Narrator: In this lecture, 2 2
we're going to have a look 3 3
on File Upload Vulnerabilities. 4 4
These are the simplest type of vulnerabilities 5 5
because they allow us to upload any type of file. 6 6
So for example if the target computer can understand php, 7 7
then we can upload any php file or a php shell 8 8
and get full control over the target computer. 9 9
Now, as the target computer or the target server understands 10 10
Python or any other language, 11 11
then you can just upload Python code, 12 12
Python shell or Ruby shell. 13 13
You can create these shells using 14 14
Veil-Evasion or Metasploit, 15 15
or you can use your own php or Python shell. 16 16
What we're going to do today, 17 17
we're going to have a look on a tool 18 18
called weevly that generates php shells 19 19
and allow us to gain access 20 20
and do a number of cool things on the target computer. 21 21
So, first of all, I have my DVWA here. 22 22
And usually when you are trying to plan test a website, 23 23
what I recommend is, 24 24
before trying to use any tools or anything, 25 25
after you do your information gathering, 26 26
is you just go in and try to browse the website. 27 27
See what you can see, just get a feel of the website. 28 28
See what's installed on it and all that. 29 29
And try to exploit any features you see. 30 30
So for example, lets say you went on everything, 31 31
and then you reached the upload. 32 32
We can see that this website allow us to upload a file. 33 33
Now this sometimes in your penetration testing tasks, 34 34
it could be a website that's allowing you to upload 35 35
a profile picture, a picture, if it's a classified website, 36 36
maybe it's allowing you to upload pictures of cars 37 37
or whatever you're trying to add in the website. 38 38
So, as you can see here, the website expects you 39 39
to choose an image and upload an image. 40 40
So let's see if we can upload an image first. 41 41
So I'm gonna go on my downloads 42 42
and I have a picture here in the resources. 43 43
Just a picture of a car. 44 44
I'm gonna upload it and see if it gets uploaded. 45 45
And we can see that the upload was successful 46 46
and it's stored in this particular location so 47 47
its .... 48 48
which means two directories back and then this file name. 49 49
So let's see if the picture has been actually uploaded. 50 50
So I'm taking away two directories, 51 51
I'm taking away the vulnerabilities and upload. 52 52
I'm only using that. 53 53
And then we're gonna get this location on the server, 54 54
just to see if the picture was uploaded properly. 55 55
And as we can see the picture has been uploaded, 56 56
so that's all good. 57 57
Now the next thing we wanna do, 58 58
let's try and upload a php file. 59 59
And to do that, we're going to use a tool called weevly 60 60
as I said, 61 61
to create a payload or a shell if you wanna call it. 62 62
And it's obviously gonna be a php shell. 63 63
You can use metasploit as I said 64 64
to create a php payload 65 65
but we're gonna be just having to look on a different tool 66 66
that's designed for web application penetration testing. 67 67
So the tool is very easy, 68 68
we're gonna put the tool name, which is weevly. 69 69
And then we're going to put generate, 70 70
because we want to generate a payload or a shell file. 71 71
Then we will put a password for that file, 72 72
so that only us can access it and control the website 73 73
when we upload it to the website. 74 74
So my password is gonna be 1-2-3-4-5-6. 75 75
And then I'm gonna say where I want to store it. 76 76
And I want to store it in root 77 77
and I'm gonna call it shell.php. 78 78
So very simple, weevly is the name of the program. 79 79
Generate is to generate a shell. 80 80
The password that the shell is going 81 81
to authenticate us with, 82 82
and its gonna be stored in root/shell.php. 83 83
Gonna hit enter and it's created now, 84 84
if I'm already in my root so I just do ls I should see it. 85 85
And we can see it right here. 86 86
So, the next thing is we're just gonna go back 87 87
to our website and try to upload that shell. 88 88
And I'm gonna look for shell and here it is. 89 89
And I hit on upload. 90 90
And as you can see now it's telling me 91 91
the file has been uploaded successfully 92 92
and it's in the same place that the picture was. 93 93
So all we need to do now is we're going to use the same link 94 94
and we're gonna use weevly again to interact 95 95
with that shell that we uploaded. 96 96
Now let's first of all see if the shell exists 97 97
and its been uploaded properly. 98 98
So I'm just gonna browse it through my browser. 99 99
Shell.php and you can see that you get a blank page 100 100
so we're not getting 404 file not found 101 101
which means that the file has been uploaded and it's there. 102 102
So we're gonna try to interact with it from weevly. 103 103
To connect to it, we're gonna type in weevly, 104 104
and then we're gonna put the URL where the shell is. 105 105
So this is where our shell has been uploaded. 106 106
And then we're gonna put the password. 107 107
So my password was 1-2-3-4-5-6. 108 108
Very simple, weevly, the URL where the file is 109 109
and 1-2-3-4-5-6. 110 110
This is very similar to when you use 111 111
your multi-handler waiting for connections 112 112
or connected through your backdoor. 113 113
So we're literally just going to connect 114 114
to the backdoor that we uploaded. 115 115
And as you can see, now we're in the file system, 116 116
so from weevly, from this place, 117 117
you can actually just type in any Linux command. 118 118
And you'll be able, it will be executed 119 119
on the target computer and you'll see the result here. 120 120
So if I do a pwd, 121 121
you'll see that I'm in var/www/hackable/uploads 122 122
and if I do an id, 123 123
I'll see my user at the moment which is www.data. 124 124
And if you do a uname -a 125 125
just to confirm that this is the metasploitable machine 126 126
you'll see that this is the Linux metasploitable machine. 127 127
Now we can do anything we want. 128 128
We can list the files, we can navigate. 129 129
You can do any Linux command that you wanna do. 130 130
Now we have changed, our place has been changed. 131 131
Weevly also offers much more features than just this. 132 132
So it actually allows you to do a number of cool things. 133 133
If you type in help you'll see all the cool stuff 134 134
that you can do with weevly. 135 135
So you can try to escalate your privileges. 136 136
Execute SQL queries and a lot of cool stuff that is just 137 137
designed for web application penetration testing. 138 138
For now I'm gonna leave it at this. 139 139
And this just shows you how to use 140 140
File Upload Vulnerabilites.