And this lecture I'd like to show you how we can use Eskil injections to read any file in the server.
So even if the file exists outside the WWE route we'll be able to read it exactly like a file disclosure
vulnerability.
And we'll also see how we can use it to write files and upload them to the system just like a file upload
vulnerability.
So the first thing we're going to have a look at is the read in the file and I'm going to set everything
to null here.
So I have my statement here and I'm gonna set select one.
I'm gonna need leave number two cause I'm gonna do stuff on that and we're gonna do another three no's
here.
So no no no.
So we have select now something.
No no no.
So 5 because we have five records when we did the order by and instead of selecting something.
Remember in the third video we did select database for example and it showed us the current database.
What I want to do now is I want to do another function and that function is called Load File
and in here I'm gonna set the file that I want to load and I'm going to use the same file that we had
the lock on and the file inclusion vulnerability and it was HTC password so we're trying to read that
file and our statement is unique and select that file and that's it.
So I'm going to copy this and I'm going to inject it here and I'm going to add my percentage 23 which
is my comment.
And as you can see we managed to read all the information all the content of ATC password even though
it's not in the web root so it's stored in ATC password so we can read anything in the server from other
Web sites from other files anywhere in the server we can read it by specifying the full part of the
file.
The next thing I'd like to show you is writing to the server.
So we're actually going to write stuff to the server and this is very useful because you'd be able to
write any code you want.
So for example you can write the code for a PSP script you can write and write a code for a shell a
virus or appear to be code to get a reverse connection to you.
So it'll basically just act like a file upload vulnerability and to do that I'm going to write the code
that I want to do here and I'm going to call that for example.
Just example example and we're going to use a function called out file.
So we're going to do into out file and then we're going to specify where we want to store that file.
Now in best case scenarios you'd be able to write to your Web root.
And that will mean that you can access the file through the browser and execute it so you can upload
a weekly file and then connect to it and do stuff like that.
So let's try to do that first.
So we're gonna do it in var w w w and that's our web route so we'll be able to access things through
it.
Or you can for it even var w w w and then put Michelle day after it.
To start in their so the commands are very simple again union select.
Make sure you set everything to null so that nothing gets right into the file except what you put in
here.
And I for example example and it's going to be stored into our file and var w w w Mattel day and we'll
call that example the steep let's try to run this and see if it works.
Now this didn't work.
And if you come down here you'll see that Askew L or my Eskil is not allowed to create or write to this
directory.
So the problem is we're not the permissions that we have don't allow us to write to this particular
location.
So just to test this exploit I'm going to change this location to GMP which is the temp and you'll see
that you can actually write to temp so in real life scenarios.
It depends you can try it and see if you're able to write stuff or not.
And this we're trying to write a temp now and if we read in temp if we cleared that and then Ellis and
temp you'll see that we have something called example.
And if we try to read that you'll see that it contains obviously it contains the content of what we
did before which was the normal selection that you'd see.
So what you see for putting this stuff for admin and then it showed us what's in there which is example
example which is what we wanted to write to the file.
Now you can obviously get rid of the admin and the admin pass stuff by just pulling the wrong user name
and nothing is gonna be displayed here.
So the only thing that you'll see is the output which is example example.
Well again this is only useful if you're able to write to your web server so you can access it and then
use your shell or use your payload and further exploit the system.