In our challenge, we were seeing if we could make our way
through the target operating system by exploiting
a PHP vulnerability and seeing the registry files.
Well, there's two things we need to remember about this.
And one of them is knowing where the registry files
are actually located.
And I'm gonna show you on my system,
dragging this in real quick and make sure I'm on the side screen,
that this right here, C drive windows system 32/config,
is where all the registry files are stored at within Windows.
Now we know our target is Windows based and Windows 10
based on the recon that we did
at the beginning of our pen testing lifecycle
on this particular system.
I'm gonna close that.
And then on our target system,
we're gonna go back to our BWAP website,
and we're going to click on Hack
for directory traversal files.
And inside of our actual burp suite,
we get the first request for the PHP,
the next request for the actual file itself.
This is the one that we're gonna send to the intruder.
And then when we go over there,
we can double click message or select our message.txt.
Come on now, you can do it.
And add a subsection for it,
for our entry into the file path
and what we're actually doing here.
Now if we remember, it was six deep
as far as going down to the C drive
and back up again to where we needed to go.
Now the one on top,
and I'm gonna zoom out for you real quick
and show you what I'm talking about,
the iNetPUB/WWWB/BWAP-config-inc.php,
that's that file location.
So we need to kind of mimic that setting
when we add it to the actual payload.
So I'm gonna clear that W or dot dot slash dot dot slash dot
slash dot dot.
I'm gonna get there.
This is why I was skipping it earlier.
Now I'm gonna go into Windows,
System 32/config,
and just add a curiosity,
I'm gonna pull it up a mine real quick
just to see which one we should go into.
Windows System 32,
and I'm doing this right here to show you,
it's okay to use references.
Don't feel like you have to memorize all of this
when you go into the field.
You'll always have notes and the Google,
and this right here is just building
the baseline of knowledge for us.
Config, and then inside of here,
let's say, for instance, we wanna go into security.
We'll come back to you later, Sam.
Oh, I promise.
And then security.
Did I spell it right?
Because sometimes I have a bad habit of doing that.
So now I'm gonna hit on start attack.
Oh, I go back 'cause I didn't add it to the payload.
There we go.
Start attack, click okay,
and I do have a code of 200 on there.
Now I'm gonna right click on that
and go to a
Shield Response in Browser, I'll be that.
Come back over to my browser, open up a new tab.
I know it's a few steps.
This file doesn't exist.
Well, it turns out we can't exactly read the registry
just yet.
Don't worry, it's coming.
But we are able to read other files
within the operating system, such as win.ini
within the Windows folder,
proving that we can traverse and read files all around.
Now I'm gonna zoom in for you real quick
and show you the commands that I used here.
And that number four is the one in particular
that actually is going to work for us.
And we know this because not only did we receive
of a status code of 200,
but we actually got a response received
as far as like sizes concerned.
So we received 276 bytes, meaning that we did get something.
Now that being said, you can also see right below
where page equals, and that's the entire string
of ASCII, understanding the dot-not slash thing.
So we're going to right click on that one
and go to show response in browser and copy it,
head on over to our browser, open up a new tab,
and stick it on in.
And you could see right here that we have,
and I'll zoom in for us,
that we have our win.ini file being displayed to us,
and opens up the possibility that we are able to get
into some very mischievous things
on this particular web server.
So while we weren't able to get in the registry,
and I left that in because I wanted to show you
that even I make mistakes, we all make mistakes,
and we might, we tried to jump too far ahead,
but we're all ready getting into the file system
of the operating system and muck it around.
So are you able to go around the file system
and see get a directory listing?
So traversal is a wonderful opportunity for us
to be able to not only see what's inside the system,
what's under the hood, so to speak,
but also set us up for other things like,
actually replacing files, uploading,
and possibly command injection as we move further
in this course.
I hope this has been informative for you,
and I'd like to thank you for viewing.