We've identified our PHP file that we're going to upload for exploitation on
the
beWAP.test site. Now let's go ahead and level the playing field with our actual
W site and get it uploaded and find it. So that's where we're going to go over
to our site. Now
remember I do have burp suite already running with Interceptor on meaning any
and all requests I'm
going to have to come in here forward either individually or just hit forward
all. So we're at
the main page. Let's go ahead and log in with B and bug and we're going to
forward that packet
already so we can get to the actual portal itself. And again you can either do
it up at the top
left or in the scroll menu down below on the left or excuse me top right. And
what we're looking for
here is file injection unrestricted file upload for our actual exploit. When
you hit hack once
you select it there's two things that'll come up. One it's going to access the
portal we're going
to forward that packet. And here is where we are able to go into unrestricted
file upload PHP.
Now if we go ahead and take a look at this site right here let me zoom in for
us real quick.
Here we go. You can see Underscriptive File upload PHP and down here you can
also see that we're
getting the site first and it's going to be followed up by our actual post here
in just a second.
Definitely take a look at the contents of this actual page itself not only in
here but also the
actual source of the code if you get a chance because there are some exploits
inside of there
that go beyond what we're doing now and are a fun little aside for you if you
want.
So we're going to go ahead and forward that packet as well. Go back over to the
site and here we have
as you can see just choose a file and up or and upload the file. Now you'll see
right above that
it says please upload an image. That's where the side quest comes in because
you're allowed really
to upload any file. Obviously we're using this to upload the PHP. But this
right here is supposed
to filter based on actual image files based on file extensions. Inside the PHP
code of this page
itself you will see where that's at and see how you can further filter as a
security precaution.
Okay so let's zoom out real quick and I'm going to pull up the 110b web system
here real quick.
The only reason I'm doing this is because I want to show you and make sure that
you know
there's nothing on my sleeve on this. So we're going to go into
make them as small as possible so that way you could see if something created
or not right
and then I'll move this over so that way you can see both sides of it. I will
come back to this
folder in a second but I just wanted to have it open because if the file upload
s you'll see it.
So we're going to go ahead and choose file and we're going to make sure that we
're on the actual
file system at the root level in the bad directory so /bad and bad PHP. It
should also be of note that
you don't have to change or chibad or anything on that bad.php file because it
's not the callee
system that we've made this on that's going to be executing the file. It's
going to be the actual
remote system. So we've already got it selected we're going to hit upload and
you can see here
that I and I've highlighted the word test for some reason I must have been
doing something else.
I'm going to search for the string bad PHP so you can see in there where we see
it in our in our
interceptor. Let me go ahead and zoom in for us right here. Now this right here
once you see that
a file has been uploaded through burp suite like this especially in HTTP guess
what as a fun
another bonus you could actually intercept this and replace it with the file
that you want to
upload instead. Take the bad PHP file out keep it to yourselves do another
injector attack
and along with a little bit of fuzzing replace it with a file and have it go up
on its own.
Now the ups and downsides this if they're doing content filtering based on file
type like we were just talking about with the image files this won't work all
the way especially
if you're trying to upload a PHP but then you get to test and see if it's based
on file extension
or magic numbers file extension you just need to change PHP to TXT or something
like that and
change it later or you can if it's based on magic numbers then you actually
have to go into the
hex of the file itself change it change it to get lots of different steps
possible but I'm just
letting you know some things to consider as we're going to make it our way
doing this right here
so we're not going to inject another file that's the one that we actually want
to upload because we
are the malicious actors here and we are attacking this particular web server.
I'm going to go ahead
and zoom out and forward that packet up and going back to the way uh-uh saw it
right up there this
altered because that file uploaded see see want to make sure you know it's
there and actually going
over back to the website you can see as I zoom in this image has been uploaded
here now there's a
couple things that we can do first we can take a look at this link and inspect
it to see where the
actual file is going to upload obviously in the folder up here but you know
bear with me for a
second let's say we don't see that right and we we don't get to cheat that's
this link that you see
up there is over there is essentially cheating because it tells us directly
where it's being uploaded
to now that we could go back to our burp suite go back to our HTTP history
under proxy go all the
way down to the bottom you see I've been farting around here a little bit all
right here and you
can see that we have the output the request and the response along with inside
of here where that
link actually goes to so you can inspect traffic and see what file response was
given or you can do
the previous couple of skills a new directory traversal or file traversal to
start hunting through
the actual system itself to see where that file saved at now we're skipping a
few steps as far as
remedial practice goes because we already know this is a basic install of iis
on windows 10 so
that allows us to be able to jump the gun and say it's somewhere inside of c
drive iNet
ww root slash bwap and within there now we'll go a little bit further because
like I said I had
it open here so that way you can see it upload at the same time and I want to
highlight it it's
inside the images folder now using your lessons learned from directory travers
al skill you have
to start counting how many directories you are deep starting with the actual
root drive letter itself
c drive iNet pub ww root bwap images so we are five deep and we need to go into
the actual c drive
itself from wherever we're at inside of the actual web page itself so we have
to traverse all the
way back to c drive and then all the way back to the images folder now can we
kind of skip a step
and just say cd images folder i mean sure that's a way to do it but i like to
reinforce you learning
the directory traversal method as well too and making sure that old school
command line commands
are stay fresh in your mind because they're about to come into use here in just
a minute now that we
have everything uploaded on the actual site when we get into the next portion
of this skill
we're going to actually manipulate bad.php to see if we can penetrate test
pen test the actual web server itself be right back