Let us start with a brand new topic file observing the reality in the last lecture.
These are the commercial injection and setting up and configuration of Bob.
So what are available when the abilities uploaded files represent a significant risk to applications?
The first step in many attacks is to get some code to the system to be attacked.
Then the attack only needs to find a way to get the code executed using a file vulnerability.
It helps the attacker accomplish the first step that is getting inside the system.
The consequences of unrestricted file upload can vary, including complete sistem, take over and overloaded
a file system or database forwarding attacks to backend systems, kleinsorge attacks or simple defacement
of the website.
It depends on what the application does with the file upload file and especially where it is stored.
There are really two classes of problems here.
The first is with the file metadata like the part and the file name, and the other part of the problem
is with the size or content.
Now, what is the risk of uploading a dangerous, malicious file?
The impact of this vulnerability is high supposed goal can be executed in the server context or on the
client side, the likelihood of detection for the attacker is high and the prevalence is common as a
result of the severity is high.
It is important to check file, upload models, access controls to examine the risks properly.
The Web server can be compromised by uploading and executing a web shell which can run commands, browse
the stolen files, browse local resources, attack other servers or exploit the local nativities and
so forth.
We are going to see this type of attack in the next couple of minutes.
File upload vulnerability can also result in client attacks.
For example, uploading malicious files can make the website vulnerable to clients attacks such as exercice
or crosstabs scripting hijacking.
Uploaded files can be abused to exploit other vulnerable sections of an application when a file on the
same or trustor server is needed.
Also, uploaded files might trigger vulnerabilities in broken libraries or applications on the client
side, a malicious file such as a Unix Shell script of Windows Virus and Excel file with a dangerous
formula or a reverse shell can be uploaded on the server in order to execute code by an administrator
or a webmaster.
An attacker might be able to put a phishing page into the website or deface the website.
The file storage server might be abused to host troublesome file, including malware, illegal software
or other contents file upload.
Those may disclose internal information such as server internal parts in their error messages.
So this is the one of the major impacts of available vulnerabilities.
And now let us see how to upload a malicious file on the server.
Again, we're telling that these tutorials are just for educational purposes so as to tell you that
how these vulnerabilities work and how you should work in order to protect them, but not use these
attacks on any random websites as you can get compromised.
So keep your copy machine on as well as Dammann Rybolovlev application on.
So let us get started.
So as you can see right now, I am on my coffee machine and the first thing that I need to do is start
the Firefox for this practical, we do not need the suite because we are going to exploit the file,
upload all the reality at a low level, just launch the damn vulnerable Web application.
Go to the security tab and just select a security to look.
Then go to applaud, and there you go, you have to upload an image now, let us choose an image to
download.
Let us see if we can upload that image into the shell and what result we get.
So what what I will do is I will download this image.
And now I will go to the Shell Barrales and again, see the image which I have been downloaded will
appear in the download STAP.
And click open and then upload, you can successfully upload and check the part where it was uploaded,
you just copy.
The pot.
Copy and go to DVD slash pasted there and then hit enter.
You can see our image has been uploaded here.
Now what we need to do is we need to upload.
A different BHP shell, I let us see if we can get access to the Web server by uploading the BHP shell.
So now to or in order to create a special we will use in the application known as the WTVG Elvi, so
using we believe we can create a remote shell and then upload that beashel to the website.
So just type Vele.
Followed by generate.
Then the password to that actual I will give one, two, three, four, five, six, and the name of
the shell, I will give Shell.
Demo Darte.
BHP and then hit Enter.
You can see it has generated a shell demo with password one, two, three, four, five, six of 680
byte file.
Now very little.
Let us go here.
And you can see them on that BHP story here now.
We want to applaud this shell to that DPW.
You can see choose an image to upload, let us see if we can upload the BHP files.
Just click browse.
Go to home and you can see Sheldon Modot, BHP, and then he opened.
And upload, you can see it has been successfully uploaded.
Now, why did this happen?
This happened because there was no server side checking or clydeside checking whether the content that
is being uploaded is a BHP or a GBG.
This is a failure of blindsight validation that the security is low.
The shell got uploaded.
Now let's see if it got successfully uploaded.
Just copy the part.
Again, pasted after divi w e.
And hit enter, it's a blank page Softshell got uploaded.
Now we will connect to the shell through the application we to just type with.
Go to your browser, copy this website, this you are Eurail.
Well, we have uploaded the shells, so copy come to your terminal based.
And then type the password, that is one, two, three, four, five, six, and then hit enter.
You can see we have successfully connected to the server session has been generated.
And now let us see if we can list out the commands using the Alaska command or the president working
directly.
So I'll execute the Alaska and see what I can get.
Vola.
You can see cyber security.
iStock photo the photo, which we had uploaded a couple of minutes ago.
We can see our picture is also uploaded.
Shelden will not BHB, which means we have successfully compromised the division of a server.
If you write dot dash help here, you can see these are all the commands that you can execute using
really can initiate TCP ports can you can execute shell commands, execute commands with super user,
execute BHP commands, compress or expand archives, copy single file, compress, expand zip files
and everything.
Which means if the server or if there is no validation while uploading a file, we can help us to compromise
the server entirely.
Now, this was pretty simple because the security level was set to look in the next lecture.
You will see even if we said the security level to medium, how we can upload a BHP file.