Let us continue with phyla vulnerabilities in the last lecture, you saw how to exploit a basic low
level operative allegedly using depletion, but what if the level is set to medium?
Well, let us see if we can exploit that to slow down on your machine and portable and login to dampen
Raible Web application.
As you can see right now, I'm in my college machine, so go to the Firefox browser.
Let us log into time with the rebels web application.
And first, we will set to security, to media.
Now, the security has been set to the medium level.
Now, let us go to applaud and will again try to applaud a BHP shell, so let's choose let's applaud
this, shall there to see if we can upload this so open and upload.
Well, we got an error that the image was not uploaded.
And also we got a descriptive error of showing what was the image on this line.
Now, these errors are also a critical vulnerability to an attacker as they are showing some critical
information about the courier.
So now what to do?
Let us go and start absolute.
Meanwhile, we'll go to the preferences in the Musila and just change the proxy settings.
If you don't remember.
Why do we do this?
You can refer back to the previous video and see again.
And now the suit has started, just do not modify anything, just click start BOPE.
A boat has been chartered go to proxy.
Click The Intercept is on not if this is if you can see this button is clicked, it will show intercepted
on there desk check if it is on.
Let's applaud and yes, forward it is, one can see it is now what we will do is we'll go to our shell,
the shell which we had created in the last video.
And we will.
Rename this shell, so we'll rename this as Shell Demo Dot, that's a GPG.
Now, this is an image.
And let us try to upload this image, keeping our intercept on so Brouse, Chalamont or.
GPG, I'm sorry, and then we'll click, upload, you can see immediately we got a request in BOPE saying
that.
Are you sure you want to upload this now?
You can see this is a post request.
As you can see the parameters through the wall.
We can see who's agent and the content limit is one one three six.
The most important thing right now that we're interested in is the filename and the content type.
You can see the content here is image slash GPG and filename is Shell demo that Dipti.
But what if we can edit that jpg.
Let let's try and see if we can edit that jpg here.
Well you can also edit it in the parameters tab after forwarding, but we will just edit it in the filename.
So I what I will do instead of GBG, I will write the HP.
And then I will forward the request and let us see Vola, shall the model be successfully uploaded.
What we did is we tricked the browser, telling that we are uploading a jpg, but in between we changed
it to BHP.
This is how we have to exploit the medium level of vulnerability.
Let us see if we have successfully uploaded this.
So click copy.
And we have shown you in the last lecture how to check whether we have uploaded this file paste into
and again, it is asking for intercepts.
We just forward for now outline of the intercept and yes, we uploaded.
So let us exploit the server.
Copy this.
Go to terminal.
Again, type Veasley, then the destination website.
I'm sorry, I didn't copy properly.
Go to Termine.
Just based, followed by the password and hit Enter, there you go.
We have compromised the medium level security of the military with the publication as well.
Let's see if we can execute a command.
And there you go.
We have our file sharing modot BHP.
You can also execute the present working directory.
Then if you click help will find out the system information using this command system in info.
Sistem.
Info.
And there you go, so you can see how powerful this shell is, and I hope you also got the idea how
to exploit the file, a provisional duty using it.
This was all for today's lecture.
Again, while quitting the browser.
So this was all for this lecture in the next lecture.
We'll see some different interesting topics again before quitting Firefox to not forget to change the
preferences from proxy settings.
No proxy click.
OK, and then this is always a good practice.
I will see you in the next lecture.