And this lecture will see how we can get a reverse connection from our weave shell.
So at the moment we uploaded Weebly and we're connecting to it directly using this URL.
So when we hit enter, we're actually just doing a direct connection and it's as if we're just interacting
with a normal PHP script uploaded on that directory.
So what we want to do is maybe in some cases you can't really run commands like this.
So right now I can run whatever command I want, whatever Linux command.
We also see in how we can use the shell as a function that comes with Weebly to try and bypass if we
can't run commands.
If none of that works, or if you want it, just an actual direct reverse connection from the target
web server to our machine.
Then you can follow what I'm going to do in this lecture.
It can be really handy because you'll have a direct connection and you'll be able to bypass a lot of
security measurements.
So we're going to do help first to see the options that we have.
And the function that I want to use today is the reverse.
Whereas it's back to reverse TCP and it basically just gives you a reverse TCP shell so it won't be
executed through PHP.
It will be a virtual reverse connection coming from the target server towards your computer.
And because of that, it will bypass firewalls because the connection is coming out of this web server,
not to the web server.
So the first thing we're going to do is, as usual, we're just going to run backdoor reverse TCP and
I'm going to put minus H to see the options that we can get with this function.
And you can see the way to use it is the first thing you need to specify the name of the function,
followed by the type of shell.
So we're going to leave that the same.
You can tell it not to auto connect, but we don't want that.
We actually want it to automatically connect.
And then you can specify the vector.
And again, the vector is very important and it specifies the way the reverse connection will be spawned.
So you can use net cat, it can be done through net cat, it can be done through Python, it can be
done through Perl Ruby.
These are all programming languages.
So if the connection doesn't, if the target server doesn't have net cat installed or if it has certain
security or permissions that prevent you from using that cat, then you can try to get your shell through
Python.
If Python is not installed or if it has some sort of measurements that prevent Python from connecting
back to you, then you can do it through Perl.
And again, if Perl is configured in a way that it's not allowed to spawn reverse connections, you
can do it through Ruby and again, you can use any of these vectors until one of them works for you.
And once one of them work for you, chances are you're going to be able to bypass a lot of security
measurements.
Definitely, you'll be able to run bash commands on the target server.
So if if you can't run bash commands normally and if you try the shell as a function that we've seen
in an earlier video and still didn't work for you, then you should come to this, try this method.
If it works, then you'll be able to run any shell commands you want on the target server.
So let's try it in action.
So we're going to type in Backdoor.
Reverse TCP.
We're going to give it the vector.
And I'm going to want to use Net Cat.
And then we're going to give it dependent on this, as you can see.
So we did that and we gave it the vector.
Then we need to give it our local host.
So the IP address of our current computer followed by the port that we want to connection to be done
through.
So to get the IP address of my computer, I'm just going to run if config.
And you can see that my IP address is ten 2014 to 13.
So I'm going to close this.
And then we're going to give you the port and I'm going to set the port to 80, 80.
So the command is very simple backdoor reverse TCP vector, which is going to be net cut.
And then we put our current IP address followed by the ports that we want the connection to be done
through.
I'm going to hit Enter.
And now the connection established.
So now we can run any commands we want.
And keep in mind that these commands will be executed through net cut.
So the connection is coming back now from the server to us and now we're communicating with it through
a completely different port.
It's not going to go through Weebly, it's actually going to go through a net cut.
So if there was some sort of security that didn't allow us to run commands through Weebly, then we'll
be able to bypass them now.
So now we can use it.
We're going to do P.W, for example, and we have to add a semicolon after it.
You can see that where we are, we can do a Who am I?
Seems like we lost our connection, so I'm just going to do it back.
So again, we can do.
Who am I?
We can pretty much do any command we want.
Now, again, if this didn't really work for you, you can go ahead and try a different vector.
You can try the python.
You can try the perl.
After each of these vectors, try to see who am I and see the current permissions or the current user
that you're running as because you might actually be running under a different user.
One thing to keep in mind here is your IP, because the connection is is a reverse connection.
So it's coming back from the target web server to your computer.
Therefore, at the moment I'm actually using a private IP within my current network, but it works because
the website is on the same network.
If I was doing this against a real website, this won't work because my private IP is not accessible
publicly because it's hidden behind the router.
So if you want to receive connections, if you want to receive reverse connections from an actual web
server, and if you're not on the same network as that web server, then you need to either set up your
carry machine as a DMZ host or you need to enable IP forwarding to enable the the port that you're using
here.
So 80, 80 in this case to be forwarded to your private IP.
You can do both of these things from the control panel of your router.
Your router is usually located at the first IP.
So my IP now is ten 2014 to 13.
The router is usually at the first IP, so it will be at the one.
So you can access that through the browser.
Look for the option called DMG and set the machine as a DMG host.
Another option is to go to port, forwarding another rule to forward port 8080 to the IP of the machine.
Also make sure the IP, the machine is connected to your actual network and it's not set up as a NAT
network like this.
So make sure you have a wireless card connected to your home network and from there you will have an
actual IP in your network instead of a private virtual IP like we have here.