OK, so now that we know how to use proxy and we already know how to exploit a basic vulnerability,
let's go ahead to the security settings and we're going to set the security to medium.
We're going to submit to make sure that it is at medium.
And we're going to go back to the file upload in here.
And keep in mind that the interceptor has been set off so far.
We're simply just testing and as usual, will keep things simple.
So when it's off, it's as if berp is not working at the moment and will simply just going to try to
upload the normal shell that we already have in my home directory right here, shall that we double
click and upload.
And when we do that, as you can see, we're going to get an error saying that the image was not uploaded,
probably because we changed the settings to medium.
And if you're doing this on a real website, you'll know that this page has some kind of a check that
is preventing us from uploading our HP file.
Now, just to make sure that the page is preventing us from uploading a file and the page itself is
not broken.
Let's try to upload a normal image.
So again, going to my downloads, selecting a digital image and click on upload, you'll see that the
GTR image will be uploaded successfully.
Therefore, we know now that the file upload functionality actually works.
The only reason why it did not work with BHB because the page itself does not allow us to upload files.
Now there is a number of ways that this website might be preventing us from uploading we file.
The simplest one would be to simply check if the file is a file using the extension or the file type.
So let's go to the file manager and I'm going to simply rename my Shell Dirt File to an image file formats.
So instead of it being shelled at BHP, we are going to call that Shell Dot GPG.
We're going to rename it like so go up and let's try to upload it again, so it's in my route and right
now it's called Shadow GPG.
Now, keep in mind, uploading a jpg file like this usually does not work because the file extension
is an image file extension.
So what we're going to do is we're going to turn on our proxy and we're going to click on upload.
And now we intercepted the upload request so we can see we have a post request to the upload directory
in the way we can see the host is actually our target host.
This is not being sent to another server.
And if we scroll down a little bit, we will see the file name in here set to shell the jpg and the
content type is set to image JPEG.
So we're going to keep the content type the way it is and we're simply going to change the file name
in here from GPG to HP.
And just so you know that this is actually our file going to get uploaded and it's not the previous
one.
I'm going to call it Shell to that.
So all we're doing right now is once we clicked on upload in here, the Web page sent a request to the
Web server.
But before this request reached the Web server, we intercepted it in here and we're keeping everything
the same.
So it looks a little bit more like an image.
We're still saying the content type is an image type, but we simply rename the file from Shell the
jpg to Shell that we effectively change in its extension.
Therefore, once uploaded, hopefully it'll actually be treated as a file and therefore should allow
us to control the Web server.
There is no guaranteed way of knowing that this works.
You'll simply have to try and see if it works.
So let's try.
We're going to click on Forward, Forward and Perfect.
Now, based on this message that we got in here, it's telling us that shell to dot BHP has been successfully
uploaded.
So that's amazing.
Now let's go to our terminal and try to connect to it and see if it actually works.
So we're going to use the same command that we used earlier.
The only difference is the filename now is called Shell 2.0.
We were going to hit enter and perfect.
As you can see, we managed to connect to the target server.
We can do it to verify and now we can use all of the features that we evely allows us to use.
We're going to talk about that later on in the post exploitation section.
But basically now we managed to bypass the check that this particular web page has in the medium difficulty
and upload a file to it that allows us to control this Web server remotely.
All of that thanks to proxy.
The main idea in here, as mentioned earlier, this can be applied in so many scenarios.
Whenever you want to bypass security or bypass checks or see the hidden requests that a Web application
might be sending to the Web server.