1 00:00:00,960 --> 00:00:07,560 All right, so in a previous lesson, we exploited the local file inclusion and we got a shell from 2 00:00:07,560 --> 00:00:08,100 the target. 3 00:00:10,120 --> 00:00:17,810 And if there are no extra checks, including a remote file into the current page is also very possible. 4 00:00:19,000 --> 00:00:22,080 So in this example, we're going to use the same page. 5 00:00:22,750 --> 00:00:25,030 Here's the language parameter in your URL. 6 00:00:27,050 --> 00:00:32,390 And it's very easy to validate if the application is akin to RFI, so. 7 00:00:33,520 --> 00:00:36,310 Delete this here and write a website address. 8 00:00:37,090 --> 00:00:40,540 I'm just going to use IMDB dot com. 9 00:00:41,910 --> 00:00:47,910 And in just a moment, it will appear and yes, indeed, this is the arvi. 10 00:00:49,530 --> 00:00:55,770 So now let's think of how we can take advantage of this, hmm, what do you think? 11 00:00:56,810 --> 00:00:59,030 All right, so let me read you down the garden path. 12 00:00:59,920 --> 00:01:05,140 Open your terminal lists the files in the Web directory of Carly. 13 00:01:08,420 --> 00:01:10,160 Now, see, I have two files here. 14 00:01:11,650 --> 00:01:13,990 So let's restart the Apache service. 15 00:01:19,840 --> 00:01:22,420 And sure enough, a patch is running now. 16 00:01:23,500 --> 00:01:25,600 So what do you suppose a plan is? 17 00:01:26,750 --> 00:01:30,860 I will serve a page on my local server on Kouy. 18 00:01:31,930 --> 00:01:35,590 And then I will include that page in into BW. 19 00:01:36,490 --> 00:01:38,500 So I started the Apache Web server. 20 00:01:40,600 --> 00:01:48,790 So then let's go to the browser again and change the language parameter to HTP Coingate one nine two 21 00:01:48,790 --> 00:01:56,230 dot one six eight two zero four one two eight slash index dot html and go. 22 00:01:58,170 --> 00:02:05,370 OK, so the index page is displayed by the application, so now instead of this page, we can provide 23 00:02:05,610 --> 00:02:07,500 a shell. 24 00:02:08,470 --> 00:02:09,520 To go to terminal. 25 00:02:10,800 --> 00:02:15,960 Now has some web shells to use in these wonderful situations. 26 00:02:16,910 --> 00:02:18,770 And you can view them just like this. 27 00:02:22,440 --> 00:02:26,760 Now I'm going to use the P version of Szell's. 28 00:02:28,590 --> 00:02:34,080 So copy both the back door and the reverse shell. 29 00:02:35,210 --> 00:02:37,370 And pasted into the Webroot directory. 30 00:02:38,720 --> 00:02:41,810 So go to the Web root directory. 31 00:02:43,960 --> 00:02:52,630 And the page files are here, so I'm going to use the back door first, so let's view the code to see 32 00:02:52,630 --> 00:02:53,320 what it is. 33 00:02:55,530 --> 00:02:58,350 Yeah, it's a little bit hard to read the code, but. 34 00:03:00,500 --> 00:03:04,370 Yeah, there's nothing to change here, so exit and go to the browser. 35 00:03:06,170 --> 00:03:12,340 And type HTP Coleman's last the last one nine two down one six eight two zero for that one to eight 36 00:03:13,220 --> 00:03:18,650 BHP Dasch back door that BHP and go. 37 00:03:20,300 --> 00:03:23,420 Yeah, so be Web loads, the remote page on Kouy. 38 00:03:24,760 --> 00:03:26,410 So this is a sample show. 39 00:03:27,440 --> 00:03:29,330 It also has a few bugs. 40 00:03:30,640 --> 00:03:36,670 But the upload feature is great, so let's browse to upload a file. 41 00:03:38,120 --> 00:03:40,450 Uh, I choose this one. 42 00:03:42,300 --> 00:03:45,510 And type here, the directory to upload a file. 43 00:03:46,620 --> 00:03:48,510 Upload admin directory. 44 00:03:52,120 --> 00:03:54,910 And I think we've already uploaded so go to Reeboks. 45 00:03:56,410 --> 00:03:57,850 Was the admin directory. 46 00:04:00,220 --> 00:04:04,630 And there is the uploaded file, as you can see here. 47 00:04:06,360 --> 00:04:09,900 So this can be any executable as well. 48 00:04:11,430 --> 00:04:16,770 OK, you don't believe me, go back to Kelly now, use the reverse shell. 49 00:04:18,050 --> 00:04:19,730 And let's give you the code. 50 00:04:22,240 --> 00:04:25,270 So I think this code is a little bit more readable than the previous one. 51 00:04:26,560 --> 00:04:31,150 But we do have something to change here right at the beginning of the file. 52 00:04:32,070 --> 00:04:37,890 So change the IP variable to IP address of Caleigh. 53 00:04:39,080 --> 00:04:46,280 And to the port, to any port that you want to listen, for example, it's jus 443. 54 00:04:48,730 --> 00:04:54,340 And there is one last thing to do, change the extension to a text file. 55 00:04:56,900 --> 00:05:03,290 Because sometimes the content of the reversal can be truncated, so to be sure, we can change. 56 00:05:04,190 --> 00:05:07,430 But sometimes, you know, I try it without a change and it works as well. 57 00:05:08,060 --> 00:05:10,090 OK, sorry, that might be a spoiler. 58 00:05:11,420 --> 00:05:13,880 So remember to restart Apache. 59 00:05:16,590 --> 00:05:22,770 And before leaving terminal, I am going to start Nat Cat listener on Port four three. 60 00:05:24,420 --> 00:05:28,590 So I just go back to the Web browser and call this show. 61 00:05:30,430 --> 00:05:33,700 I think the shell is included, so the terminal. 62 00:05:35,100 --> 00:05:37,380 And here is a pretty Basche shell. 63 00:05:38,420 --> 00:05:39,950 And you can type commands. 64 00:05:41,110 --> 00:05:47,620 All right, so that's a lot of fun and you can have a lot more fun with it, but for now we are done 65 00:05:47,620 --> 00:05:50,410 with file inclusion vulnerabilities.