We're only going to skip the rock across the pond of prep work on this one
because we should know by now and have definitely reinforced directory travers
al and also file traversing being able to examine file contents inside of our
test system in the lab setup against
the map.test. I'm going to move on over to the side screen real quick and we
can see that I have the CaliBox pulled up and I'm going to move it over just a
little bit for us. And along with burp suite already on interceptors on proxies
running and we already have the browser opened up.
All that has been laid out for us, but I want to go ahead and get a file ready
for us to be able to send to bwap.test for us to potentially target and exploit
this individual says a web server that we're looking at.
Now you may notice that I already have the file built for us and there's two
reasons for this. One, I did it on the actual system itself inside of terminal
and use them to do this. But I also want to take this opportunity to show you
the NotePad++ inside of Cali. So inside of the actual root system itself slash
bad, I created that folder. I created the file bad.php. Now I'm going to go
ahead and open up terminal here.
And you could have created the file through touch and then vem'd your way into
it. And I have the code listed below this video of the contents of bad.php. We
're going to do a pseudo cat bad.
Let's see the password and you can see here that I only have one line of code
and it's PHP code. Now I'm going to open this up in notepad++ to allow us to be
able to see it just a little bit better.
And here we are inside of notepad++. Now a couple things I want to point out
real quick if you're not familiar with this program, it's basically a very
fancy text editor.
And one of the things I really like about it is the fact that you can select a
language markup style that allows you to be able to kind of see visually if
your code is correct or not or roughly there with it.
What I mean is is that you can see how I have on line one, the Pacman brackets
on the left and right. Well if I put one on the left, the less than sign.
Then the corresponding greater than sign would have to be there somewhere to be
able to close that statement out. If it isn't, then it will give me not
necessarily an error, but it will note that something needs to appear.
Now in order to do that, you select the language where right below the actual
file name you see language, go down alphabetically and pick the language that
you want to be able to look at.
Now I am in PHP and you'll notice in there that Pascal is still an option that
some of us ancient people out there still hammer and chisel our way into
programming hearts and minds.
But after you select a more updated language like PHP, you can see that I have
one line of code and I'm going to explain this roughly for you.
Question mark PHP, I'm addressing this in PHP.
And that get is going once we say shell execute, it's going to say get what
inside a shell and we're getting command. Then we're closing out all the
brackets and with the question mark greater than sign, we're closing out the
PHP statement.
And that's it. Now the reason this is really important is because we're going
straight for command. We're going for the jugular here.
We should be able to find a way to upload this file and be able to access it
from the website to allow us to be able to funnel commands through the web
browser into command because this is a PHP file.
And again, this is a vulnerability, be it through code and misconfiguration of
PHP in bewap, but is also set up because it's a pretty common occurrence out
there.
So, why are we using command? Excellent question. Glad you asked. It's because
we know by now that we've beaten it in with the nerf bat that we're using
Windows 10 as our baseline operating system to host the actual web server and
web applications.
So, if we were using a POSIX-based system or if we were doing this inside of
patchy, the only difference here would be that we'd instead of command CMD, we
would be using bash or whichever flavor of shell that you like.
For me, it's bash because it's the default one, right? But essentially, you're
still calling up a prompt. Now, you may be wondering, can you invoke PowerShell
from here?
Yes, but even though PowerShell does run a lot of commands, you would be
required to do a lot of ampersands and continuances, right?
And PowerShell is really long command statements. When you're running something
like this, you want to try to keep it as quick as possible.
Two reasons. One, it makes it very easy for us to memorize basic commands to go
in here like IP config, NS Lookup, Who Am I, PWD, etc. or DIR, even.
Also, once this gets invoked on a normal web server that has all the
recommendations from places like Owasp and NIST, which we referenced earlier in
this course, National Institute to the Science and Technology Standards,
basically, NIST puts out advisories for us to be able to implement security
settings.
If those settings are implemented and we have all of our IDS and IPS systems in
effect, something like this is going to bring a lot of bells and that bell don
't get on wrong.
It's going to catch out of the bag at that point.
So we're taking advantage of the fact that bwamp.test is our primary test site
for us to be able to go through and trying to manipulate misconfiguration
vulnerabilities instead of the actual code itself.
Because we should also note that while there may be code vulnerabilities that
allow command or even bash terminal to execute inside a PHP, regardless of the
versioning because a code, because a code mess ups and need patches.
Configurations can help tremendously in preventing some of these faults without
doing security patches. Do you want the security patches? Yes, but there may be
a testing period that our organization has to abide by.
It may be that this is a zero day vulnerability and there's no known patch for
it yet. And we can just strengthen our security posturing through
configurations in administrative and technical controls to be able to prevent
things like this from happening.
But we saved this file as PHP. Two reasons. One, we want the web server
recognize it. And if you save it as PHP inside of notepad QQ or touch it as a
PHP file, it will create the wonderful little magic numbers at the beginning of
the file that identified this as a PHP.
And we can verify this inside of time dot there for a second. I apologize. We
can verify this as a closed notepad plus plus as you could see the icon of the
actual PHP file. Purple, nice little PHP in the middle, meaning that the magic
numbers of this particular file identified in Cali as being a PHP file.
So now that we got those basics out of the way, it's time for us to be able to
go inside a B-WAP and start trying to upload this and see if we can manipulate
some traffic and some commands and execute some remote shell terminology for us
to verify our file inclusion exploit.
exploit.