So in the previous lecture we learned that we can use the NS look up or the ping command
to send a request to a server that we control such as this burp collaborator domain
to discover blind command injection vulnerabilities because once we send that
request we're going to be able to capture it in here.
Or if we're sending it to our own server will be able to see the request in the logs.
And I said that's enough proof to say that
the target server is vulnerable to a command injection.
And I also said in a pen test you can inject a command to send you a
reverse connection to your own computer and get an
interactive shell where you can fully execute commands,
read the results and control the server.
Now, depending on the scenario,
you might find yourself in a situation where you're not able
to get an interactive shell and you just want more proof to
know that you're actually able to execute commands or you might be
missing some information before you're able to get an interactive shell.
So in this lecture, I'm going to show you how to take this exploit right here.
One step further and use it to actually execute commands on the server and see the
results so that you're not simply limited by
reading the requests that you're getting in here
and doing that is actually very very simple.
We're still going to be using the NS look up command
but we're gonna edit it
so that we perform an NS look up to the command that we
want to execute on the server surrounded by these quotes in here.
And as a result the terminal is first going to execute the command that you
have between the two quotes and replace it with the result of the command execution
like so and then perform an ns look up
to whatever results you got from executing this command
dot your server dot com.
Then we're going to be able to see the logs of our server and we're going to see
that somebody made a request to the result of
the execution of my command dot server dot com.
And this way I'll be able to get the result of executing my command.
Let me show you a quick example before we do this. So I'm gonna clear this
and I'm gonna copy my collaborator domain to clipboard
and I'm simply going to go and s look up.
I'm gonna put one of these quotes, I'm gonna put the command that I want to execute,
which is your name.
Close the quote put a dot so that this is considered as a sub domain.
And then I'm gonna paste my burp collaborator domain.
So my system is first going to execute you name,
get the result of that which is going to be
Darwin and then send an ns look up to Darwin dot
my domain.
Then I'm going to read the logs of my domain and I'll be able to see that somebody made
a request to Darwin dot my domain And therefore
I'll know that the result of executing the U.
Name command is Darwin.
So let me show you I'm going to hit enter
and we're gonna go to the collaborator.
We're gonna click on paul now, click on the result that we got.
And perfect as you can see,
the first part of the request now is Darwin because we're making
a request to the result of the execution of the union command,
which is Darwin. As you can see in here
dot whatever domain that you control.
So we're going to do the exact same thing in here.
We're doing the ns look up command to our burp collaborator domain.
We're just going to use to back quotes and put the command between it.
So we're going to run the U name command and we're
gonna put a dot in here to make this a sub domain
and that's it. We're good to go.
So the main thing you want to keep in mind is we're using back quotes in here.
They're not single or double quotes. These are back quotes.
And as mentioned when you do it this way,
the command that you're placing in here will be
replaced by the result of executing this command and then
the ns look up command is going to be performed
to the result of the execution of this command.
And therefore when we analyze the logs we're going to
be able to see the result as a sub domain.
We're going to collect on sand.
And let's go to the collaborator client and click on paul now and perfect.
As you can see we have a DNS request and we can see the sub domain.
The first part of it is the result of executing
the u name command that we specified in here.
So now you can replace your name with any command
that you want to execute on the target system and
then you'll be able to see the result in your
collaborator or in your logs as a sub domain.
So this could be very handy if you
needed to gather some information about the target before
you can exploit it further or before being able to get an interactive shell on it.