And the previous lecture we've seen how we can write stuff to the server using an SQL injection, using
the into out file function.
And if the server allows us to write to the web directory to a place that we can browse, then we can
just write our reverse shell using the same code that we've seen before, using the pass through, and
then we can browse it and we'll get a reverse shell exactly the same way that we did when we upload
a file.
The problem is we weren't able to write stuff to the web directory, so we can't actually read the stuff
using the URL.
The only place that we could write to was the temp, so you can't actually browse the TMP through the
URL.
Therefore you can't just browse that file.
So what I'm going to do today is I'm going to show you a workaround for that problem, but for this
workaround to work the same website or the same server has to have a local file inclusion.
This is very important, the same web server, not the same website, because we see in remember in
the first section how we can discover all the websites that are within one server.
So if one of them has an SQL injection and the other has a local file inclusion, you can combine both
of these and get a shell and I'll show you how to do that.
So I'm actually going to be doing this on the DVD.
You can do it on Matilda Day, but I'm just doing it here just for a change to show you just another
example.
So I'm going to the SQL injection and I'm going to put number one here.
Submit it, and then we're going to start doing our injection exactly the same way that we always did.
So we close the quote and we do union select.
One, two.
And our comment.
And that will work, as you can see.
Now, what I'm going to do, I'm going to write my shell to temp, and then I'm going to browse that
shell through the local file inclusion.
So my exploit is going to be union select one to.
And in one, I'm actually going to write what I want to write to the file.
So I'm going to write a PHP code, the same PHP code that we've been using to get a reverse connection
to my computer.
And the code is going to be passed through.
And see.
Ben assuage my IP.
The port, which is 80, 80.
And instead of number two, I'm going to put null.
So nothing will be written to the file.
And then we're going to say into our file.
And we'll call this reverse VP.
So let's just have another look on this exploit.
So what we're doing, we're doing a normal union select and we're doing a normal into out file and we're
saving this in the temp exactly like we've seen in the previous lecture.
But instead of writing just normal stuff, we're actually going to write PHP code and we're going to
do a pass through and see bin S-H, my IP port and what this is going to do, it's actually going to
try to connect to this IP using net cut.
So let's exploit this.
And I'm actually going to set the ID here to minus one so that no values come in for the admin and admin
in here and the first name and the surname.
So I just set that to minus one and then I'm going to put my exploit here after the minus one.
Same way that we always do it.
Enter.
And it tells us that the file already exists, but it actually doesn't.
This is just a normal error.
So this file has been written now to the server.
Now, the problem is if if we wrote this file to somewhere else other than temp.
So for example, if we can actually write this file to say.
Var w w w dv w a.
Then we'd be able to just go and browse this file.
From here.
So all we have to do is just go to the W to this and then write in reverse the PHP and then we'd be
able to see it.
But again, we actually don't have permission to write in here.
You can try to write an images, for example, DWI images, so you can actually before you go to this
method, you can go ahead and try to find a place or writable place on the server.
A lot of the time you won't, because if web admins should actually know about this and they shouldn't
allow you to write stuff like that, but if you did, then you're lucky.
You can just go ahead and browse it like this.
If you didn't, then just continue this video and see how we're going to exploit it.
So now I'm just going to listen for connections using net cut.
So I'm going to do c v LP.
8080.
And that will listen for income and connections on Port 8080.
So when we execute this code, it will try to connect back to us and we'll get the connection here.
So now we have the file written and we're listening on connections.
All we need is a way to browse this file to get it executed.
So we see that we can't actually write anywhere, that we can browse it.
And because we start this in temp, if you manage to run it from anywhere on the web server, then you'll
have connection and you'll have access to this website.
So it doesn't have you don't have to find a local file inclusion in the same website.
You can find it in any website, in the same server.
And this is where the information gathering part comes in really handy.
So I'm going to do what I'm going to do now is I'm actually just going to run from within TBWA, but
I just want you to know that you can do this since we started it in the TMP.
You can.
Open it and browse it from within any website on the server.
So all you have to do is just find a website on the same server that has a local file inclusion.
Now I'm going to go to the file inclusion, and we've used this before.
So what I'm going to do is I'm just going to browse to.
It's password first.
To make sure it works and it works.
Now we're going to browse to our file that we just uploaded, which is stored in temp.
Reverse.
The PHP.
And as you can see now, we've got a connection and we can run any commands we want on the server.
And pretty much we have a reverse shell and we can do whatever we want on it.
Now I'm going to listen on 80 again.
And what I want to do is I want to show you how you can exploit this now from anywhere within the server.
So I'm actually going to go to Matilda instead of give you a.
And we're going to go to the local file and inclusion vulnerability in here.
So we'll try to exploit this now the same way.
So it's five times back.
Etsy password.
And as you can see, we can read the Etsy password.
Now all we have to do is just read the temp.
So this is a completely separate website from TBWA we found.
Let's assume that we find an SQL injection in DWA and then we find the local inclusion in this, combining
the two because the two websites are installed on the same server, on the same computer, we can actually
get a reverse shell on that server.
And doing that we're just going to go to TMP, reverse the PHP.
And again, as you can see, we have our shell here where we can do whatever we want on the Target Web
server.
So again, the idea to take from here is using into out file.
You can write stuff anywhere.
If you can write stuff within the web directory, then you're lucky.
You can write your reverse shell and just browse it through the URL as if you're browsing any file on
the web server.
If you can't, then look for another website on the same server that has a local file inclusion.
And if you do, then you can just write the file using the SQL injection and then browse it using the
local file inclusion and you have your reverse shell.