So we're still inside Weebly.
And in this lecture we're going to see how we can upload and download files from the target system.
At the moment.
I'll be running some shell commands and I'm going to look for a file that's interesting for me.
So with the first thing we're going to do is download the file and I'm going to do a PDF and you can
see that I'm enviar w w w w I'm going to do an LZ to see all the files right here and we can see that
there is a directory called config and the config directory is R or if you see a file called config
or directory called config, then chances are it contains important information.
Most of the time it contains information about connecting to the database.
So I'm going to navigate to that directory using the CD command.
And then I'm going to list to see what I have.
And you can see that we have a file called Config dot inc dot PHP.
Now we can try to read this using the cat command and we can try to read it using the functions that
come with the weebly.
But this is not what we're interested in in this lecture.
Let's see how we can download this file so we can read it on our local machine.
Now remember, you can't actually browse through this file.
So if we go here to the server.
And if we go to a.
Config.
And you see that there is a config file, but if we click it, you'll see that we you can't actually
read it because it's written in PHP and PHP files cannot be right remotely.
So even if you view the source.
You'll see that it's empty.
It has no lines whatsoever.
So let's go back and we're going to use the download.
So the download is called file download.
And then I'm going to put minus H to see how to use it because I don't know how to use it.
So just I want you to see the idea of how you use all of these functions.
You put the function name minus H to see how to use it, and you can see that the way to use it is you
literally just specify a file download, you can specify the vector.
So this is similar to what we were doing when we were reading the ETSI password or executing the shell
as h execute shell commands.
So you can specify the method of of downloading the file because sometimes maybe the basic download
method will not work for you.
So you can just do minus vector and you specify the vector that you want.
So in this example, I'm just going to use the default one.
I'm not going to specify a vector.
So again, we're going to do file, download or path, which is the remote path.
So the file on the server that you want to download followed by the location that you want to download
it to on your local machine.
So the command is going to be file download, the remote path is going to be config dot dot php and
I want to store it in my route.
So this is on my actual local machine.
It's going to be stored in route and I'm going to call it config downloaded.
And I'm going to make it a text so you can actually put it to PHP if you want, but I'm going to make
it a text in my case.
So the command is very simple.
It's file download followed by the file, the full path or the location where the file is located.
And the file for me is located in the correct working directory and it's called config dot inc dot PHP.
And I want to download it to my root config downloaded.
So I'm going to call it config downloaded the txt.
And if I wanted, if this command didn't work for me, then I can just do the vector by doing minus
vector.
And specify the way that I'm going to download it so I can just specify the all the methods that we
have here.
So we have file, we have a free file gate and base 64.
So I'm just going to use the file.
And that's it.
The files should be downloaded.
So let's go to our file manager.
And we're already in the route and you can see that there is a file called config downloaded or txt.
If we double click it, you'll see the information that was saved in that file.
And remember when we went on the browser, nothing was displayed.
When you go here you'll see that you can see everything because we actually downloaded the source code
for the file.