Now, with a previous video, we started to look for known vulnerabilities and box.
And the next few videos, we're going to cover these problems and so much more, so here's another one.
Now, within your reconnaissance phase, let's say that we discover the rescue like directory.
And when you follow.
This page will open it is, and ask you like manager interface.
And you can easily get the version information from the upper part of the page here.
OK, so that's how it got.
Now, after detecting a version, we'll look for public exploits.
So go to exploit that divide, come check verified exploit and type in the search box as you light.
OK, so the exploits here are listed.
Now we need to find exploits that match our escalate version on our target.
So I think this local fire conclusion correlates to our version.
And this is the content.
And the current theme, cookie is vulnerable to Elfy.
And they viewed the magic file.
That's just a pelo.
There are no extra files or anything else.
So let's go to the manager page.
Then enable Foxe proxy.
From the main menu, choose something.
And it will automatically request so open burb.
And the request is like that, but there's no cookie information that we look for.
So we'll forward it.
And the response comes.
And look what we have here.
The server set askew, right, manager, current theme cookie.
So that's great.
Forward it.
And now the page will request other components.
And that's where we the browser, will send the current theme cookie.
OK, so let's delete this value and add this one.
But now I want to point out an important thing here, the null character at the end of the payload,
if you don't put it in, it's going to fail.
So when we look at the code, you'll know why.
OK, so forward it.
OK, it was very nice, we get the content of our magic file.
Now, we've already seen this file, so.
It's really no big deal.
You don't have to see it again.
So we validate and then exploit the vulnerability.
Now, go to terminal, go to rescue directory.
And there are files and folders here.
Now, to analyze it so quickly, you can run a grip command, so tight grip as you might manage your
current theme are and I and run.
So this text is used five times in two different files.
Now view the first file.
And have a look at this part of the code.
If theme variable in post request is set, the application sets the current theme cookie if the current
theme cookie is already set.
The application sets its value to the local theme cookie.
OK, go back.
And now I'm going to look for local theme.
And of course, it takes a little more to analyze manually, but, you know, I'm used to it and you'll
get used to it.
But I think look here, the last line is interesting.
It has and include function as well.
So go to this file.
And this line, it is here.
So the application includes the value and the local theme once and the known characters we put after
the payload, eliminate the rest.
OK, so now you know how to get a full shell over an Alphie vulnerability.
We practiced in the 11th section, I know you remember it well, that's why I'm leaving the rest for
you.