OK, so the next vulnerability that we're going to go over is local and remote following inclusion.
So sometimes in the euro, for certain pages, you might see something like page equals or fire equals
appended to the end of it.
So if this exists, you might be able to conduct a directory traversal or file inclusion at site.
So if the application is actually vulnerable to this, then you should be able to change any file on
the host, like change the file to any file on the whole system and actually have that show, as I'll
put it, in a browser.
So this opens the door for you to learn everything that you need to know about the system and might
even let you execute some commands remotely.
So let's go ahead and check this on how we can do file inclusion.
OK, so the back of the Linux machine, we can go over to file inclusion in the deep Web app.
But before we do this, there's a change that we have to make on the most floatable machine that's going
to allow us to actually do these like specific ones of these file inclusions so we can just go to our
meta split-Level machines.
So I have a right here.
It's very ugly black and white interface, so we can just do a clear command really quick.
So we're going to be pseudo nano sized P five.
So I've seen guys like I and I and then I see sideburn password and massive admin and is going to I
might have the wrong I myself am in.
There we go.
Cool.
So we're going to type in so hit control w and then you're going to type in allow underscore you are
L and just hit enter and now it's going to take us to where we need to be.
So we want to make sure that allow you are open openness on and allow you to include is on.
And when you change that it might be off-stage change.
It's on the you can do a control o to actually save the file, enter and then control to exit and now
we're good to go.
So one last thing that we're going to need to do is just a pseudo slash UTC such and it decides to restart.
So this is just going to restart the Apache server and allow these changes to be made.
So these changes are going to allow us to actually, you know, take advantage of these files, inclusion
vulnerabilities, just some settings that had to be changed really quickly, manually.
So let's go back over to the machine and actually try this local and remote file inclusion.
OK, so first, guys, make sure that you go and set the security back to low for right now and then
go back over to follow the inclusion.
And so it's saying to include a file edit the page equals indexed Piñero, it says include.
But we could just like change like one letter on it and just say inertness.
It was going on.
So it was given as errors.
So that's pretty, pretty interesting.
And so we now we know that the directory structure of the machine, we kind of know what's going on,
what piece P file is actually being reached out to.
So let's go back and let's check out the source code.
So it seems like if you were to look at this, it literally just grabs whatever page is actually put
into it and does not sanitize anything.
So one thing that we might be able to do is a directory traversal outside, so.
What we can do is like before we change that, and it caused an error that we found out, like the directory
structure, so let's try this again and kind of see like where stuff is going on.
And so it seems like right now we're over in this vulnerabilities directory.
So what we're going to want to do, actually, is this F.L. FBI director.
You kind of can't see it.
So what we're going to want to do is actually try to back out.
So if you remember back to our Linux fundamentals, if you do that, for its example, it allows you
to, you know, back out a directory.
So what we can do is actually like back out in the euro and actually go to whatever part of the system
that we want to actually read the file and include it as output.
So let's actually try that really quickly.
So let's say page equals.
So let's say we need to go back like five directories of data, slash, slash, slash, slash, slash
and let's put ATC slash shadow or Apostolides.
Sorry that we did my antivirus, blocked it.
Great.
So I need to get off of that bridge connection.
There we go.
So let's try this one more time.
OK, so.
Now, so, yeah, make sure that you're not on the corner if you have antivirus, make sure you're on
the the host on the adapter I was on the one that merges it with my post.
So as you can see, it included the shadow or the past, the password file.
So now we know the usernames and maybe some hash and stuff like that, some good information that we
can get.
Like if you want to, like, print out, like the shadow follows something we can do, like the hashes.
So it's pretty neat.
So it printed all that out.
So now we know that we can use this directory traversal and actually, you know, if you like, you
know, any file pretty much on this system that this user is going to have access to.
OK, so we did the local file inclusions and now let's try remote file inclusion.
So it actually gives us the capability of it's vulnerable to actually allow us to load any remote file,
you know, into the system.
So what we're going to do is actually load something from our machine in the URL and it's going to display,
you know, on the page first.
To do that, we have to be hosting, you know, a Web server.
So we're going to go back over to our colleague, Linux hosts.
And one of the first things that we're going to do, so I have a folder.
So if I were to I have a file in the e-mail folder.
So cat so let's do that.
So hack that.
I put that into the directory for the Apache server.
So if I were to just do a pseudo service Apache to start.
And they put a password in my might have typed the wrong.
OK, now we're going.
OK, so Apache's now started.
So if I were to go in my browser to see localhost, see maximized, go to localhost, slash, hacked
dot 60.
So I press this out.
You got hacked.
So we're going to make this web application load that file.
And the way that we're going to do that is simply just putting the directory to us.
HTP as calling for us as far as large one nine two one six eight five six one zero seven slash hacked
text and see, as you can see, I'll put it onto the page.
So now we know that we can remotely include files, you know, into requests from from this Web application.
So that opens the door for a lot of different things and a lot of malicious activity to actually be
able to, you know, take place.
So now let's actually bump up the difficulty a little bit and it's some medium.
So let's try the media submit.
Let's go back to file inclusion.
OK, so we're at the final inclusion page, so let's look at the source code and see what's going on
and make it different this time.
So it's not just one line now.
So it's the page that we give it and it says is replacing a CEDP calling for those forces with like
a blank string.
So if we understand kind of like what the string replace function for P does, it verbatim changes if
it finds AEP calling for us as far as I will replace it with this or face it keeps calling for us.
As far as I say, it will replace it with a blank string.
So that will ultimately make us today cannot load our profile.
So one thing that we can do, though, is we know that verbatim actually does that exactly as we can
just change the case of the EDP so we can maybe H capital or the T capital and see what happens.
So let's actually try it first.
So let's do a SCDP.
Let's try it first without it.
So this is normal.
So one nine two one six eight six dollars or seven slash tax that 60 copy this on the table again.
So now it's actually not working.
So what we can do is actually, like I said, verbatim copies.
It verbatim looks for ACP calling for us as far as slash and removes that and puts a blank string there.
So it's actually just put capital T and let's see what happens.
And now it says you got hacked.
So now you know, if you were to see that string replace function or if you were to see that, you know,
it was actually getting replaced with like a blank string, maybe you can try this maybe is not actually
looking for every, you know, iteration of, you know, how you can actually put it.
And this is a very common way that people are able to bypass, you know, these security controls for,
you know, file inclusion, especially in remote file closure, because that's dangerous.