Hi, within this lecture, we're going to try and hack into the server, we are using WordPress vulnerabilities
or some kind of tricks over here.
So what I'm going to do, I'm going to go into the library and see if we can upload something over here.
The basic trick is that if you can upload a reverse over there, then you can get a shell back.
This is what happens mainly in the WordPress sites.
I'm going to try that, but I don't know if it's going to work or not.
So I'm going to search for a reverse shell exploit or cheat sheet like we have done in the python before
in the previous section.
Now, of course, I'm going to go into the Panthers monkey one more time and say, yep, let's go over
here and I'm just going to find the one liner.
So this is good.
And if you as you can see, it says as if you want to be able to upload KDDI more feature full and robust.
Rochelle, this is just this is just a one liner that you run in the comment, OK, in the terminal.
But we don't need that.
We actually need a file to upload so that we can test if we can actually upload a PDF file to server.
So come over here and just find the raw shell.
And over there, I believe we should have some kind of download button over there.
I says that changed.
Don't forget to change the IBM part and listen with Nat Cat in another terminal and just make sure you
run the code.
I don't know.
We can do that yet.
We are going to try and see.
So I'm going to download the reverse shell.
So let's come over here and let's see.
Let's go to Donalds and here we go.
Let's see where this and and search for BB so I cannot seem to find it.
Yeah.
Here you go.
And this is for some reason it's TR and G zip.
Let me just take it into the CTF folder, OK?
I'm there Mr. Robot.
I'm going to paste is over here.
So this is TR and G Zip.
Let me try to just unzip it from here.
Like we can use G Zip to just unzip this or let me just around the Lesli.
Yeah.
Here you go.
This should have been Guiseppe but let me try this.
So I'm going to write preoperational one point zero.
Targett.
Yeah.
It says that it's already as.
Yep.
We have to specify we're going to decompiled this.
It says that unexpected end of file.
So let me double click on this one.
Yep.
It doesn't really work.
It's it it is like an empty file.
I believe there was something wrong with downloading it.
So let me try this one more time.
I'm going to try it too.
But we don't have to for some reason.
Let me just run give help and see.
Yep.
We are doing this right.
We are decompressing this.
I believe there is something wrong with the file itself.
So let me try and figure out how to proceed over here so if we can try to download this one more time.
And here you go.
Karley says that this file contains malware.
So I made it's unavailable.
If you click on this icon over here, you can just say open it will open that file for you.
OK, so Khalid thought that this is a malware or something like that.
So I'm going to delete it, but just take this reverse shell out of it and put it over the folder over
here, OK?
So we don't need the rest of it.
I'm going to just move trash and come over here and find your file.
I opened this with any kind of editor like Leaf Pad or anything.
You are really I'm going to choose GenY, but you can't even open this with Nano itself, OK?
Because all we need to do is just change the IP address and change the portal address.
So far, the IP address.
I'm going to write my own callisthenics IP address, which is ten or two for my case, and I'm not going
to even change the port.
So the part is one, two, three, four, which is perfectly fine for me.
So I'm going to close this down and I have a few virtual over here.
So if I can run this on the WordPress, then I will get I can run this on the server that holds the
WordPress.
I can get a back, so let me see if I can upload this to the WordPress, I'm going to come over here
to Mr. Robot and find my shell and just double click on it.
And here you go.
It says that this file type is not permitted for security reasons, which makes sense.
So I'm going to copy this one and pasted over here and try to just play with it a little bit.
What we can do, we can just rename this, OK, and change the extension a little bit.
I'm going to call this my shoulder that Panji.
So it looks like a PNG file, but it's actually a file.
Even though we can upload this, maybe it won't get run by the server.
But again, it's worth a shot.
Here you go.
It doesn't let us do that.
So, again, even though this is a PNG extension, it doesn't allow us to upload this.
So I'm going to go to Google and just find a jetpack or PNG file.
I'm going to search for Metallica since this is my favorite band.
You can do this with your own favorite band as well.
I'm going to just save an image over here.
I'm going to call this Metallica DOT GPG and apparently I already have mine downloads.
So let me come over here and find that, OK, and try to see if we can actually upload anything over
here.
And apparently, yeah, we can.
So as you can see, this picture got uploaded to the server and we cannot do that.
We cannot just upload files over here.
So I'm going to change this to something like that jpg to see if there is something wrong with the PMG
file and if it's OK with the jpg file.
I'm going to come over here and just choose this one.
Here you go.
It doesn't let us.
So the filtering works very well.
As you can see, it doesn't let us upload files.
So what I'm going to do, I'm going to go for a previous to editor and I'm just going to change the
codes themselves.
OK, so I'm going to just change the codes and just copy and paste my reverse Sharlto here.
So over here, we're going to have to find a thing like a Futer or 404 template in order to paste our
code so it won't get recognized by editor or it won't get recognized by the developer and gets called.
It gets executed every time we visit the WordPress page.
Right.
So something like futer or you can just put it in the 404 template and just go for a page that doesn't
exist.
It's a good strategy as well.
So I'm going to come over here to our Web server, which is 10 to 15.
And over here we don't even see something like WordPress, like real WordPress blog or something like
that.
Right.
So maybe we can try to find something related to WordPress so that we can get to see the folder and
header.
So let me see.
This is futer that BHP.
OK, and there is an archive that comments that BHP Wicken just tried to go to for for or maybe we can
just trigger this from the server as well.
What we really need to do is just find an optimized place to put this code into.
So I'm just going to try with Futer, OK?
And we can just come over here and just run the footer that bad.
Here you go, Bluck.
Right.
So we can just reload this file and see if this works or not.
So before reloading, of course, we're going to change the content of this futer.
So this is the folder itself.
I believe it really doesn't matter.
All I'm going to do, I'm just going to copy the reverse code and pasted over here and see if that works
or not.
And you can just delete this folder that, OK, I'm just going to copy this so that if we get if we
break something, we can just always come back and pasted back.
I'm going to put it under my notes that Texte OK?
And I'm just going to pasted over here if I can.
Nope.
Let me try one more time.
Nope.
It doesn't work.
Let me try basically Bourdier.
Here you go.
It works now this is over here so if I break something I can go back and just take it from there.
Now let me delete everything here, OK.
Delete everything in the future and just open my reverse shell and copy.
Everything from here and say copy and just come back and pasted over there, so my future is over show
right now.
So if I can update this file, as you can see, it says file, isn't it?
Successfully.
Then let me just try and listen for incoming connections from part one, two, three, four.
OK, so we're doing that with Nat Cat.
And let me just refresh this.
And here you go.
The Futer disappeared, but it should send the connection back.
And here you go.
We are inside of the server.
We managed to check the server if I on it.
We are Dayman and if we are on, who am I?
Here you go.
Of course we are not rude.
It is not wise to expect to be rude when you first take into.
But we are going to try and escalate our privileges.
Right.
So here you go.
We can see some files we can browse here because see what kind of things there are inside of the ETSI
password is stuff, but we hacked into the server.
That's what's important.
I'm going to stop here and within the next lecture we we can see what we are going to do to escalate
our privileges and become route.