1
00:00:00,710 --> 00:00:05,420
Now, with a previous video, we started to look for known vulnerabilities and box.

2
00:00:07,510 --> 00:00:13,930
And the next few videos, we're going to cover these problems and so much more, so here's another one.

3
00:00:15,480 --> 00:00:20,430
Now, within your reconnaissance phase, let's say that we discover the rescue like directory.

4
00:00:21,870 --> 00:00:23,640
And when you follow.

5
00:00:26,430 --> 00:00:31,470
This page will open it is, and ask you like manager interface.

6
00:00:32,630 --> 00:00:36,800
And you can easily get the version information from the upper part of the page here.

7
00:00:37,480 --> 00:00:38,840
OK, so that's how it got.

8
00:00:40,060 --> 00:00:44,440
Now, after detecting a version, we'll look for public exploits.

9
00:00:45,480 --> 00:00:54,330
So go to exploit that divide, come check verified exploit and type in the search box as you light.

10
00:00:56,650 --> 00:00:58,690
OK, so the exploits here are listed.

11
00:00:59,890 --> 00:01:05,050
Now we need to find exploits that match our escalate version on our target.

12
00:01:06,740 --> 00:01:11,360
So I think this local fire conclusion correlates to our version.

13
00:01:13,140 --> 00:01:14,790
And this is the content.

14
00:01:16,540 --> 00:01:20,470
And the current theme, cookie is vulnerable to Elfy.

15
00:01:21,980 --> 00:01:24,740
And they viewed the magic file.

16
00:01:25,620 --> 00:01:26,520
That's just a pelo.

17
00:01:27,550 --> 00:01:29,980
There are no extra files or anything else.

18
00:01:31,050 --> 00:01:33,090
So let's go to the manager page.

19
00:01:34,130 --> 00:01:36,080
Then enable Foxe proxy.

20
00:01:39,320 --> 00:01:40,940
From the main menu, choose something.

21
00:01:43,190 --> 00:01:47,540
And it will automatically request so open burb.

22
00:01:48,810 --> 00:01:54,360
And the request is like that, but there's no cookie information that we look for.

23
00:01:55,290 --> 00:01:56,430
So we'll forward it.

24
00:01:57,540 --> 00:01:59,010
And the response comes.

25
00:02:00,420 --> 00:02:02,950
And look what we have here.

26
00:02:03,960 --> 00:02:08,370
The server set askew, right, manager, current theme cookie.

27
00:02:09,060 --> 00:02:10,770
So that's great.

28
00:02:10,950 --> 00:02:11,580
Forward it.

29
00:02:12,520 --> 00:02:15,430
And now the page will request other components.

30
00:02:16,610 --> 00:02:19,940
And that's where we the browser, will send the current theme cookie.

31
00:02:21,520 --> 00:02:25,120
OK, so let's delete this value and add this one.

32
00:02:26,540 --> 00:02:31,490
But now I want to point out an important thing here, the null character at the end of the payload,

33
00:02:32,030 --> 00:02:34,120
if you don't put it in, it's going to fail.

34
00:02:35,400 --> 00:02:37,800
So when we look at the code, you'll know why.

35
00:02:38,850 --> 00:02:39,870
OK, so forward it.

36
00:02:41,090 --> 00:02:44,540
OK, it was very nice, we get the content of our magic file.

37
00:02:46,120 --> 00:02:48,220
Now, we've already seen this file, so.

38
00:02:49,280 --> 00:02:50,630
It's really no big deal.

39
00:02:50,650 --> 00:02:51,900
You don't have to see it again.

40
00:02:53,920 --> 00:02:57,370
So we validate and then exploit the vulnerability.

41
00:02:58,640 --> 00:03:02,750
Now, go to terminal, go to rescue directory.

42
00:03:03,880 --> 00:03:06,370
And there are files and folders here.

43
00:03:07,730 --> 00:03:14,020
Now, to analyze it so quickly, you can run a grip command, so tight grip as you might manage your

44
00:03:14,030 --> 00:03:18,290
current theme are and I and run.

45
00:03:22,140 --> 00:03:25,650
So this text is used five times in two different files.

46
00:03:27,170 --> 00:03:28,970
Now view the first file.

47
00:03:33,220 --> 00:03:35,470
And have a look at this part of the code.

48
00:03:36,480 --> 00:03:46,710
If theme variable in post request is set, the application sets the current theme cookie if the current

49
00:03:46,710 --> 00:03:48,550
theme cookie is already set.

50
00:03:48,570 --> 00:03:52,320
The application sets its value to the local theme cookie.

51
00:03:52,930 --> 00:03:54,420
OK, go back.

52
00:03:55,720 --> 00:03:58,150
And now I'm going to look for local theme.

53
00:04:00,990 --> 00:04:06,990
And of course, it takes a little more to analyze manually, but, you know, I'm used to it and you'll

54
00:04:06,990 --> 00:04:07,710
get used to it.

55
00:04:09,540 --> 00:04:12,090
But I think look here, the last line is interesting.

56
00:04:12,970 --> 00:04:15,900
It has and include function as well.

57
00:04:17,190 --> 00:04:18,780
So go to this file.

58
00:04:22,280 --> 00:04:25,190
And this line, it is here.

59
00:04:26,290 --> 00:04:32,560
So the application includes the value and the local theme once and the known characters we put after

60
00:04:32,560 --> 00:04:34,690
the payload, eliminate the rest.

61
00:04:36,170 --> 00:04:42,710
OK, so now you know how to get a full shell over an Alphie vulnerability.

62
00:04:44,480 --> 00:04:50,780
We practiced in the 11th section, I know you remember it well, that's why I'm leaving the rest for

63
00:04:50,780 --> 00:04:51,110
you.