So the next vulnerability that we're going to take advantage of is command injection, so command and
injection pretty much involves exploiting a vulnerability that allows, you know, the execution of
commands into a system.
So this one is big.
So take advantage of this type of vulnerability is usually possible when user input is taken, is not
sanitized, and then is passed into a command that's actually sent to dismiss the systems command line
interface.
So let's actually go ahead and try this out with the DPW webapp.
OK, so back in our Carlina's machine, let's click on command execution.
So this loads up so.
OK, so this is ping for free.
So enter an IP address below and this is a button and it is a text box.
So let's check out see this view the source.
So the code on the back end doing a post request and then Isbel is taking it.
So let's see.
Did you do it's running a show and is running ping and then the target, which is what we passed in
as IP.
So that's pretty useful.
So it doesn't look like it's doing anything to prevent us from putting another come in after.
So what we know now is we can potentially use this.
So let's try like I already have some things.
And so one, two, seven.
Zero to zero one, let's say NASA now is executing the command and hey, did it ping so it ping localhost
went through these three pings and gives you the information like you would see, you know, in the
command.
So we know honestly, we know that this is running on Linux.
So this is the meds political machine.
And you probably would have found out that this is Linux anyway from your reconnaissance.
So knowing that and that is not sanitizing input, if you think back to Linux fundamentals that we went
over one of the earlier sections, so we know that we could change commands together in multiple ways.
So one way we can do it is with the ansible so we can try the same command.
So one two seven zero zero one and then we can put it in and maybe like we try and see what happens.
So now we see that they're still executing it.
So it went through.
And actually, you can see right here is that it actually says, hey, the current user is done with
that data.
So now we know that we can actually in commands, put commands into this paintable and actually have
them executed.
In another way that we can do it is one two seven zero zero one.
And we could do the vertical bars of pipe that's just doing my.
I don't know if I hit the slash before dinner.
There we go.
So it does the Pinkman with this one and then it excuse this command and that's all that it gives its
back.
So it's pretty neat.
We can execute any series of commands that we would like, maybe escalate our privileges, all kinds
of different stuff that we can do.
So pretty useful.
Pretty nice to.