‫Now, we've already discovered this you URL, so I'm passing those things and we will find an alibi
‫for this version of Ask Your Manager, but doesn't mean there can't be any other vulnerabilities.
‫So why don't we go ahead and open exploit DBI, dotcom.
‫And there is a remote code injection for this version that we have in box.
‫Now, the content of the export code is here.
‫I'm sure that you don't need this file, you can accomplish it manually, so don't download it, just
‫open as you like, manager interface, and then you can start by creating a new database.
‫So I'm just going to name it Shell and I'm going to save it.
‫Shell, that BHP.
‫OK, so now quick ask you, Will, from the menu.
‫And we will see this code pain, so this is where we're going to inject our payload.
‫So I'm going to paste this school code and a code creates a table and adds a value.
‫But the value is a bar code that executes operating system commands and it looks for net cat's directory,
‫then execute.
‫And the value was added, so if you click table one, then click display, you can view the entry.
‫Now, you may wonder where this file is, so click Shell or your database name click options.
‫And the location property will show the path.
‫OK, then open this path from Firefox.
‫And here's a result.
‫Now view the source.
‫So this is binary data and here is our result.
‫OK, so now I go over to the manager interface.
‫Display the table one again.
‫And edit the entry.
‫So instead of this input, use this one.
‫The one line reverse net catch shell.
‫Then save.
‫Go to Sheldon.
‫Oh, I forgot to open that listener.
‫OK, so that's done.
‫Now refresh the page.
‫And Beatbox connects back to Kelly.
‫So now you can type of Linux commands and.
‫Hostname.
‫Or quite convening a pace, this python code to get a bash style show.