‫For a fresh hack, you can start over.
‫I'm just going to move on with the same request.
‫So there are several ways to include a file which is stored local or on a remote server, and also there
‫are several ways to execute the files that are executable.
‫So.
‫The first way is to contaminate a log file.
‫Then include the contaminated log file and the page.
‫OK, so just send the first request.
‫Then go to be Bux.
‫Open terminal and tight tail slash VA slash logger Pache to slash access log.
‫So this log file contains they get requests that we sent.
‫So now I'm going to contaminate this file with a script.
‫So going back to Kelly.
‫I'm going to paste this code.
‫And it's a simple Michelle.
‫It'll execute the value of a command parameter set over the wall as an operating system command.
‫And send the request.
‫There's nothing with a request, so go to be box run the same command in terminal.
‫So here is a code that we sent over your URL.
‫Now go back to Kelly.
‫And delete this code and type slash bar, slash log, slash Apache to slash access to log.
‫Ampersand command equals P W.D..
‫All right, so, no, it doesn't work.
‫The command is not executed.
‫We got a permission denied error, so that just means we need to try something else.
‫Now, there is a special file in the directory process itself and veteran.
‫Now, in order to contaminate this file, we need to add this simple shell as the value of the user
‫agent header.
‫So I'm going to paste it in here.
‫Now, send the request.
‫And have a look at the response.
‫No, it doesn't work as well.
‫We got the same error.
‫So, OK, we can try a different way.
‫I need a clear request, so I'll go back.
‫And I will change this payload to a rapper this time.
‫So it's add BHP Coingate input here.
‫And now pays the Shell script to the body of the request like this.
‫All right, so now send the request.
‫And look at the response.
‫That's it.
‫Yeah, this time the command works and OK, so change to the list command.
‫And it works.
‫So now let's go a little further and open a net catch, Shel.
‫And B box, so the first thing we need to do here.
‫As we need to learn where the net next binary is.
‫Sometimes it can reside in different directories, so it's not too hard to find just type which percent
‫signed 20 ency percent saying 20 is the URL encoded space character.
‫And send it.
‫And here is that cat under the bin directory.
‫And here are the Basche commands to open a reverse shell from B box to Colly.
‫So I'm going to copy the second one.
‫Now, sometimes it doesn't work because of the difference between the versions of Netcare.
‫So your version and the version on the target may cause problems.
‫But in a situation like that, you can always use the third line as a reverse shell.
‫OK, so I'm going to it here.
‫And sended.
‫Hmmm, I think something went wrong.
‫I don't see a response, there's nothing in it.
‫OK, so I found it.
‫Yeah, it's for sure you, Erlend, code problem, so let's open up the decoder tool.
‫Paste here.
‫And code is your URL.
‫OK, copy all of that wild output.
‫And paste instead of this.
‫Now, before sending their request open terminal.
‫And of course, we should listen for the incoming Shell connection and see Dash and AVP four four three.
‫Now go to burp again.
‫Now, send the request.
‫Now, I wait for this empty response pain in a previous attempt, so.
‫I think we get the shell.
‫Go to terminal and here is a connection, I.P. address of box.
‫So this way, Ngarkat provides us a shell interface on PAYBOX.
‫So now we can execute the Basche Shell commands on Beatbox.
‫I'd like to see the current user and you can execute every command that your user is able to execute
‫and what do you know?
‫We can traverse between folders lissome.
‫Now, from here on out, it's up to you and your imagination, what can you find?
‫We are going to exploit the remote file inclusion in the next lesson.