Now we actually have a complete bash shell so we can run any bash commands.
We want the exact same commands that we've seen in the Linux Basic section at the start of this course.
So I won't be going about how you do mine and how you do help to see how you use the commands.
I'm going to skip through that and I want to show you a few commands that are useful when you first
gain access to a server.
So the first thing you want to check is what's my privileges at the moment?
And the privileges depend on how you gain your access.
So it depends on the page that you're getting your access through.
So we got our access through this current page.
So dependent on what privileges this page is running, as we will get the same privileges when we get
our reverse shell.
Same goes for SQL, same goes for everything really.
So I'm going to do who am I?
And as you can see now, my privileges are WW data.
So I'm not rude, I'm not admin, I'm not MSFT admin, w WW data.
And this is very important because when you wrote you can do anything you want on the server.
When you are another user, then you have less privileges or less permissions to do stuff on the current
web server.
So another thing that you want to check is the kernel version of the computer.
So you can do you name a.
And this will display a lot of information other than the current version.
So you see the computer name and you can see the version of the kernel.
This is important if you're trying to run a local exploit to escalate your privileges to a higher privileges
or maybe even get root privileges, which will give you access to do anything you want on the on the
whole server, not only on this website.
Now, as I said, you can run any of the commands that we learned so far.
So you can do list to list the current files and we can see that there is help index and source.
You can do pwt to to see where you are and we are currently at var w w w d a vulnerabilities and xg.
So you can navigate through these exactly the same way you'd navigate with a normal Linux system so
we can do a dot dot to go back.
The blood and we're at vulnerabilities again.
C Dot dot and another dot dot.
Now if I do a pdf, you'll see that I'm as var.
W.
And this is the document root at the moment.
So if I do an lz l to get more information and note.
We can see here the permissions and before the permissions.
Now, if you see you see, notice that there is a D here.
That means that this is a directory.
It's not a file.
And when you don't see the D, that means it's a file in here.
Now you can see that we have access to all the other websites so we can access the TK Wiki website.
We can also access the utility website and you can access the DVD right here.
So what this shows you is if you manage to hack into any website, then most of the time you can actually
navigate to the same websites on the same server.
And this is what I said in the information gathering section.
I said it's very important because sometimes your target website will not have any vulnerabilities,
but you might find something on the same server and from that you can navigate to, to your website.
So for example, we gained our access through DWA and let's say Mattel today was our actual target,
but we couldn't find anything in it.
So we hacked into the server through DWA and I can navigate now to Mattel today so I can just do CD.
Matilda.
And then I can do an LSL to see the files.
So you can remove files using the ARAM command.
You can delete files.
You can do anything you want.
Really.
Now, in the other websites in Matilda, even though we never actually got access to Matilda, we got
our access through DWA.
Now one of the very important commands is cut, which allows you to read files.
And one very important file that you always want to read is the ETSI password.
Now we actually try to read this using the local file inclusion vulnerability, but I want to show you
now.
So if you do a cad.
Etsy password.
You can see that we can read all the content of this file right here.
And what this file has, it shows you the users installed on the current computer and it shows you the
directory for these users.
Now, in this particular setup, all the websites are stored in var w w w so they're still in var w
w w and then you can put DWI to access the DWI website or you can put Matilda to access Matilda.
Most of the time you won't see this in most websites.
They actually create a user for each website and the user usually corresponds to the website name.
So for example, let's say your example, your target was Facebook, then the user would be called Facebook
or Facebook user or something similar to that.
So what you'd want to be doing is.
You want to go through this file and see the path for that for your target website?
So let's say you hacked into this website through Google and Facebook is on the same server.
Then look for a user called Facebook and then just navigate to that file.
Now you can see that the WWE data user right here.
And you can see that it has its directory stored at bar w w w again if you open that you'll see all
the websites in here.
So if we just do see the var.
Then you can list whatever you want.
So they take a lesson from this is that on a virtual you can basically run any command, any Linux command
you have dependent on the privileges that you have.
The privileges depend on the page or the source that gave you the access.
So whatever privileges that resource is running, you'll actually get the same privileges, the same
permissions.
And once you're in a server, the server is just a computer.
So once you gain access to that server, you can increase your privileges, you can escalate them and
try to access other websites on the same server.
How you access the other websites, it's in the ETSI password.
You list that and you see the user corresponding to your target website and just open that directory
using the KD command.
Now I'm going to attach a list of the bash commands that you can run so that you can go through them,
try them and see how they work for you.