1
00:00:00,480 --> 00:00:07,710
Now, another problem that you will probably see while you are testing unrestricted file upload forms.

2
00:00:08,870 --> 00:00:12,860
And sometimes you can bypass restrictions if they're not properly coated.

3
00:00:13,780 --> 00:00:21,340
So in this lesson, we are going to be dealing with an unrestricted file upload challenge, you'll see

4
00:00:21,340 --> 00:00:21,900
why in a minute.

5
00:00:22,360 --> 00:00:29,260
So go to Cali and log in to be web and open unrestricted file upload page from the menu.

6
00:00:32,110 --> 00:00:36,130
Now to see how it works, browse and then choose a picture on your computer.

7
00:00:37,980 --> 00:00:39,360
And then upload the file.

8
00:00:40,580 --> 00:00:47,300
And you will see a link below, so click it to the image yeah, I uploaded said.

9
00:00:48,890 --> 00:00:55,070
So, OK, enable Foxy Knoxy and I'm going to arrange the view for you here, so.

10
00:00:56,690 --> 00:00:57,610
We can look at the code.

11
00:01:02,920 --> 00:01:04,870
Now, there's no check for a low level.

12
00:01:06,060 --> 00:01:09,960
But for medium file, upload, check one is called.

13
00:01:11,180 --> 00:01:13,760
And for high level check two is called.

14
00:01:15,200 --> 00:01:21,350
OK, exit now, I created a folder for this example before, so I'm going to go to that folder.

15
00:01:22,290 --> 00:01:25,890
And I'm going to prepare a shell with MSF venom tool.

16
00:01:27,020 --> 00:01:34,910
So type MSF venom does p p p slash interpreters slash reverse Tsipi for the payload?

17
00:01:38,100 --> 00:01:45,960
And almost equals one nine two one six eight two zero four one to eight for the localhost dress and

18
00:01:45,960 --> 00:01:52,500
Bellport equals four four for three for the local port and Cali and the file name.

19
00:01:54,220 --> 00:01:58,330
And now we can provide some other parameters to MSF venom.

20
00:02:00,200 --> 00:02:03,350
But we don't need this for this example.

21
00:02:04,340 --> 00:02:05,120
So.

22
00:02:07,690 --> 00:02:09,370
OK, the payload is created.

23
00:02:10,700 --> 00:02:14,870
So here it is, my folder, and this is the content.

24
00:02:16,260 --> 00:02:20,010
All right, so we're done here, so then go back to Firefox's.

25
00:02:21,110 --> 00:02:26,840
Well, browser images, but choose shelled out and uploaded.

26
00:02:28,430 --> 00:02:30,660
Offload request is in berp on the right.

27
00:02:31,890 --> 00:02:34,110
And you can see the content of the file.

28
00:02:35,910 --> 00:02:40,200
And the content type is Application XP, HP.

29
00:02:40,950 --> 00:02:41,970
OK, so let it go.

30
00:02:44,060 --> 00:02:46,310
And the link appears on the page.

31
00:02:47,670 --> 00:02:50,040
But now, before clicking, let's go back to terminal.

32
00:02:51,880 --> 00:02:58,060
Now, I forgot to create a handler to capture the reverse connection, so open Métis Boyte.

33
00:03:01,240 --> 00:03:05,470
OK, so use exploit slash multigrain handler.

34
00:03:07,090 --> 00:03:11,440
And then set payload to reverse TCP.

35
00:03:15,580 --> 00:03:18,490
And you can set localhost the IP address of Carly.

36
00:03:22,350 --> 00:03:24,750
And so the local board to four, four, four, three.

37
00:03:26,650 --> 00:03:28,930
So one more time, we'll show the options.

38
00:03:30,600 --> 00:03:34,950
And then type exploit RSJ to run a background job.

39
00:03:35,820 --> 00:03:39,720
OK, so go to Firefox and click here to see the show.

40
00:03:41,580 --> 00:03:44,250
And the session is open in terminal.

41
00:03:45,770 --> 00:03:48,500
So type sessions to list sessions.

42
00:03:49,770 --> 00:03:52,140
And interact with the session one.

43
00:03:53,590 --> 00:03:57,550
Type get Eweida for the user of the open show.

44
00:03:58,630 --> 00:04:05,410
And then info, you see the basic info about the open shell, exit the shell.

45
00:04:06,540 --> 00:04:10,260
And go back to Firefox's, so now I will increase a level.

46
00:04:11,430 --> 00:04:12,420
So choose minium.

47
00:04:13,680 --> 00:04:15,570
And try to upload the shell again.

48
00:04:19,700 --> 00:04:23,600
And there's a year because these extensions are not allowed.

49
00:04:25,300 --> 00:04:27,430
OK, so it's a naval interception.

50
00:04:28,850 --> 00:04:30,830
And then upload the shell file again.

51
00:04:33,530 --> 00:04:35,180
That request is here in berp.

52
00:04:37,100 --> 00:04:44,060
OK, so change the extension in the file name and just add three to the end, that's all.

53
00:04:45,080 --> 00:04:46,340
And send the request.

54
00:04:47,820 --> 00:04:54,270
And a link for viewing the uploaded image is right here on the page, but before we do that, let's

55
00:04:54,630 --> 00:04:55,710
let's grab a listener.

56
00:04:56,580 --> 00:05:01,380
So start the handler and metastable by typing, exploit J.

57
00:05:04,570 --> 00:05:05,740
Now click the link.

58
00:05:07,790 --> 00:05:09,440
Perfect sessions open.

59
00:05:11,020 --> 00:05:12,940
So interact with session to.

60
00:05:14,700 --> 00:05:19,950
And we'll run get your ID, the user is w w w data.

61
00:05:21,020 --> 00:05:24,950
And this info for the basic information about the shell.

62
00:05:26,270 --> 00:05:27,170
And then you can exit.

63
00:05:28,690 --> 00:05:30,430
Now, go back to Firefox again.

64
00:05:31,520 --> 00:05:33,980
And I'm going to increase a level one more.

65
00:05:35,040 --> 00:05:39,900
So select high and now try to upload the shale file again.

66
00:05:42,450 --> 00:05:43,920
And there's our friend, the error.

67
00:05:45,440 --> 00:05:49,800
But this time it allows only these extensions.

68
00:05:50,650 --> 00:05:55,370
OK, so enable interception and upload the file.

69
00:05:57,720 --> 00:06:02,160
And this time, the problem can be solved by adding a suitable extension to the file name.

70
00:06:04,710 --> 00:06:06,200
And let it go.

71
00:06:08,390 --> 00:06:11,810
And there's the upload, problem solved.

72
00:06:12,590 --> 00:06:13,250
Here's a link.

73
00:06:14,790 --> 00:06:17,010
So open the terminal and start the handler.

74
00:06:18,240 --> 00:06:19,740
OK, it is done.

75
00:06:21,930 --> 00:06:22,830
Now click the link.

76
00:06:24,870 --> 00:06:26,010
Hey, nothing happened.

77
00:06:27,230 --> 00:06:28,130
There's no session.

78
00:06:29,310 --> 00:06:30,030
It doesn't work.

79
00:06:31,040 --> 00:06:40,070
Because the application tries to open an image file, but remember, it's a file, so it gets confused,

80
00:06:40,070 --> 00:06:42,260
throws an error without executing it.

81
00:06:43,600 --> 00:06:46,960
So we cannot directly execute this show.

82
00:06:47,850 --> 00:06:56,370
But remember, we discovered Elfy on the Web so we can use Elfy to include our shell into the application.

83
00:06:57,350 --> 00:06:58,860
But that's for you to do.

84
00:06:59,300 --> 00:07:02,630
I know you know how, because we did Elfy several times.

85
00:07:03,380 --> 00:07:04,190
Have fun with that.