Narrator: Just like we did before, in the last video 2 2
we put five times back and then we put ETC password to 3 3
access the password file. 4 4
What we're going to do today is we're going to try to 5 5
access a file located on a different server. 6 6
So if you're doing this pentest on an actual 7 7
webserver then you need to store the file that you want 8 8
to access, needs to be stored on a place with a real 9 9
IP address or with a domain name. 10 10
I'm doing this on my local server so I'm gonna store this 11 11
on the webserver on the Kali machine, on the 10.20.14.203. 12 12
This is 10.20.14.204 and I'm gonna store my file on 13 13
10.20.14.203. 14 14
So that file, as I said, can be anything. 15 15
It could be a web shell, it could be a payload. 16 16
Well what I'm going to do is, I'm going to create a very 17 17
simple php file. 18 18
So this is just the php start and end of the file. 19 19
And what I'm gonna put in the file, I'm gonna use 20 20
a function called passthru and in that function, 21 21
basically what this function does it executes 22 22
operating system commands. 23 23
So it executes Windows, Linux or, depending on the webserver 24 24
it's going to execute commands related to that. 25 25
So you put the command here between the two quotation marks 26 26
and I'm gonna use the same command we used with the 27 27
code execution vulnerability which was the netcat command 28 28
which allowed us to get connection, a reverse connection 29 29
from our target. 30 30
So I'm gonna paste that here. 31 31
So let's just have a first a look at this, so php 32 32
and the end, these are just the start and the end 33 33
of the file, of the php file. 34 34
Passthru is a function that I'm gonna use which executes 35 35
any command that's inserted between the quotations. 36 36
And I'm using the same command that we used in the 37 37
command execution vulnerability which will just do 38 38
a reverse connection to my computer. 39 39
So this is all good, now the next step is the most important 40 40
step and it's storing this file. 41 41
So as I said, if your target was a remote webserver 42 42
then you should be storing this file in a place with a real 43 43
IP where you can access it from the remote webserver. 44 44
Now I'm gonna be trying to access this from my 45 45
Metasploitable machine which is able to access files 46 46
stored on the Kali machine because they're both 47 47
on the same network. 48 48
And I'm gonna be calling this, I'm gonna be storing it 49 49
in my var, www html, so it's being stored on the Kali, 50 50
not on the Metasploitable. 51 51
And I'm gonna call it, 52 52
reverse and I'm gonna save it as txt not php. 53 53
And I'm doing this, if I store it as a php, 54 54
it's going to be executed on the Kali machine. 55 55
So it's gonna create a reverse connection from the Kali 56 56
machine and I don't want that, I don't wanna hack 57 57
the Kali machine, I actually already have access 58 58
to the Kali machine. 59 59
The one that I wanna hack is the Metasploitable machine 60 60
and that one is stored remotely. 61 61
So, in order to be able to include the php code 62 62
and execute it on the remote machine, we're gonna use it 63 63
as txt and get it executed on the Metasploitable machine 64 64
instead of executing it on my Kali. 65 65
So I'm storing it as a txt and I'm gonna say, save it 66 66
and now let's just see here. 67 67
So if I go to my local host 68 68
and if I say 69 69
reverse .txt we'll see our file right here. 70 70
So again, this is on my local host which is 71 71
not the Metasploitable machine. 72 72
It's 10.20.14.203 73 73
and the Metasploitable is on 204. 74 74
So, how are we gonna run this? 75 75
First let me just listen for connections like we did 76 76
before, so it's just going to be netcat 77 77
bvlp 8080. 78 78
And then, 79 79
right here instead of including a file on the same server, 80 80
I'm gonna include the remote file and the command 81 81
is going to be http, so it's just going to be the link 82 82
to this file. 83 83
So we can access the file here as txt, 84 84
I'm gonna copy it and paste it here. 85 85
And also in some case, you might need to add a ? 86 86
to the end to get this file to be executed as php. 87 87
So I'm just gonna go over this again for one more time. 88 88
Including a remote file which is on a remote server, 89 89
make sure the remote server is accessible by your target. 90 90
And also make sure you store it as txt because if you 91 91
keep it as php, this file the reverse file, will be executed 92 92
on the remote server. 93 93
So it will be executed on the 203 instead of being executed 94 94
on the 204. 95 95
And I'm keeping it as txt, this way it will be, 96 96
it's gonna be executed on the 204 and it's gonna give me 97 97
a remote connection this computer, 98 98
to the Metasploitable computer. 99 99
So if I come back here, as you can see we have 100 100
a remote connection. 101 101
If we do a uname -a 102 102
you'll see that this is the Metasploitable machine, 103 103
not the Kali machine. 104 104
So we basically have full access to the Metasploitable 105 105
machine through a remote file inclusion vulnerability. 106 106
Now if we do an ls, we can do a pwd to see where we are 107 107
and we can literally run any Linux command we want now 108 108
on the machine and do anything we want. 109 109
Basically we have full access to that machine.