So here's yet another lesson on known vulnerabilities, it's almost inexhaustible, really.
So in this lesson, we're going to exploit and other rescue like manage your vulnerability, but this
time you're going to memorize your access knowledge and I'm going to skip the detection of rescue.
Right.
Manager and version.
So right now, go to exploit database.
And we have already listed the vulnerabilities.
And we've even exploited two of them.
And there are a bunch of others that match our askew white manager version B box, so there are several
excess has vulnerabilities.
Yes.
So I'm going to open all of them.
And I think this one doesn't actually work with our version on our system, so I'm just going to eliminate
it.
And the second one.
All right, so this version matches.
Now it looks like there is an excel in the DB SPL parameter in the you are Al.
And the other one.
But this one is only for Internet Explorer, so I'm going to skip this one.
OK, so I'm going to look for this, your URL.
So go to the manager interface, enable Foxe proxy.
Now click the database.
And go to berp.
So the request will look like that.
So send it to the repeater and then forward.
Forward again.
Another DCL parameter is in the euro, send this to the repeater as well, and then forward.
Another request with DCL.
And send that to the repeater and forward.
And then go ahead and forward the rest.
OK.
So the page loads now up in the repeater.
So this is the first request we sent and I'm going to paste the payload here, then send.
And the response turns back, so type here, alert.
And we have the payload here.
And they can cause excess has vulnerabilities, but the last double quotes after the payload can prevent
execution.
So open the second request.
And paste the payload here as well.
Then send.
There's no alert code in response, so this means that the payload does not work here, so we'll go
to the third request.
This payload here is well and send it.
OK, so now we can see the color code here.
And also, the exploit code shows this you, Earl, so let's try it.
Delete this part of the URL.
And right, the payload.
And sure enough, the JavaScript code executes.
But to exploit a user, this page is not very convincing.
I don't think.
So we are going to need to make a few changes.
So let's copy this HTML code and we're going to prepare a payload step by step.
So first, let's close this tag.
Now, put in the alert code.
And then add a script tag to put the rest between script gags.
So paste it into the URL and go.
This time.
The page this way is much better.
So will view the source.
We can also complete the tag.
So use this payload.
That works well.
View source.
OK, this horse is better now.
Now we can write more accurate and more powerful JavaScript payloads.
Because the first part is complete and there's no error, so then our actual action payload comes.
And the last script tag eliminates the remaining HTML code.
OK, then open web developer, and now we can cookie the cookie stealer app.
So paste this payload and go.
But nothing sent to our server.
OK, let me just check the payload real quick.
OK, let's view the source code.
Now it seems right.
Ah, so here's our payload.
I see what's wrong, so something happens to the plus sign at the back end.
So we need to find a solution instead of this plus sign.
Yeah, you probably guess what we're going to do, we can solve this problem with a JavaScript function,
so I'll just change the plus sign to concat as our function.
And paste our new payload into the You are Al.
OK, so this time it sends the cookie value.
Open up the STELARA application and refresh the page.
There's one session.
So log in.
And here is a new session.
So let's check to see if it's alive.
And it is live.
So go to session.
And here is the user be.
OK, so in this lesson, we exploited an excess of vulnerability on askew light manager.
So we also get the BWB session ID as well.