Now that we managed to execute commands on the server using the low security settings, let's see if
we can set it up to medium and if we can do the same after increasing the security.
So we covered the basic case and now I'm going to go to security and I'm going to send set the security
level to medium.
I'm going to submit this.
Then we're going to go back to our command execution and I'm going to input my IP.
Now, I just want to note that my IP is different now.
If you notice that the IP of this server right now is 209 and my machine IP is 208 if I do a config.
You can see that the IP of my machine is 208.
So again, I'm going to try to bring the machine.
Let's just first see if we can fake something.
So we're assuming that we don't know this website.
And again, this is going from a black box point of view.
So we're not going to look at the source code.
So we're just going to run this website, stillness, that's going to ping stuff for us.
So I'm just going to put the IP of the card and see if the ping works.
So we're just going to put ten.
And as you can see now, the pink command is working.
Now let's see and try to do what we did before.
So we used to do we put the IP and then we use the semicolon to say that run this command and this command.
And in the low security settings, this used to work for us.
So we're going to submit this and at the bottom it should show us our current working directory because
we have the p.w dx here.
So I'm submitting this.
And as you can see, nothing got executed.
So not even the pin command got executed.
So again, looking from a black box point of view, we're going to think, oh, maybe they're using
some sort of filtering on the semicolon.
So they're checking if the command contains a semicolon, then they're going to ignore that command
and not run it.
So we're just going to try to use another trick, something similar to the semicolon.
So what we used to do before we had an example of doing LZ, so that's the list command and or and the
PWT is what shows the working directory.
And we can combine these two by doing LZ.
Semicolon and then we do the pWt.
And that will do both.
It will do the lies and the pwede so that what you used to work for us doesn't work anymore because
they're probably filtering based on this specific character.
So what we're going to do is we're going to use something else available for us in the Unix command,
which is the pipe.
So piping is really useful when it comes to UNIX.
You'll use it a lot.
What it basically does, it means run the first command and once you run that command, send the output
or pipe the output to this command and run the second command on it.
So essentially it'll run two commands in our case.
Now you can use pipe for a lot of things, and it's used into regex and things like that for us.
All we want to do is we're interested into getting the second command to run.
So let's have an example of this.
So we're going to do LZ, which is going to be similar to our ping.
And then we're going to put the pipe character, which is the vertical bar, and then we're going to
put the second command that the LZ output should be passed to.
Now, PWT doesn't expect any input to be passed to it.
So at the moment when we run this, it'll basically run both.
But it won't show you the result of running LZ.
It will feed it to the PWT and show you the results of PWT.
So when I hit enter you'll see that p wd got executed.
So in our example, what's happening is we have a ping.
Then we're inputting our IP, so we're going to put our IP.
And then we're going to use the bar character and we're going to put the second command that we want
to run, which will be the command that will give us Shell on the server.
But for for the testing, we're just going to do a PWT.
And again, as you can see, we don't see the results of the ping.
We only see the result of the p.w because again, for the third time this command, it will run this
and feed the output to p.w.
So let's try this in here.
So we're going to do we're going to put our IP again like we did before.
And we used to put we'd like that.
But I'm just going to put my bar character.
And enter.
And as you can see, the second command got executed and we got our current working directory.
Now we can modify this to get a shell on our computer.
So again, we're going to use the bar.
And we're going to get it to you.
We're going to use the exact same method that we used last time.
So we're going to do NC minus E.
Input my IP.
And then I'm going to put the port, which is 80, 80.
Now before I execute this.
I'm going to listen on Port 88 for a connection here.
And we're going to use the same command like before using that cat.
So and c v v lpi 88.
This is listening and we're going to connect back from here to the Kelly hit submit.
And sure enough we get a connection here that allows us to run any command we want on the server so
we can do p.w now we can list the files, we can get our ID or do anything we want on the current server.
So we basically manage to gain access to that website.