Hi, within this lecture, we're going to see if we can log into this admin portal, so before trying
brute forcing our kind of sequel injection over here, I'm going to take a look at the page source and
see if we can have a tip or hint.
And here you go.
We have a lot of things going on over here.
Let me zoom in and see what we can get over there.
So we have the middle name description over here and the content is lead password login test page views,
base 64 encoding for images.
So they are in line in the HTML and yep, it says that I read somewhere on the web.
This is a good way to do this.
I don't know about that.
But we have another comment over here.
OK, so this is the comment syntax, as you might remember.
And in the comment we have to see to do, we need to clean this up for production.
I left some junk in here to make testing easier.
So we have this note and it's obviously a hint for us.
And the note is written by easy peasy over here.
So easy peasy.
So this may be our Edmands may be our user.
We're, of course, definitely going to try to login with this.
Right.
Because that's what we do.
We follow the breadcrumbs and try to see what we can do with it.
And over here, we actually have the image source encoded with base64, I believe.
So let me see if this is the same image.
Let's say copy, image, address over here and paste it.
And here you go.
They actually named the image like this.
So I don't know who does that, but supposedly it works.
If I click enter, it will download the file for us.
Of course, we don't need that.
But again, so this is the case.
It says that we use base64 encoding and I don't know how it's going to do us any help.
But if we scroll down a little bit, we can see there is another comment over here, OK, which is the
basics to encryption one more time.
So what I'm going to do, I'm going to copy this one and try to decrypt it and see what we can actually
get out of this.
Well, maybe this is the password.
So as you can see after that, there comes the form.
So it's going to do a post over here if we give the user name and password.
So, again, there's nothing funny over there.
So this is the form.
But maybe username is easy peasy.
We assume that we found the user name.
Maybe this is the password as well, but we're going to try and see.
So I'm going to copy this and go to Web and search for base64, decrypt online, something like that,
decode decryption.
And I believe we worked with this before base64 decoded ARG and it doesn't work.
We can always try other things.
So I'm going to paste is over here and just see.
Yeah, it says that malformed inputs.
So let's see.
Maybe we have copied the wrong thing.
You let me just do this one more time over here and just say copy and come over there and just delete
the whole thing and paste one more time.
Here you go.
It again says that malformed input so it isn't good.
Let me copy this one and come to my terminal over here and let me go to my folder and create a new thing
called Password that Steve OK, and pasted over there.
So I'm going to try and decrypt this in my color Linux.
I'm going to save this control or enter and control X, and I'm going to use base64 in order to decrypt
this.
And I'm going to say Base64 Dashty and you can just give the file as an input like password data exceed
and here you go.
It kind of decrypts it but it's all gibberish.
OK, and we see the PMG over here.
So I probably this is not a string, this is not a regular text file, but they decrypt, they encrypted
and PMG file.
So I'm going to decrypt this and give the output as a file like decrypt that Panji, something like
that, and see if we actually get a valid back.
So if we get this, that means that we're going to see a picture.
Right, so here you go, we have the decrypts that PNG over there.
So let me just open that and try to see if we have a valid PNG file over there.
So let me come over here and here you go.
So this is supposedly our password.
Of course, we're going to try and see maybe this is the user and E.S.P is the password.
I don't know.
So I'm going to open my notes one more time because we're going to have to just take a note of those
things.
So, first of all, let me just take this from here.
So this is uppercase, lowercase, OK, PKK, e, something like that.
It's going to take some time.
So if you know how to do this automatically, then it's great.
I believe there are some services to do that online.
But since this is a short, fairly short amount, shorter amount, I'm just going to do this manually
and copy this, OK, and let me see if I copied the right thing.
Here you go.
Yeah, I believe yeah, I believe I did the right thing.
But let's do that one more time.
So I'm going to copy this and save this as well and come back here to our log in.
Purtill I'm going to paste is under the password and for the username we're going to give the easy peasy.
Let's see how it's spelled.
Let me come back over here.
Yeah.
So it's like that.
Easy peasy.
So I'm going to copy that as well in order not to make a mistake.
And I'm going to say log in and here you go.
Log in.
Successful and yeah, easy peasy.
Should have been our user should have been our admin user.
I don't know yet.
And this is the password.
So great.
And this is supposably the admin portal.
As you can see, we don't get much.
We only have something to upload over here and it says that upload image.
But of course, as usual, we're going to try and upload some reverse over there.
I hope it works.
So let me come over here and try to find something to upload.
So we have done this before and this is the similarity between the Mr. Robot and this one.
So I'm going to come over here and just search for the reversal.
And of course, I'm going to go into the panties monkey by saying ignore the risk.
So we have done this before.
So I'm going to do this quick.
I'm going to come over here to B and download the previous show.
So we have done this before.
If you remember, once we download this, it will get downloaded and the colonics will complain to say
that, yeah, this is malware.
We're going to open this, OK, so that it will allow us to edit this file.
And I'm just going to come over here to my folder and just unzip this thing over there.
And if I come over here and open this reversal with any kind of editor, then I get to edit the actual
Allport and I'll host over here.
Right.
So remember, we have to open this with any kind of editor I'm using.
Genie, if you're using something else, this is fine.
Just I changed his IP address to your own IP address, which is ten down to four for me, I believe.
And you can leave the port as it is.
So I'm going to save this and close this one down and this one as well.
So make sure you put your own IP address rather than channel to four and try to just I'm going to try
and upload this thing over here.
So let me find THP Perico and let's see if we can do that.
Here you go.
It says that this is not ever that file only allowed our PNG jpg.
So again, we're going to have to try something else.
So I'm going to rename this, OK, I'm going to change this too.
Shall not be.
And we can try that PMG like we have done before.
Let me try and see if this works or not.
I'm going to come over here and upload this one.
Here you go.
It says That file has been uploaded to uploads.
Great.
So let's go over here and see if we can actually make this work, because it doesn't mean that it's
working right now.
We only got to upload it.
OK, so if you.
Come over here to upload it, say no and let's say images, it says no.
Here you go.
Images, yeah, we can't see the images, but it's not uploaded over here and we cannot seem to go to
uploads.
Let me try that one more time.
I, I actually wasn't able to see the whole thing over here.
I'm going to just go for a movie LP on two one, two, three, four to start listening, OK, by the
way.
So, yeah, it's supposed to be.
Let me come over here.
It's supposed to be uploads.
OK, so maybe we can just try to reach the upload slash and the filename over here, but we cannot go
to uploads.
Right.
We cannot go there.
So you can just try to directly go to the shelter that PMG and here you go.
It seems to be working and we got the show right now.
We got the show back from here.
So maybe you can make a note of this URL as well.
So if you lose your shadow over here, you can come back anytime you want.
And as you can see, we are in the Apache user, which is great, but not great, actually, which is
good, but not great because we are not rude.
So we need to escalate our privileges a little bit.
OK, so again, make sure to copy this one and try to run it.
If you lose your show, if you lose your session later on, I'm going to go into my folder over here
to Nannerl in my notes that Texte and I'm going to pace the thing over there so that we can actually
reach it whenever we want.
OK, now we are in the server.
We managed to hack it.
Now we're going to see what we can do with it.
But we're going to do that within the next lecture together.