I mentioned earlier that we only allow us to run a number of very useful functions on the target server
if we manage to upload its shell to that server.
So in this lecture we'll see how we can convert our basic shell access to a shell.
So I'm going to create first of all, I actually have connection here coming from my Metasploit table
machine and my privileges are just normal w w w data.
As you can see.
Now, what I'm going to do is I'm going to create my wiggly shell first.
So we've done this in the file, upload vulnerability.
So it's very simple.
All you have to do is just run weebly.
And then generate to create a shell or create a backdoor.
And then we're going to have to set a password for that backdoor.
And I'm going to set it to one, two, three, four, five, six, and then state where do you want
to save it?
And I'm going to save it in route.
And I'm going to call a chair.
Now in the file upload vulnerability.
We actually created the shell with PHP format.
Right now I'm not going to create it in PHP because I have to download it from the Metasploit table
machine.
When PHP files are downloaded, the source code will not be downloaded with them.
So if I created sp php and downloaded from the Metasploit table machine, it's not going to work properly
as I wanted.
So what I'm going to do, I'm going to call it as I'm going to create it as text and then rename it
once I downloaded at the Metasploit table machine.
All I have to do now is upload it somewhere that is accessible by the Metasploit evil machine.
So in real life scenarios, you want to be able to upload it to somewhere where you can directly access
the shell.
In this lecture because we're doing it in our local and our local environment.
I'm actually going to just put it in my web server, in my machine, which is accessible by Metasploit.
So I'm just going to do CPU.
To copy, and I'm going to copy your route.
Shell dot txt and I'm going to copy it to var w w w.
HTML, which is my document root in Kali.
And I'm also going to start my web server, so I'm just going to do service.
Apache two.
Start.
And now Apache is running.
So I literally have I basically have a web server now which contains this current file.
Let's see if the file exists.
So I'm just going to come here.
And I'm going to go to my local host.
So pretty much I can just do local host, but I'm going to put my IP, which is ten 2014 to 13 and we
call that the TCD.
As you can see now we can see the code for the actual backdoor.
This is very important.
So when you upload it to a server, make sure that you can access the shell directly like this and make
sure that when you access it, you can see the code without anything on the sides, with no ads, with
no binaries, with nothing showing up around it.
So you can literally access the bear code.
Once you do that and you have this URL, all you have to do is just download it from the Metasploit
table machine.
So at the moment this is my Metasploit table machine.
So if I do a.
You name a.
Just to confirm, you can see that I'm actually connected and inside the Metasploit machine.
So all I have to do is download it, but I can't download it anywhere.
I need to download it somewhere again accessible by my carry machine so I can connect to it.
So you want to you want to download it somewhere within the document root within the var, w, WW,
W or whatever document root your current website uses.
So if I do a WD.
You can see that I'm inside var.
W w w w a vulnerabilities.
So I'm going to do c d back to go one one step back.
And if I do an LZ here.
You can see the files that we have in this current directory.
Now let's try to download the file in this current directory.
Now sometimes you won't be able to download files depending on your privileges or permissions.
So I'm just going to do a W get and this is the download command.
So W get can be used on Linux systems to download any files.
So you literally just do wget and that and then you put the URL that you want to download so you are
that we want.
The download is http.
Ten 2014 to 13.
And then we called the file shall dot txt.
Now I'm going to give it some time to download.
And then I'm going to do an LZ again.
And as you can see, we have a file called child dot txt.
Now this file is uploaded on the Metasploit machine inside DVD.
DWI vulnerabilities.
Again, if we do PWT, you can see that we have DWI followed by vulnerabilities.
So let's go and try to browse it in here and make sure that it exists.
Ten, 2014 to 12, which is that's where our DWI is.
And then we're going to go to vulnerabilities.
And our file is called Shell the TCD.
But I didn't put the DVD before it.
And as you can see, we can access the file now which is uploaded inside VW vulnerabilities.
We can see our shell, the text.
Now again, this is not good enough because it's not getting executed.
So now all we have to do is change its extension to PHP again and again.
We're going to do that from our basic shell access right here.
So we're going to do MV.
Shell dot txt.
Two Shell php.
And then do less to make sure that the process was done properly.
And we can see that our shell is called shell.
PHP Now we can connect to the shell using our WEEBLY client, so we're just going to do weebly.
Give the shell the URL.
So our URL, the shell is stored now at http.
So this is where you uploaded the shell.
So it's it's exactly the same URL as this, but with dot PHP because we changed the file extension.
I'm actually going to copy this.
And I'm going to set this to PHP.
And then we're going to put the password, which is one, two, three, four, five, six.
Make sure you put the same password that you said when you created the backdoor hit enter.
And as we as you can see where inside the target computer were inside this target.
And we can run all the commands that we've allowed us to do.
So we can just do an LZ.
I pwt and all the next commands plus all the commands that we really allow us to do, all the functions
that we allow us to do, which we're going to have a look on in the next videos.