Narrator: Code Execution Vulnerabilities. 2 2
These type of vulnerabilities allow us to execute 3 3
operating system code on the target server. 4 4
So, if the target server uses Windows, 5 5
we'll be able to execute Windows command, 6 6
if it uses Linux, then we'll be able to use Linux commands. 7 7
Clearly, this is a really critical problem, 8 8
that would allow us to do anything we want 9 9
with the target, really. 10 10
We can upload a PHP shell, 11 11
using wget command or upload a payload, 12 12
a virus, anything we want, 13 13
using the wget Linux command. 14 14
You just need to make sure that you're uploading it 15 15
to a file or to a directory, 16 16
which you're allowed to write stuff to. 17 17
Another way of exploiting this vulnerability, 18 18
is, to just run OS commands and get a reverse shield 19 19
based on these commands. 20 20
So, because we can run operating system commands, 21 21
we can use the programming languages supported 22 22
by that operating system to try and get 23 23
a reverse connection on our computer. 24 24
So, first of all, let's just assume 25 25
that we're browsing here, 26 26
and we manage to we're going around 27 27
and then we got to a tab in the website 28 28
where it allows you to, 29 29
for example do a ping. 30 30
Now what you should do is, you should always 31 31
try to experiment with any input works you see. 32 32
Try to see what that input works does 33 33
and what can you inject into it, 34 34
what can you do to get stuff running. 35 35
So, for example, this input works 36 36
is telling you its going to do a ping. 37 37
And, if you put an IP, 38 38
for example I'm going to put 10 20 14 203, 39 39
which is my own IP. 40 40
Just to see it, to use it as a normal person, 41 41
I'm going to do a submit and it's going to go ahead 42 42
and ping it for me and give me the ping results. 43 43
So, what looks like here, 44 44
it's actually executing the ping command, 45 45
in Linux systems. 46 46
Now, let's see if we can exploit that. 47 47
If it's actually executing the ping command. 48 48
So, what it's doing is, it's going, 49 49
and it's doing. 50 50
So, we're sending 10 20 14 203 as the ping. 51 51
And then it's going to the web server 52 52
and the web server is doing ping, 10 20 14 203. 53 53
So, let's see if we can exploit this. 54 54
How would we exploit it? 55 55
It's taken what we're inputting, right here. 56 56
And then, it's doing ping, that. 57 57
Now, in Linux and Unix based commands 58 58
you can use, the, this sign to execute multiple commands, 59 59
on one line. 60 60
So, if you do this, for example in your own terminal, 61 61
so, I'm just going to go through my terminal, here. 62 62
And I'm just going to do LS, which is the list command 63 63
and then PWD is what lists, 64 64
what shows your working directory. 65 65
So, if I do an LS, followed by this sign 66 66
and then do PWD, it will execute both commands. 67 67
So, it will do this and then it will show 68 68
where the working directory is. 69 69
So, we can do the same thing with this 70 70
and see if it works for us. 71 71
So, we're going to put in IP, a right IP, 72 72
and then I'm just going to do PWD 73 73
and see if it will execute the PWD for me. 74 74
If it does, 75 75
then this is a code execution vulnerability 76 76
and I can execute anything I want on the server. 77 77
So, let's see what's going to happen. 78 78
I pasted this, and I'm going to hit submit. 79 79
And as you can see, we got the ping results, 80 80
but at the end, 81 81
we got our current working directory. 82 82
So, its via wwwdvwa vulnerability is an exec. 83 83
So, it executed the PWD that I inserted. 84 84
And that means I can insert any commands I want, 85 85
in there and they'll be executed. 86 86
So, I've inserted a resources file 87 87
that you can use to get reverse connection 88 88
from the target computer. 89 89
Now, there's a number of ways, 90 90
a number of commands that would give you 91 91
a reverse connection. 92 92
All of these commands depend on the programming language. 93 93
So, for example, we have commands in PHP, 94 94
we have commands in Ruby, you have Pearl commands 95 95
and we have the one for Bash. 96 96
Bash is the Linux shell command and language. 97 97
So, all Unix operating systems will be able to execute 98 98
Bash commands. 99 99
So, that's a very good way of doing it. 100 100
So, most Unix system, 101 101
this command should work on most Unix based systems. 102 102
So, this would be a really good way of doing it. 103 103
Again, most of them would have Python, 104 104
so, Python would be a good way. 105 105
Netcat, most of them do have Netcat as well. 106 106
So, Netcat is a good way of doing that. 107 107
And, we're actually going to use Netcat in this video. 108 108
So, what I'm going to do is, 109 109
first I'm going to listen for connections, 110 110
just like we used to do with Metasploit, 111 111
when we used to do multihandler. 112 112
You can actually use a multihandler for this, 113 113
and listen for a connection. 114 114
Well, I'm just going to keep it simpler 115 115
and show you a new way. 116 116
And, I'm going to use Netcat. 117 117
So, Netcat. 118 118
Netcat is just a tool that allows you 119 119
to listen and connect computers together. 120 120
So, I'm going to listen on port 80 80. 121 121
So, Netcat is the program. 122 122
vv is just to see verbose output, 123 123
so we can see a lot of output, 124 124
anything goes wrong, we can see it. 125 125
And, we're telling it to listen, 126 126
using the L option on port 8080. 127 127
So, I'm going to hit enter, 128 128
and that's saying just listening on port 8080, 129 129
that's all it's going to do. 130 130
The next command we're going to do, is, 131 131
we're going to try to connect from the web server 132 132
back to my computer, using Netcat, as well. 133 133
So, we're assuming the web server has Netcat. 134 134
We're going to try it and see if that works. 135 135
So, the command is very simple. 136 136
It's Netcat and we're telling it to use bin bash. 137 137
And we're giving it the IP of my device. 138 138
My attacker device, which is 10 20 14. 139 139
And, then the port which is 8080. 140 140
Which is where we're listening on, right here. 141 141
So, I'm going to copy that. 142 142
And I'm just going to execute it the same way 143 143
we used to execute the PWD 144 144
command. 145 145
So, the last thing we did, was, 10 20 14 203. 146 146
And then we did PWD. 147 147
So, what I'm going to do now, 148 148
I'm going to remove the PWD 149 149
and paste the code that we just created, 150 150
which we'll try to connect from the web server 151 151
back to the cally machine to the attacker machine. 152 152
And, I'm going to come here. 153 153
And, as you can see, we got a connection back 154 154
from, to us, from 10 20 14 204. 155 155
So, that's the tarried computer. 156 156
And, if we do a PWD, you'll see that we have 157 157
a reverse shell if we do an LS. 158 158
If we do an ID, you'll see that we're wwwdata 159 159
and you're free to (mumbles) you name A, just to confirm. 160 160
That I'm in the Metasploitable and you can see 161 161
that I'm in the Metasploitable. 162 162
And, I'm able to run any command that I want 163 163
on the target computer. 164 164
So, basically I have full access to the target computer.