‫All right, so in a previous lesson, we exploited the local file inclusion and we got a shell from
‫the target.
‫And if there are no extra checks, including a remote file into the current page is also very possible.
‫So in this example, we're going to use the same page.
‫Here's the language parameter in your URL.
‫And it's very easy to validate if the application is akin to RFI, so.
‫Delete this here and write a website address.
‫I'm just going to use IMDB dot com.
‫And in just a moment, it will appear and yes, indeed, this is the arvi.
‫So now let's think of how we can take advantage of this, hmm, what do you think?
‫All right, so let me read you down the garden path.
‫Open your terminal lists the files in the Web directory of Carly.
‫Now, see, I have two files here.
‫So let's restart the Apache service.
‫And sure enough, a patch is running now.
‫So what do you suppose a plan is?
‫I will serve a page on my local server on Kouy.
‫And then I will include that page in into BW.
‫So I started the Apache Web server.
‫So then let's go to the browser again and change the language parameter to HTP Coingate one nine two
‫dot one six eight two zero four one two eight slash index dot html and go.
‫OK, so the index page is displayed by the application, so now instead of this page, we can provide
‫a shell.
‫To go to terminal.
‫Now has some web shells to use in these wonderful situations.
‫And you can view them just like this.
‫Now I'm going to use the P version of Szell's.
‫So copy both the back door and the reverse shell.
‫And pasted into the Webroot directory.
‫So go to the Web root directory.
‫And the page files are here, so I'm going to use the back door first, so let's view the code to see
‫what it is.
‫Yeah, it's a little bit hard to read the code, but.
‫Yeah, there's nothing to change here, so exit and go to the browser.
‫And type HTP Coleman's last the last one nine two down one six eight two zero for that one to eight
‫BHP Dasch back door that BHP and go.
‫Yeah, so be Web loads, the remote page on Kouy.
‫So this is a sample show.
‫It also has a few bugs.
‫But the upload feature is great, so let's browse to upload a file.
‫Uh, I choose this one.
‫And type here, the directory to upload a file.
‫Upload admin directory.
‫And I think we've already uploaded so go to Reeboks.
‫Was the admin directory.
‫And there is the uploaded file, as you can see here.
‫So this can be any executable as well.
‫OK, you don't believe me, go back to Kelly now, use the reverse shell.
‫And let's give you the code.
‫So I think this code is a little bit more readable than the previous one.
‫But we do have something to change here right at the beginning of the file.
‫So change the IP variable to IP address of Caleigh.
‫And to the port, to any port that you want to listen, for example, it's jus 443.
‫And there is one last thing to do, change the extension to a text file.
‫Because sometimes the content of the reversal can be truncated, so to be sure, we can change.
‫But sometimes, you know, I try it without a change and it works as well.
‫OK, sorry, that might be a spoiler.
‫So remember to restart Apache.
‫And before leaving terminal, I am going to start Nat Cat listener on Port four three.
‫So I just go back to the Web browser and call this show.
‫I think the shell is included, so the terminal.
‫And here is a pretty Basche shell.
‫And you can type commands.
‫All right, so that's a lot of fun and you can have a lot more fun with it, but for now we are done
‫with file inclusion vulnerabilities.