Hello, everyone, and welcome to this video.
So in this video, we are going to see how can we increase our impact from LFA when the ability to actually
eat.
So we have seen the law in how to identify LFA videos that how you can successfully find out any one
parameter under the Web application and try to read the file from the server wherein you can also execute
the file.
But now we are going to increase the impact and the severity for this venerability so that if you are
hunting this on any bug bounty program, you can increase the reward for this Ravelli.
All right, so I have divided this process into a few parts so that you better understand how you can
increase the impact of LFA vulnerability to remote code execution.
So part one is obviously identifying the main floor into the application, which is LFA.
So here is a live website, which is vehicle duty dot com, wherein there lies availability of elephant.
As you can see, I was able to load and read the EDC past a bloody file from the server.
OK, so let's move ahead, partook identification of slash progs, self slash and we're on this basically
is the process file into any Linux system wherein I was able to read the custom user agent.
If you look closely, the user agent equals two is the current request that has been sent to the server.
If you look, the user agent is Mozilla and my computer's user agent, which is Macintosh, Intel,
Mac.
So I came to know that my custom user agent get saved into the Bruxelles environment variable.
What if instead of this, if I tried to send a custom user agent because it is under my control.
So part three, writing a custom user agent and saving it into the product itself environment.
Now, if you look closely over here, I have written a BHP shell code here.
I have base64 encoded the Shell code just because the server does not detect if a shell is coming.
And you can see I am writing a file and the filename is Arcy by Elfy that BHP.
So this simple reverse shell is getting uploaded.
So the simple BHB shell is getting uploaded to the server.
And when I had to go for this request, I'm able to see a 200 OK response, which basically means that
my this custom user agent has successfully saved onto the target server.
Now it's time to verify this.
So part five, as you can see over here, the file that I tried to write on the server was Elfriede
and Text.
And you can see this was RC using Elfy job done, which means I was able to successfully write a file
onto the server.
Also, I can execute as many as commands I want.
So I hope you guys understood this.
Let's jump into the practical to see more in depth about how can we increase our impact for this vulnerability
to turn from Elfy to RC.
So as you can see over here, this is a life application we call duty dot com.
I have identified that there exists to elevate vulnerability, which we have already discussed in one
of the one parameter over here.
All right.
So let's identify the vulnerable parameter and the vulnerable parameter over here is B.G. equals two.
Now, I'm going to put the payload into this one parameter or the injection point and try to see if
I am able to exploit Elfy vulnerability.
I will just reload the application and try to identify if I'm able to see the EVC past.
Absolutely.
Fine.
Let's wait for this to completely load.
And you're I cannot see anything.
So let's do again a hit and trial and move into one more part.
Remember, this is totally Hattan trial.
You have to navigate inside and out of directories.
So yes, it worked.
And now I'm able to see the past W.T. file, which contains the users that exist into the server, which
is running Vical dude dot com.
All right.
So I have the possibility file.
Now, let's try to read another file.
So let's say we try to read the prompt self environment file and let's see what interesting thing we
can identify from there.
So I have to write slash, prop slash and we don't know when I try to load this.
It will not allow me to load anything because you need to write self as well.
Now, let's see if we are able to get any sensitive information from the server.
All right, here we go.
Here you can see we are able to see the processes that are being drawn, running and into the last request
because that has been sent to the server HDB user agent has been saved over here.
And what is the user agent?
This is basically the last requested user agent to the server.
And you can see it's Mozilla 5.0, Macintosh and Mac OS x ten point fifteen, which is basically my
computer systems user agent.
Perfect.
So this means that any request that I send to the server saves my user agent and I can control my user
agent, that basically means I can also try to save a custom user, user agent or custom modified code
into the user agent.
All right.
So let's do this let's send this request to you and send this to Rubedo, because from here, we are
going to use this request again and again.
Now, let's try to read this file and we are able to successfully get a two hundred, OK, which means
we are able to read this file.
Now, as I discussed, we are going to modify the user agent as a user agent over here is this and this
is exactly the same user agent that you can see onto the left hand side over here.
Now, this is getting reflected into the response, which means this is getting saved onto the target
server.
Now, let's control this and modify this to a BHP shell.
So I have written a BHP shell and I have base64 encoded the shell just to bypass any filters.
If they try to block my payload, I'll just copy this and I'm going to pasted over there into the custom
user agent field before pasting it over there.
Let's do a breakdown of what exactly the Shalders as it is a BHP shell.
It has to start with BHP and you can see I assign a variable equals to I'm going to post something.
It is going to open a file which is denoted by F open.
And you can see post file file basically is the name of the file that I want the data to be written
into, and the data will get written into the file and it will get closed.
If you look over here, file equals to f open the filing that I want to be created onto the server.
So I have given the name as RC by elevator BHP.
So it is going to write into that file and close that file.
The data, which you can see is basically for encoded is going to get written into the file successfully.
All right.
So let's copied and pasted over here.
So this is the new user agent that I'm going to send to the server, which basically is a BHP shell.
Now, let's try to send this request and verify that are we able to save our custom user agent onto
the server into the proper self environment file?
So I've written this and I'm going to send this now.
So let's hit send and let's read together.
Two hundred.
OK, so we've got a 400 page request.
Just because we messed up writing the custom user agent here, I need to write it this way.
And again, let me send it.
Yeah, again, it is a bad request because the data that we have pasted over here is not properly formatted.
So let me just format it properly and remove any extra thing that has been copied by mistake.
And now let's try to send this perfect.
We haven't got a successful two hundred OK response, which means our file by the name are Sehbai el-Fadl.
BHP should have been made onto the target server.
Let's verify this.
So for this we are going onto the server, which is very clear duty dot com and trying to open our file.
So let's see if we are successfully able to open our file.
So the filing that we made was asked by Elfy Dot BHP and you can see over here the file is successfully
created.
Perfect.
So let's create a new file under the target's network and let's say we call the Filer's LFA, then the
text and Righton shall go into this just for security reasons.
We do not want to break anything into the server.
I'm just writing a simple message.
It says this was ACEEE using Elfy in Joplin and you can see it has been successfully completed.
So after the request is fulfilled successfully, let's try to see if our shell has worked or the file
has been created.
So the file that we created was elevated in the text and try to open that file over here.
And you can see a success message which says this was CEO using Elfy job.
Then I hope you guys understand this, how we increase the impact of Elfy to Arcy and how we are able
to completely take over the server.
This was just a demonstration when we did not a.
Secure any harmful good onto the server, but any attacker with malicious intentions can do a lot of
harm to the server, including additions or deletion of files from the server, which can make it completely
unusable.
So I hope you guys understood this.
This can be considered as a be1 critical vulnerability on many of the bug bounty programs.
Thank you.