Okay.
So in this lecture we'll combine everything that we
learned so far to exploit the blind S.
S. R. F vulnerability that we discovered earlier
and execute code on a vulnerable web server.
So by the end of this lecture will basically have a remote
code execution on the server by exploiting an S S R.
F vulnerability.
So we're gonna send a forest request
in the forest request. We're setting our target in their affair.
We're gonna be putting our exploit in the user agent
and in yellow in here we have the shell shock.
We're gonna call it magic string to actually
allow us to exploit the shellshock vulnerability,
followed by the command that we want to execute, which is ns look up.
So this is the command that will only send the request to my server. So we're saying.
And as look up my server dot com.
And before that as a sub domain,
we're going to be running a command that we want to execute on the target server.
So as to who am I command?
This is going to go to a vulnerable web application to a blind ss ri vulnerability.
And as a result, it's gonna send this to Target dot com.
It's gonna set the host to target dot com and it's
gonna set the user agent again to the same exploit.
Therefore, on target dot com. The following command is going to be executed.
So who am I is going to be executed first.
And for example, let's say you get the user root as the result and then
it's going to perform an Ns look up to route dot my server dot com,
which is what we specified in here.
And therefore because of the ns look up command this value right here.
Root dot my server dot com will actually be sent to my server
and then I'll be able to read the logs of my server and no,
the result of executing my command, who am I?
Because the first part of the result that I'm going to get is
actually the result of the execution of the command which is root.
So let's go ahead and put this in practice.
So we're gonna turn on our interceptor,
we're gonna click on any product and I'm gonna send this to my repeater.
We're gonna set the target to let's say a service that is running locally.
So we're going to do
and normal http. And let's do 19216801 on port 80 80.
So we did this previously in order to access local
services that are connected to the same web server.
And then in the user agent in here we're gonna set our exploit.
So we're gonna remove everything we have in here
and we're gonna paste the shellshock magic string.
And then we're gonna type the command that we want to execute.
So we want to go to user bin and this look up
and we want to execute the command who am I.
And we're going to change that to my collaborator domain name or U. R. L.
And that is it. So we basically set our target in the refer like we said
and we put our exploit in the user agent.
So let's go ahead and send it
and let's look at our collaborator and see if we got anything.
So we're gonna click on paul now.
And as you can see we got nothing
And we got nothing because
the target that we specified in here the 19216801 is probably not vulnerable.
Therefore what we're going to have to do,
we're going to have to do something that we actually covered earlier.
So we're going to have to use the intruder
to try this exploit on every single possible I. P.
That is connected to the same network as the web server.
And that's why I said
there is a good chance of discovering vulnerabilities in these
services because they are internal services on an internal network.
They're not accessible through the internet so
we can't communicate with them directly.
Therefore hopefully the server admin did not pay too much
attention to them thinking that these can never be exploited.
So what we're going to have to do in here and I cover this in details previously.
So I'm going to do it a little bit quicker than usual.
We're gonna send this to the intruder
and in the intruder
we're gonna clear all the signs
and we're gonna increase the value in here from one all the
way up to 254 because that's all of the possible I.
P. S. In the same range.
So I'm highlighting the number one and I'm clicking the add s to add the ss around it.
And then we're gonna go to the payloads.
We're gonna set this two numbers.
We're gonna increase it from 1-254.
And we're gonna step one at a time.
So we're saying we want to send this exact request with this
exact exploit that we specified right here in the user agent.
And the only thing that we're going to change we're going to change the I. P. In here.
So we're gonna send the same request to every single possible I. P.
By increasing this number from one all the way up to 54 to cover all possible I. Ps.
That might exist within the internal network.
So everything is set now we're gonna click on start attack.
And once the attack is complete we're gonna go back to our burp collaborator or if you
had your own server you want to go back to your logs we're gonna pull it again.
And as you can see we actually have two DNS requests so let's inspect them
and perfect as you can see looking at the domain
that the request was submitted to.
You can see that the first part of the domain right here
is actually a user name. So it's peter dash J W s at S H. Whatever
that is the user name of the account that executed the shell command for us.
So the ns look up command was executed successfully
and the who on my command was also executed successfully.
And the result, as you can see was sent in here instead of route.
We actually have Peter dash J W
S H four.
So basically from now on,
you can replace who am I with any command that you want to execute on the server.
And not only that, it's gonna execute it on the target server,
but it's also going to send the result of execution to your own web server.
So let me show you another example. Let's close this
and we're gonna go back to the positions and simply instead of who am I?
Let's just do your name.
And because I closed my collaborator, I need to put a different domain now
and we're going to start the attack
and let's bring back the collaborator
and let's pull it now.
And if we look at it,
you can see we've got the result of executing the command you name
and we can see that the target is running a Linux operating system.
So right now we managed to get full remote code
execution on a target server through a blind srf vulnerability.
The possibilities are endless.
Now, like you have code execution,
you could get the internal I P you could do other things.
You can map other networks.
So what I would do if I wanted to exploit it more is send it a backdoor.
Very simple linear backdoor. There's one liner back doors for Linux,
even show them in my courses.
So send it to backdoor, execute the back door,
and that will send you a connection and then
you can execute interactively whatever commands you want.