitation with this tool.
And what do you also want to
master in this course is how to
master the detection phase right? So I'm
going to show you how you can maximize the
power of SQL injection detection with SQL map
and this is what's gonna happen in the next module. So
thank you very much for your attention.