‫Sometimes, for some reason, Web applications try to perform tasks by executing system level commands.
‫So in order to run Goodman's Web applications, communicate with the U.S..
‫So if an application doesn't do this properly, this functionality can be exploited.
‫So the U.S. command injection vulnerabilities occur at this crossroads.
‫So due to insufficient input validation, a user can inject those commands via a web interface like
‫an actual injection.
‫And these commands will be executed by the Web server OS now, depending on the level of privilege that
‫the Web server software has, the result can be devastating.
‫Don't let's fool ourselves.
‫So open up, Carly, and log in to be Web.
‫Choose OS command injection.
‫And it's a sample page doing OS level things.
‫And it shows the DNA information for the input value.
‫Now, I would avoid querying the NSA, but you can go ahead and do it.
‫No, strike that from the record.
‫OK, so type Google dot com and look it up.
‫So something does happen.
‫What is it?
‫So let's view this horse.
‫So maybe we've got something here.
‫Oh, nothing's here either, so go back.
‫Open your terminal.
‫Now I'm going to view the code.
‫So scrolling down.
‫OK, so based on levels, it looks like there are some security checks.
‫We can look for Jack one and check two later, so keep scrolling down.
‫So here's the main part.
‫As you can see, the page use shell exactly is a built in function to execute and as up command on the
‫operating system.
‫So that's all here.
‫The functions are in this file.
‫So here are the command injection check functions.
‫So the first one clears the ampersand and the semicolon.
‫And the second function calls for a built in function escape command show, so this function is used
‫to escape system commands.
‫OK, enough with the code.
‫Now, after the NSA Look-Up Command comes the target, so in a low level, there's no check.
‫We can run several OS commands after the target by adding some special characters.
‫Now, let's delete the NSA address type, Google dot com and WD and then go.
‫And we see the BW rectory.
‫Oh, I'm so bored by deleting the NSA each time, but.
‫I'm just a little paranoid, so let's enable Foxe proxy.
‫We can choose from autocomplete.
‫And go to.
‫Nothing change here.
‫So send it to the repeater and then let it go.
‫Over the repeater now.
‫Yeah, I think I think he like this, too.
‫I know, I do.
‫It's really handy, though, right?
‫Never mind, so send the first request as it is.
‫And yeah, so we can get the response.
‫And then now we can modify it here.
‫You can do it however you want.
‫I have a list.
‫I'm going to share it with you so you can try to cut while many possibilities.
‫What do I hear you say, where's the password file?
‫No, I didn't forget it.
‫It's here.
‫I with what I do, it's actually routine, so I find the vulnerability, then display some important
‫files and I try to open a basic reverse shell with Netcare at.
‫And I typically do not break my routine.
‫So I'll type which ency?
‫And scrolling down, yeah, it's here.
‫So now I'm going to paste the one line that Cashell.
‫And before sending let me make Nat Cat listen.
‫So now Neck Cat listens for incoming connections.
‫And go to the repeater again.
‫Click on the send button.
‫Well, I think we got the show because there's nothing here on the right pane, so let's open up the
‫terminal.
‫And see the shell from B box so you can type some bash commands, I.D., you name.
‫Who am I?
‫Just like that.