Just like we did before and the last video we put five times back and then put ATC password to access
the password file.
What we're going to do today is we're going to try to access a file located on a different server.
So if you're doing this test on an actual web server then you need to store the file that you want to
access needs to be stored on a place with a real IP address or with a domain name.
I'm doing this on my local server so I'm going to start this on the on the web server on the Callimachi
understand 20:14 two or three.
This is 10:20 14:24 and I'm going to store my file on it and 20:14 two or three so that file as I said
can be anything it could be a web shell it could be a payload.
Well what I'm going to do is I'm going to create a very simple APHC file.
So this is just a PH for you start and end of the file.
And what I'm going to put in the file I'm going to use a function called pass through.
And in that function.
Basically what this function does it executes.
Operating system commands.
So it executes Windows Linux or depending on the web server it's going to execute commands related to
that.
So you put the command here between the two quotation marks and I'm going to use the same command we
use with the code execution vulnerability which was the netcat command which allowed us to get a connection
reverse connection from our target.
So going to paste that here.
So let's just first have a look on this.
So BHP in and these are just the start and the end of the file of the BHP file passed through is a function
that I'm going to use which executes any command that's inserted between the quotations and I'm using
the same command that we used in the command execution vulnerability which will just do a reverse connection
to my computer.
So this is all good now the next step is the most important step and it's stored in this file.
So as I said if your target was a remote web server then you should be starting this file in a place
with a real IP where you can access it from the remote web server.
Now I'm going to be trying to access this from my mentor deployable machine which is able to access
files stored on the candy machine because they're both on the same network.
And I'm going to be calling this I'm going to be storing it in my Vire.
W w w Hastey I'm so sorry.
It's been started on the Kalli not all demitasse floatable and I'm glad to call it reversed and I'm
going to save it as cxxviii enough BHB and I'm doing this.
If I started as a Ph.D. it's going to be executed on the Callimachi.
So it's going to create a reverse connection from the Callimachi.
And I don't want that I don't want to have the Callimachi.
I actually already have access to the Callimachi machine the one that I want to hike is the Methos floatable
machine and that one is stored remotely.
So in order to be able to include the APHC code and executed on the remote machine we're going to use
it as the XTi and get it executed on the Mutazz floatable machine.
And instead of executing on my Kalee so I'm Stirling's as ATX D and I'm gonna say save that and now
let's just see here.
So if I go to my local host and if you say reverse that you will see our file right here.
So again this is on my local host which is not the media's political machine it's 10 20 40 2 0 3 and
the floatable is on to 0 4.
So how are we going to run this.
First let me just listen for connections like we did before.
So it's just going to be netcat the LP 80.
And then right here instead of including a file on the same server.
I'm going to include the remote file and the command is going to be Heyse TTP.
So it's just going to be the link to this file so it can access the file here as text.
I'm going to copy and paste it here.
And also in some cases you might need to add a question mark to the end to get this file to be executed
as APHC.
So I'm just going to go over this again for one more time on including our remote file which is on a
remote server.
Make sure the remote server is accessible by your target and also make sure you started as DXi because
if you keep it as P-H with this file the reverse file will be executed on the remote server so it will
be executed on the two or three instead of being executed on the two or four.
And I'm keeping it 60 this way it will be.
It's going to be executed on the two or four and it's going to give me a remote connection to this computer.
Meet portable computer.
So if I come by here as you can see we have a remote connection.
If we do a you name age you'll see that this is dimittis political machine not the Callimachi.
So we basically have full access to the exploited will machine through and remote file inclusion vulnerability.
Now if you do an alliance we can do a PWT to see where we are and we can literally run any Linux commands
we want now on the machine and do anything we want.
Basically we have full access to that machine.