Welcome back.
In this video, we're going to cover command injection vulnerability.
We already know what this is, and we already covered some type of command injection in the previous
video once we exploited the shell shock vulnerability.
However, now we're going to do it on the Web page itself.
So do you remember this example on the screen that we talked about?
Say we have a website and that website keeping an IP address that would tell it to Pink and it will
tell us whether that IP address is offline or online?
Well, we are going to take a look at this example inside the government display political.
So for this, you want to start your Linux machine and your purpose inside of your Linux machine.
Now we won't be using it in this specific video, but nonetheless, we must have it started because
we connected it to be the proxy to our Firefox.
If it is not open, we won't be able to visit Web pages after that.
You also want to open up your portable virtual machine and check its I.P. address, and then we want
to visit the command injection page on our anticipatable machine.
So go to your Firefox's right here, type in the IP address of your anticipatable, it will lead you
to this official page where we want to go to TBWA.
Let us log in with the credentials that they give us, which is admin for the username and password
for the password, click on login.
We don't want to save these credentials and we want to go to the command execution or otherwise known
as command injection.
But before we attack it, let us go to a security and set the security to look, because right now we
can see down here that the security level is set to high.
So let's go right here.
Check this arrow and click on look now so you can see everything better.
I'm going to zoom all of this in.
And once you said the security level to be low, you want to click on Submit.
Great.
Now, let's go back to our recommend injection.
So as we can see, it tells us that we can ping an IP address for free, so all we need to do is enter
an IP address and it will give us a result of whether it is offline or not.
Let's give it a try.
If we type, for example, the IP address, all my router, which is 192 of the 168.
That one.
And I click on Submit.
Let us see what it will tell us.
And here is the output, it seems to work and it gives correct results, my router is indeed up and
running.
But if you take a closer look at this output that we got right here.
It seems that this is the same output that we get when running a command inside of a terminal.
Right.
So if I go to my Linux machine and I open the terminal and I type the command ping, when I talk to
the 168, I find that one and I only want to ping it three times if I press enter.
Well, we pretty much get the same result right here, it will ping my router three times and it will
give us a similar output to our anticipatable page.
What does this mean?
Well, it most likely means that this Web page forwards the command to the server, which in our case
is our exploitable machine.
And that machine executes ping command to determine whether that IP is up or not.
Another thing that we get with this page is if we scroll down here, we can see view source and this
is the source code to this page so we can see whether they filter the input or not.
But let us not check source code yet.
Let's not cheat and let's just try to execute command dejection and get it to work.
So how are we going to do that?
Well, we can try to execute to commence inside of this input bar right here.
It does ask us for an IP, but we can also try to get another comment after we specify an IP address.
For example, if I type one or two, that 168, that one, that one and I type dot and comma to separate
commands.
And after it I type Dash L.A., which stands for a list all including hidden files.
And I click on Submit.
And it works, it gave us both results from the both comments back it pink director first and after
it, it executed the command and we can see what falls our target has.
This means there is command injection vulnerability because this is something that we shouldn't be able
to do.
We shouldn't be able to execute other commands outside of this command.
So let us try different commands as well.
So let us enter the same IP address, then dot and comma, and then who am I, for example?
And it does give us the output of that as well.
We're w w w dash data.
OK, but how can we exploit this and gain access to the target with the help of this command injection.
It's quite simple, actually, we can use Nethercutt for that, so if we start a listener in our clinic's
terminal, if I go right here and type and see Dash LWP and then I'm going to use the good old one,
two, three, four, five, PT..
I start my listener right here.
And I go back to this page and run the following comments, so I typed the IP address, then dot and
comma and then and see Dashi, where I tell it, that I want to execute bin Bash.
And I after it specified the IP address or my Linux machine, which in this case is let me just check
it out one or two that 168 at one time.
So I specified right here 168 dot one, dot nine.
And the port is going to be one, two, three, four, five, which is the same port from our listener.
I click on Submit and if I go back to our terminal, we got the connection right here.
So we exploited the command injection vulnerability.
We can run the commands type.
Let's go back and switch through the other directories and we can check out all the other files.
Here is the passport file so we can also check out the passwords.
We can check out other commands as well.
And everything works great.
We exploited this target.
Let us exit out of this.
And now that we successfully exploited this vulnerability, we can take a look at what the source code
was.
So let's go down here, click on View Source.
And if, by and large, all of this so we can see it a little bit better.
If we take a look at it, we will see that it didn't really filter any user input, they just requested
the IP that the user inputs and they forwarded that IP address to the ping command right here and right
here without any filtering whatsoever.
That was a big, big mistake since because of this, we were able to gain access to the target system.
Now let's give it a try on a medium security level and let's see whether we can exploit it then.
So I'm going to close this source code, go back to debate security and change from low to medium.
Click on submit.
And now the security level is medium.
Let's go back to the comment injection.
And now that it is on medium level, let's give it a try.
Let's just start with the same thing that we did previously and try to execute the command.
So if I go right here, type one, two, that 168 at one, that one, and then dot and comma and then,
for example, less Dash eight, if I click on Submit, well, nothing seems to happen.
It doesn't seem to work anymore.
However, luckily this dot and comma aren't the only ways we can run to commence.
If I go to my terminal, if you type for example s dot com, I am I will execute both of these comments.
So it will give us the output of these commands and then Mr. Hacker as well.
But you can also do it like this specified these two sides and then who am I?
And it will do exactly the same thing.
So let's give it a try like this.
Maybe they filter this character, but they didn't filter it like this.
If I go here and type one, I do that 168, that one, that one.
And then these two sides and then, for example, less than a once again click on Submit.
And this will do the same thing.
It will still not work.
OK, let's do the same thing, but just delete one of these sites that we put right here.
If I show you right here, copy the same comment pasted right here.
And I removed one sign.
It will once again execute both of these commands just as two different processes.
So it might execute one before another.
However, it will execute both of them.
Let us go right here and give it a try.
One eye to that 168 ad funded one and then one of the signs and then else a click on Submit and it works.
We get the output of both comments and the output of all of the files inside of the current directory
on the target system.
So first, two tries didn't work, probably because those characters for getting filtered and blocked,
but if we specified like this.
Then it seems to work, it seems to bypass any security and it executes our second command.
So if we go down here and we take a look at the source code.
I enlarged this so we can see the entire code.
It seems that they created some type of a blacklist right here, so they removed these characters and
this character right here.
So anyone that tries to specify command rejection with these characters, it will not work.
That's why this is a medium security level.
And you need to go through a few more commands in order to bypass this.
However, it is still bad because they filter some characters out, but others they don't filter at
all.
For example, besides this one character that we used, we can also exploit it using the pipe characters
so I can type one or two of the 168 at one point and then the pipe, which is this upper line, and
then after it they specify L.A. and this will work as well as we can see if we get the output of a comment.
Great.
Now, if we were to change the security level to high, I think I read somewhere that high is an example
of how the code should be written.
So it isn't really exploitable.
You can change it right here.
You can submit and you can go to the command execution and check out the source code right here.
It seems to only require the integers and it checks whether all of your inputs are integers and it splits
the IP address into four octets.
It does that first explicit right here, and it checks if every octet is an integer and if it is an
integer, then it combines those octet once again back and it pings that target.
OK, so we have covered command injection vulnerability and now you know how to try to find it and exploit
it in the next video, we're going to move on to the next vulnerability.
See you there.