‫Now, with a previous video, we started to look for known vulnerabilities and box.
‫And the next few videos, we're going to cover these problems and so much more, so here's another one.
‫Now, within your reconnaissance phase, let's say that we discover the rescue like directory.
‫And when you follow.
‫This page will open it is, and ask you like manager interface.
‫And you can easily get the version information from the upper part of the page here.
‫OK, so that's how it got.
‫Now, after detecting a version, we'll look for public exploits.
‫So go to exploit that divide, come check verified exploit and type in the search box as you light.
‫OK, so the exploits here are listed.
‫Now we need to find exploits that match our escalate version on our target.
‫So I think this local fire conclusion correlates to our version.
‫And this is the content.
‫And the current theme, cookie is vulnerable to Elfy.
‫And they viewed the magic file.
‫That's just a pelo.
‫There are no extra files or anything else.
‫So let's go to the manager page.
‫Then enable Foxe proxy.
‫From the main menu, choose something.
‫And it will automatically request so open burb.
‫And the request is like that, but there's no cookie information that we look for.
‫So we'll forward it.
‫And the response comes.
‫And look what we have here.
‫The server set askew, right, manager, current theme cookie.
‫So that's great.
‫Forward it.
‫And now the page will request other components.
‫And that's where we the browser, will send the current theme cookie.
‫OK, so let's delete this value and add this one.
‫But now I want to point out an important thing here, the null character at the end of the payload,
‫if you don't put it in, it's going to fail.
‫So when we look at the code, you'll know why.
‫OK, so forward it.
‫OK, it was very nice, we get the content of our magic file.
‫Now, we've already seen this file, so.
‫It's really no big deal.
‫You don't have to see it again.
‫So we validate and then exploit the vulnerability.
‫Now, go to terminal, go to rescue directory.
‫And there are files and folders here.
‫Now, to analyze it so quickly, you can run a grip command, so tight grip as you might manage your
‫current theme are and I and run.
‫So this text is used five times in two different files.
‫Now view the first file.
‫And have a look at this part of the code.
‫If theme variable in post request is set, the application sets the current theme cookie if the current
‫theme cookie is already set.
‫The application sets its value to the local theme cookie.
‫OK, go back.
‫And now I'm going to look for local theme.
‫And of course, it takes a little more to analyze manually, but, you know, I'm used to it and you'll
‫get used to it.
‫But I think look here, the last line is interesting.
‫It has and include function as well.
‫So go to this file.
‫And this line, it is here.
‫So the application includes the value and the local theme once and the known characters we put after
‫the payload, eliminate the rest.
‫OK, so now you know how to get a full shell over an Alphie vulnerability.
‫We practiced in the 11th section, I know you remember it well, that's why I'm leaving the rest for
‫you.