And this lecture, we're going to have a look on file upload vulnerabilities.
These are the simplest type of vulnerabilities because they allow us to upload any type of file.
So, for example, if the target computer can understand PHP, then we can upload any PHP file or a
PHP shell and get full control over the target computer.
Now, if the target computer or the target server understands Python or any other language, then you
can just upload Python code, Python shell or Ruby Shell.
You can create these shells, use anvil evasion or metasploit, or you can use your own PHP or python
shell.
What we're going to do today.
We're going to have a look on a tool called Weebly that generates PHP shells and allows us to gain access
and do a number of cool things on the target computer.
So first of all, I have my DWI here and usually when you're trying to test a website, what I recommend
is before trying to use any tools or anything after you do your information gathering is you just go
in and try to browse the website so you see what you can see.
Just get a feel of the website, see what's installed on it and all that, and try to exploit any features
you see.
So for example, let's say you went on everything and then you reach the upload.
We can see that this website allows us to upload a file.
Now this sometimes in in your penetration testing tasks, it could be a website that's allowing you
to upload a profile picture a picture.
If it's a classified website, maybe it's allowing you to upload pictures of cars or whatever you're
trying to add in the website.
So as you can see here, the website expects you to choose an image and upload an image.
So let's see if we can upload an image first.
So I'm going to go on my downloads and I have a picture here in the resources.
Just a picture of a car.
I'm going to upload it and see if it gets uploaded.
And we can see that the upload was successful and it stored in this particular location.
So it's dot, dot, dot, dot, which is which means to directory is back and then this file name.
So let's see if we if the picture has actually been uploaded.
So I'm taking away two directories.
I'm taking away the vulnerabilities and upload.
I'm only using that.
And then we're going to get this location on the server just to see if the picture was uploaded properly.
And as you can see, the picture has been uploaded.
So that's all good.
Now the next thing we want to do, let's try and upload a PHP file.
And to do that we're going to use a tool called Weebly, as I said, to create a payload or a shell
if you if you want to call it.
And it's obviously it's going to be a free shell.
You can use Metasploit, as I said, to create a PHP payload, but we're going to be just having a look
on a different tool that's designed for web application penetration testing.
So the tool is very easy.
We're going to.
Put the tool name, which is Weebly, and then we're going to put generate.
Because we want to generate a payload or a shell file, then we will put a password for that file so
that only us can access it and control the website when we upload it to the website.
So my password is going to be one, two, three, four, five, six, and then I'm going to say what
I want to store it and I want to store it in route and I'm going to call it Shell Dot PHP.
So very simple we Lee is the name of the program generates is to generate a shell the password that
the shell is going to authenticate us with and it's going to be stored in route shell dot PHP we're
going to hit, enter and create it.
Now if I am already in my route.
So if I just do ls I should see it.
And we can see it right here.
So the next thing is we're just going to go back to our website and try to upload that shell.
And I'm going to look for a shell.
And here it is.
Going ahead on upload.
And as you can see now is telling me the file has been uploaded successfully and it's in the same place
that the picture was.
So all we need to do now is we're going to use the same link and we're going to use Weebly again to
interact with that share that we uploaded.
Now let's first of all see if the shell exists and it's been uploaded properly.
So I'm just going to browse it through my browser.
Gelled with PHP and you can see that you get a blank page.
So we're not getting 404 file not found, which means that the file has been uploaded and it's there.
So we're going to try to interact with it from Weebly to connect to it.
We're going to type in Weebly.
And then we're going to put the URL where the shell is.
So this is where our shell has been uploaded and then we're going to put the password.
So my password was one, two, three, four, five, six.
Very simple.
We've got the URL where the file is and one, two, three, four, five, six.
This is very simple.
Similar to when you use your multi handler waiting for connections are connected to your backdoor.
So we're literally just going to connect the backdoor that we uploaded.
And as you can see now we're in the file system.
So from Weebly from this place, you can actually just type in any Linux command and you'll be able
it will be executed on the target computer and you'll see the result here.
So if I do a pwt, you'll see that I'm in w w w hackable upload.
And if I do an ID.
I'll see my user at the moment, which is the WW data and if you do.
A You name.
A Just to confirm that this is the Metasploit evil machine.
You'll see that this is the Linux Metasploit table machine.
Now we can do anything we want.
We can list the files we can navigate.
You can do any Linux command that you want to do now.
We have changed.
Our place has been changed.
We've also offers much more features than just this.
So it actually allows you to do a number of cool things if you type in help.
You'll see all the cool stuff that you can do with Weebly so you can try to escalate your privileges.
Execute SQL queries and a lot of cool stuff that is just designed for web application penetration testing.
For now, I'm going to leave it at this.
And this just shows you how to use file upload vulnerabilities.