Just like we did before in the last video we put five times back and then we put ETSI password to access
the password file.
What we're going to do today is we're going to try to access a file located on a different server.
So if you're doing this test on an actual web server, then you need to store the file that you want
to access.
Needs to be stored on a place with a real IP address or with a domain name.
I'm doing this on my local server, so I'm going to start this on the on the web server, on the machine,
on the ten 2014 to oh three.
This is ten 2014 to oh four, and I'm going to store my file on ten 2014 to oh three.
So that file, as I said, can be anything.
It could be a web shell.
It could be a payload.
What I'm going to do is I'm going to create a very simple PHP file.
So this is just the PHP start and end of the file.
And what I'm going to put in the file, I'm going to use a function called pass through.
And in that function, basically what this function does, it executes operating system commands, so
it executes Windows, Linux or dependent on the web server.
It's going to execute commands related to that.
So you put the command here between the two quotation marks and I'm going to use the same command we
used with the code execution vulnerability, which was the net cat command, which allowed us to get
a connection or reverse connection from our target.
So I'm going to paste that here.
So let's just first have a look on this.
So PHP and the and these are just the start and the end of the file of the PHP file.
Pass through is a function that I'm going to use which executes any command that's inserted between
the quotations.
And I'm using the same command that we used in the command execution vulnerability, which will just
do a reverse connection to my computer.
So this is all good.
Now, the next step is the most important step and it's starting this file.
So as I said if your target.
Was a remote web server, then you should be storing this file in a place with a real IP where you can
access it from the remote web server.
Now I'm going to be trying to access this from my Metasploit table machine, which is able to access
files stored on the Kali machine because they're both on the same network.
And I'm going to be calling this I'm going to be storing it in my var.
W w w h html.
So it's storing being stored on the Kali, not on the Metasploit table.
And I'm going to call it reverse and I'm going to save it as txt, not php.
And I'm doing this.
If I start it as a PHP, it's going to be executed on the Kelly machine.
So it's going to create a reverse connection from the machine.
And I don't want that.
I don't want to hack the machine.
I actually already have access to the machine.
The one that I want to hack is the Metasploit machine, and that one is stored remotely.
So in order to be able to include the PHP code and execute it on the remote machine, we're going to
use it as text and get it executed on the Metasploit machine instead of executing it on my Kali.
So I'm starting it as a text and I'm going to say, save it.
And now let's just see here.
So if I go to my local host.
And if I say.
Reverse the text.
We'll see our file right here.
So again, this is on my local host, which is not the Metasploit machine.
It's ten 2014 to oh three and the Metasploit table is on to oh four.
So how are we going to run this first?
Let me just listen for connections like we did before.
So it's just going to be net cat v LP at 80.
And then right here, instead of including a file on the same server, I'm going to include the remote
file and the command is going to be HTTP.
So it's just going to be the link to this file so we can access the file here as txt.
I'm going to copy it and paste it here.
And also in some cases, you might need to add a question mark to the end to get this file to be executed
as PHP.
So I'm just going to go over this again for one more time, including a remote file which is on a remote
server.
Make sure the remote server is accessible by your target and also make sure you start as txt.
Because if you keep it as PHP this file, the reverse file will be executed on the remote server.
So it will be executed on the 203 and instead of being executed on the 204 and I'm keeping it as txt.
This way it will be it's going to be executed on the 204 and it's going to give me a remote connection
to this computer, to the Metasploit computer.
So if I come back here, as you can see, we have a remote connection.
If we do a you name a, you'll see that this is the Metasploit table machine, not the Kali machine.
So we basically have full access to the Metasploit machine through a remote file inclusion vulnerability.
Now, if we do an RLS, we can do a P.W DX to see where we are and we can literally run any Linux command
we want now on the machine and do anything we want.
Basically, we have full access to that machine.