Welcome back.
Let's cover our first example of command injection and as usual, we are going to start off with an
easy example.
First, this example will be the one from our tri hack me a WASP top 10 lap.
So we already ran that virtual machine once we covered the HTML injection.
And we want to do the same thing again.
We want to run the virtual machine used to perform command injection in the lab that we covered inside
of the tri Hackney platform.
Now, since we already ran it once, I'm going to go through the process of running those virtual machines
and setting up VPN one more time just so we can refresh our memory.
So the first thing that we want to do once we open our tri hacking account is we want to make sure that
perpetuities started and that intercept is turned off and then we want to run our VPN file.
Remember, we downloaded it in the home and then our account and indeed downloads directory and all
we have to do to run it is type pseudo open VPN and then the file name.
Enter your password and it will start the VPN for you.
Now if you open another terminal and type in, I recommend you should be able to see another interface
right here that will give you the IP before address that will belong to the Tri Hack Me network.
OK, awesome.
Once you get that set up, you want to navigate to your dashboard, navigate to the learning tab.
Scroll all the way down till we find our modules, which are right here, select Web hacking fundamentals.
And under here, we want to go with a WASP top 10.
OK, awesome, as we can see, we are connected to their network, here is our IP address, as it says
even here that we are connected.
We are open VPN.
So everything is set up good.
Now, if you don't connect from the first try, just try to restart both of your open VPN and your Trie
Hackney platform just to refresh it after you start European again.
And it should work perfectly.
Now, once we navigate right here, we want to go to the task force and Task five.
Both of these are command injection.
Just this one is only theory.
It allows you to read something about it.
You can go through all of this if you want to.
I do advise you to read it.
And you can also read examples of command injection right here under the task five.
But we are not going to be reading this at the moment.
What we want to do is we want to start the machine.
As we remember, it will take around one minute for our IP address of our vulnerable virtual machine
to appear right here.
So let's wait for that.
And by the way, after we finish showing the command injection in the next video, we're also going
to try to do these tasks or do these challenges right here.
These are something like capture the flag challenges.
So it will ask us to find something and we will try to do it with the help of command injection.
But for now, let's just get Commander Jackson to work.
So let's wait once again for I.P. address to show.
And here is my IP address, I'm going to copy it, and the first thing that they always do, which I
already mentioned, is I try to ping the IP address in case you get a response like this where it is
not able to ping it, make sure that you wait for a minute or two and then you should be able to ping
it since it does take some time for the machine to set up.
So let's control cities.
Wait a couple more seconds and then we will try again.
Let's give it a try again, and if I bring it now, we do get the response.
OK, awesome.
Let's go back here.
And in our challenge, as we already saw previously, we do get this link right here.
So this link is what we're going to use to try to perform command injection.
Let's click on it.
And it should open page called Evil shall not be on our target's IP address.
And here we get a simple Web application.
It only has this one input that allows us to enter a single comment, and if we type something like
test.
Well, nothing will appear, but what would happen if I type something like a test and then semicolon
to separate documents and type URLs, which is the command to list all the available files in the directory,
if I click on Submit now we get the response.
We get all the files that are currently in this Web servers directory.
So this input right here is vulnerable to the command injection.
You can do this with any command that you want, you can type test and then semicolon and then, for
example, who am I?
And it will tell you which account is it running as currently it's running as w w w dash data circumvent
injection works in this input.
But there's one more thing that I didn't really tell you besides the command injection that reflects
the output on the page, there is also something called blind injection or blind command injection.
What does that mean?
Well, it means that we can see the output of our comment on the page, even though it might be vulnerable
to the command injection.
OK, but you might be wondering, well, how can I then know if it's vulnerable if I can't see any output
on the page?
Well, we have to approach it differently.
Now, let's imagine that this same page doesn't give us any output.
Let's imagine that once we type test and then semicolon and then space and else, it doesn't print anything
right here.
If you didn't know about Blankman ejection, you would probably think that it's not vulnerable, but
there is another test that we can perform.
We can try to perhaps ping our Cal Linux machine from our target machine.
It won't give us any output here, but if we try to intercept the requests using something like a Wireshark,
then maybe we can see the packets that the target machine is sending in order to Pinchas.
If we do see those packets, that means we have a blind ESKIL injection, let me show you what they
mean.
So first thing, we're going to open a program called the Wireshark that is used to sniff packets and
data over certain interfaces.
We do ideally want to open it with pseudo.
Just so we don't have any limitations to just type so the Warshak and then type in your password, it
will open this user interface program where we are going to try to sniff our packets once we run the
Pinkham.
And so you will open a window that looks something like this and you will have multiple interfaces right
here.
Ideally, we want to select the interface that we use with our VPN and once again, you can figure out
which interface that is by typing.
I have config.
And for me this is t u n zero interface.
It has the IP address that belongs to the tri Haqqani network.
So I'm going to select that one right here.
And here it's going to sniff for all the packets that are coming to that interface now in order to discover
this blind command injection, what we can do is we can type test and then ping our IP address.
Said to check out what IP address we have, we can keep it from our config output right here.
And we can paste it here.
But before we run it, we want to be specifically sniffing for ping requests inside of our Wireshark
and those packets are also called ICMP packets.
So you can type in the search Bar ICMP.
Press enter and it will only output any ICMP packets that are received right here, so let's give it
a try with type test semicolon.
Then we added space for the second comment and we typed pink and then the IP address.
Now, also, since Linux systems Pink forever until you control.
See, we also want to add Besch C option, which stands for count and we want to ping only five times.
So we were going to type ping IP address then space that you see, and then five in case you don't see
it really well, let me enlarge this and it looks something like this.
Once we submit this request, you will notice that this page is loading consistently and after a few
seconds we get this output.
But if we go to our wireshark, we also get ICMP packets from the target machine.
Now, imagine that we didn't get this output right here, we would think that there was no vulnerability,
but if we opened our wireshark and saw the requests coming in, we would know that we have a case of
blind command injection.
How cool is that?
OK, awesome.
And this was the simple example of command injection.
In the next video, we're going to take a look at these tasks right here, even though they don't really
have much to do with the injection, but more like system navigation and something like that.
But we're nonetheless going to do them just to show how you can approach these challenges.
Thank you for watching and I'll see in the next lecture.