Hi, within this lecture, we're going to try and find a way in order to upload a shell or any kind
of way to send a reverse shell back to our clinics with inside of the cold fusion administrator panel
over here.
OK, so I don't think that you ever use cold fusion before, but if you do, then you can actually find
this very easy.
But when I first saw this ETF, I haven't used any kind of cold fusion products before, so I'm going
to exactly show you how I found this out.
OK, so first thing I did, I'm going to just open the Google and I have written down how to upload
Shell to cold fusion.
OK, so this is how easy it is.
Or maybe we don't know yet.
Maybe it's easy, maybe it's not.
As you can see, we have one million results over a year, more than one million actually close to two
million.
And we can just try to read these tutorials over here in order to understand how this works.
OK, because if you never worked with cold fusion before, then you don't even know the menus.
You don't even know the options.
So you're going to have to cheat a little.
But of course, you don't want to just open the, I don't know, the Arctic CTF solution like this.
OK, so this is the Arctic right up, for example.
I have seen this when I first Google it as well, but I haven't opened it because that would be cheating.
OK, but you can actually read the other ones.
Like over here we see that it's Shell that GSB.
So it should be in the JSB format most of the time, I believe.
And let's see if we have to upload file to cold fusion and let's see if we can find something about
this.
OK, because we can create a JSP easily with MSF Wynnum.
So I'm just going to search for like that how to download files from cold fusion and see if we can actually
make a request, because cold fusion is a web application development portal, some kind of software
eventually.
And there that should be a way to download files.
Right.
So as you can see, we have the stack overflow over here.
And yeah, I believe we can write some functions inside of the cold fusion administrator panel over
here.
So maybe we can try to find this schedule tasks as we see over there and try to see what it does.
OK, let me go over here.
And of course, we're going to have to wait a little bit, as usual.
And by the way, it took me much more time to understand that we need to go into the schedule tasks
then.
Did the research OK?
Took me a lot of Googling.
But again, I have found out that if I come over here, I can create a schedule task.
And the schedule task is exactly like a grown job that we do in calisthenics or in Linux usually.
And over here we can create a job like I create a task and we can assign a Eurail to it, apparently.
OK, so if we can assign a URL, we can just download that file and save it to some kind of a file and
folder system inside of the Adobe Cold Fusion.
And that would be great because we can just create a show and upload it over here.
OK, and there's one question in mind, though, how to run that after we save it.
OK, we don't even know that we can write to you earlier here, OK?
That's that is very easy.
We can just put it on our Apache Web server and how to actually save that file and run that file.
OK, so it should be somewhere over here like Sieff slash files or something like that, but we don't
know it.
So how to find that file?
It took me a lot of time to understand that too.
You have to go to the server settings and mappings.
So if you go to mappings, you can see some general information about your cold fusion aid administrator
settings.
OK, and let me show you what I mean.
If you go to the mappings, you will see the logical patterns over here.
So these are the mappings that our cold fusion server uses.
So our director, Pat, is something like this, so called Fusion eight and WW W Root NCF idea.
OK, so of course there is no way of knowing that you have to look at from the mappings so that you
can come to the scheduled tasks.
When you create a schedule task, you can just put that route into your file target and then make it
work.
So I'm going to show you how to do that.
But just let me search for JSB, Rochelle, by the way, to see if we can get a reverse scaled back
from The Apprentice, Munky or something like that from GitHub, or we're going to have to create it
with myself, with them.
So let me see.
So this is the GOP versus GSB and I don't know.
Yeah, it's a backdoor, actually.
Maybe we can try to compile this on our own or just submit it to download it from the cold fusion and
just make it run and get back to us.
Or maybe we can try to do this automatically with MSF them.
Let me see if we have an interpreter session or like a massive Wynnum Jospeh Rachelle's.
I don't think we can get them interpretation of this one, but at least we can get a shellback.
Right.
So let me come over here.
Yeah.
Yep.
Here you go.
We have JSB, Joven, Interpretor Reverse.
DCPI, we have an interpreter.
Well, I don't think we're going to get an interpreter shellback but it's worth a shot here.
You see the comment in order to run this, OK, as you can see, can be found with a quick Googling.
So all you gotta do is just specify the payload over here, which is Java JSB, Shalrie GCP.
And of course, you get have to give the Al-Hussayen Alpert and you're going to have to run to draw
and call it into a file called Sheldon GSB.
So it's the usual way of working with MSF.
Wynnum, I'm going to run this or you can just copy and paste it from Google or you can just follow
along with me.
I'm going to say it must have been the payload option.
Over here is Dash B, Java JSB shall reverse TCP and for the host, I'm going to go for ten, ten,
fourteen, nineteen.
Of course you got have to write your own.
Alpert is far, far, far, far.
It really doesn't matter.
I'm going to want it in a row format and I'm going to just save it under Devar w w w hdmi l and of course
you get enough to give it a name like Sheldon GSB.
OK, and don't forget to add the extension over here as well.
Like did that just be OK.
You don't have to call it shuttle, you can call it anything you want, but make sure you.
The dark GSB at the end, so this will create a JSP Shall for us, and now I'm going to run the service
Apache to start thinking.
So you know John, run my Web server.
Now I'm going to schedule a new task.
Now I can reach that file through my web server.
Right.
So I'm going to specify the path, the URL as my Web server, and also I'm going to specify the path
of the file as the mapping that we have copied.
So remember, we copied the mapping.
OK, so I'm going to call this test and for the URL, I'm going to go for 10, 10, 14, 19 and Shalal
that GSB.
So this is my Web server.
You're going to have to write your own IP.
I don't require any username and password to reach for this.
I'm going to save this to hear the path that we have copied from mappings.
OK, so let me open this one more time because it seems that I've lost that.
This is one of the reasons that we should take notes often.
As you can see, I lost that.
I have to put this one more time.
So let's wait until 10 seconds so that we can copy it and just come over here and pasted.
So here you go.
It's going to be under here.
So, of course, you don't have to take in the C, OK, because it's already in the local for this one.
But since we do that, it can just come over here and save it under the sea itself.
And over here, I'm going to write that JSB so that this file can be saved to here.
So I'm going to submit this and I believe this will be executed for us.
And we can see if we get the file or not by just running this.
OK, if we can actually reach the JSP file, that means that we got the file.
OK, but this is the maybe this is the first time that we are doing this on cold fusion administrator
panel.
So we're going to try and see.
So I'm going to open them up, have over here because I'm going to create a listener for us.
So here you go.
Our task is scheduled.
So I don't think we have given some instructions for scheduling, like around over a minute runs every
10 minutes.
I'm going to see to that as well.
So over here, I'm in the Métis Floyds.
So what I want to do, what I want to do, I want to go into the multimember as usual, and over there
we're going to have to set the payload to JSB.
So let me try and use exploit multiheaded there so I don't have any payload right now.
So I'm going to say show payloads, but I believe it's going to show us a lot of payloads over here.
So let me see if we have one with interpretor.
I don't think so.
So we're just going to use the same old Java JSP But let me just try to see because it said interpretor
already there in the website.
I don't think so, but let me just find it so I don't see it.
If you guys found a way to open an interpreter with that JSP payload, then it's very good.
But I believe we're going to have to go for the university anyway after Java.
OK, and let me just take a look around here.
I really want to read this, so I'm going to search for my interpreter.
Windows GSP shall OK, MSF Council.
So we're going to get a very special back from the JSB file and see if we can make it into the interpretational
or not.
Nope, I don't think so, because even though it says that interpreter shall over here, OK, the payload
is still Java JSP shall reverse TCP.
So I'm just going to go for that, OK, because let's not waste time over here.
It doesn't matter if we get an interpreter shellback or not.
I'm going to set payload to this and I'm going to run the show Upshaw's.
So we're going to have to change that host to ten, ten, fourteen, nineteen.
Alpert's I believe you have already defined it as four four four four.
So I can run this on the background with running expert.
And I'm going to come back here and let me see if we got the JSB file back, so I'm going to run shelter
just beyond that video over here, OK?
And see if we can get this.
And let's see, shall that GSB, of course, we get have to wait 10 seconds in order to make this work.
And it will show us if we got that file, if we got that file, it will open the show and here you go.
I don't think so.
We didn't get it yet.
So we don't have a child back here.
So it says that file not found exceptional.
OK, so maybe we going to have to just take a look at this test one more time.
Maybe we can just click on here like round scheduled task so that it can run it for us because we haven't
specified an interval for this.
Like in a current up, you remember the current tap.
So we have to specify some kind of time frame and we didn't do that over here.
Maybe we going to have to run this manually like that and see if it works or not.
Of course, it will make us wait 10 seconds again before it shows us the results.
So, yep, I believe yeah.
It says that task was completed successfully.
Let's see if we can get this.
OK, let's see if we got this right now.
So CFI Schallert, JSB, let me run this and let's see if we get the shuttle back.
If it doesn't work, of course, we're going to have to just run the scheduled task one more time with
a different setup.
So, again, we're waiting 10 seconds and here you go.
We got the file not found except one more time.
So I believe there are some things that we should consider about the scheduled task itself.
So let me go into the test and we're going to change some parameters.
Let me see.
Of course, we're going to have to wait and see for 10 seconds one more time.
Again, this is not how you do CTF.
So I'm going to go into our e-mail to see, yep, we have the shell that GSB and here you go.
Vaisse the thing over here.
So we're saving it under the right folder and everything seems to be fine.
It's saving in the right folder.
Right name.
So for the frequency we actually specified something without even realizing it.
So it should be one time thingee at some point.
So I'm going to make it daily every maybe one hour.
One minute.
OK, why not make it one minute and make sure just save it, save output to a file as well.
Maybe that was the problem.
So I changed to one minutes.
They every and also I checked the same output file.
OK, so maybe the frequency was the problem.
Maybe saving this output file was the problem we are going to see.
Yup.
It says that you need to enter a valid start time.
OK, I'm going to choose this one more time, but I'm going to leave the same output to a file checked
and we're going to see if that was a problem or not.
OK, let's see if we can make it work.
So if we can make it work, we can always run this from the administrator panel.
I believe you know that play button that we have actually clicked on and it said that test completed
successfully.
Why not?
We do that.
We can just try to do that as well.
Right.
So I'm going to try that as long as we can submit this.
Yeah, here you go.
Now, I can run this by clicking on display button and let's see if we can get back the shot this time.
OK, we're going to have to wait ten seconds.
And then we're going to have to run it from the browser one more time.
And here you go.
Let me just see.
Yep, this is finished.
I'm going to run this and we're going to have to wait 10 seconds to get a response back.
And then if we get this shell that JSB should open a reverse shell back to us, to the Culley machine
over here.
So let's wait until we see.
Here you go.
Now, we don't get an error if we come over here to a listener.
Here you go.
Now we have the shell open.
So I'm going around saying, well, now here you see we have this one and I'm going to just interact
with it.
And let's see what kind of shall we get?
It really doesn't matter.
As long as we get a shell, we can try to escalate our privileges in a way that we can become an administrator
user because we have seen a lot of things about it in the previous section.
Right.
So let me try this with hitting enter or something.
Yeah, here you go.
We have the shell back here, so I'm going to try to find who am I?
Yeah, we are Arctic tolis.
So far so good.
I'm going through our system info and let's see.
Yeah, here you go.
We see all the things over here.
So this is Arctic.
This is window server actually Windows Server 2008.
Very good.
Let's stop here.
And within the next lecture, we can understand how to escalate our privileges together.