We have our file verified on the actual web server itself.
Let's hop back on over to the CaliBox real quick and log back in due to a
timeout real quick.
And there's a couple of ways that we can slice this carrot.
First, we can actually go back to the actual proxy itself inside the web
history and see where the file was uploaded at.
And then go back to our browser here, open up a new tab, we're going to type in
" unwap.test".
Oh, it wants us to do a forward request.
Yeah.
Okay, there we go.
Go back to it.
And inside the web address bar, we're going to type in " unwap/images forward".
And I'm going to take that out real quick.
And this right here, and I'll put the link of what this is supposed to look
like below the video.
We're going to hit enter.
And essentially, we're going to go to a blank page.
Now I'm going to zoom in for us to show us what it looks like.
" unwap.test/bwap/images/bad.php".
Now going to the page itself doesn't necessarily tell us anything or present
itself to us.
We could even do a right click and go to source view page source.
There it is.
And there's nothing in there as well.
So what is it that we're exactly going to do?
Well, we're going to follow PHP at the file extension site with a question mark
followed by command.
And I'm forwarding those packages as it happens.
And I'm going to show you what this looks like.
"question mark command = dir".
What are we doing?
Well, I'm going to open up bad.php for us real quick.
Right click on it and go to open with notepadqq.
And then I'm going to zoom in again for us.
Now, remember, I'm not a PHP coder.
I, as far as like my everyday job, that's not it at all.
But I'm showing you here that shell exact dollar sign underscore get command.
We're invoking command.
Meaning like the terminal shell that you get inside of Windows, the command
prompt.
And then the equal following with that is going to be a command that we could
put
inside of the command prompt for us to be able to execute.
We should get the results back inside the browser itself.
So let's see if that's what happens because we haven't pulled up here ready to
go.
We hit enter and what you know, we have an output of everything in the
directory
that we're in right now.
We zoom in and make sure that we understand where we're at in the directory
browsing itself.
Volume and D drive C has no label volume, serial number, et cetera, et cetera.
Directory C drive, IDEP hub, www root, bewap images, date and timestamp.
And then I know this is not broken down by line here, but you can see that we
have
bad PHP and all the other images that are inside of that image folder itself.
We're exfiltrating data from the system using a unrestricted upload exploit
and malicious code all together with our traversal lessons as well too.
So now we're starting to see where all this comes together.
Well, that's all well and good that we could do DIR.
What else can we do?
Well, you could do pretty much anything that you can inside of a regular
command prompt
inside of the actual operating system.
So if you want to do another command, for instance, now we're going to say DIR.
You may be wondering are spaces allowed?
Yes, yes, they are because we're going to say DIR space, C colon dollar.
And I'm just going to do the C drive first.
And then I'm going to send a request.
But before I do, I want to show you what that looks like.
The ASCII code of space and everything like that, the percent stuff is already
added
in there to the request as we can see here by the packet that was intercepted
from
burp suite. So it goes from the browser and intercepts and then to the actual
server
itself with that modified address.
And time me back over, I now have a directory listing of everything on the C
drive.
What does this really mean?
We could start browsing the directory and see in if we can actually see some
files.
So let me go to the actual Windows 10 system here for a second.
And my fact, we make sure that we know nothing's up my sleeve here.
I'm going to make sure I'm going to close this window now that we don't need it
.
No more. I'm going to open up a file, explore and go to desktop and show you.
The actual path for it right.
Click, go to properties and then show you the path for it.
C drive users learners.
I had a little bit of a brain fart there for a second.
I'm so used to doing everything in command line now.
C drive users learners.
So we're going to go in there and that's where we're at on desktop.
We're going to right click and go to new text document.
We're going to call it secret.
Did I spell that right?
Yep. And we're going to open it up in notepad and say this.
Is a secret and then save it and close it.
And we're going to go back over to our B.
W our Kali system here inside of the terminal that we have now from our B.
Wap shell and command equals a D.
I. R. C drive windows slash or excuse me.
We just said it was users slash learner slash desktop.
And for right now, I'm going to turn intercept off and then go back to the
browser.
And you can see here that we don't have anything listed because it's only
showing
the C drive users learner may need to put us backslash on the end of that.
And see if we could get anything to come up.
I wonder if it has something to do with our permissions.
Let's see who we are.
By who we are.
I mean, who am I?
We are at this point in time, according to the actual browser.
It's self as I zoom in for us here real quick.
I use our I user, meaning we're an Internet.
I S user.
So does I user have permissions into the actual file on the desktop of C drive
users learner?
Hmm.
Might be something that we need to go check on the actual system itself as we
go
into the properties and then inside the actual security tab.
And would you know it?
It doesn't.
Well, that's kind of a key piece of information to remember.
Now we're not really going to go inside of, you know, all three permissions and
everything like that just yet.
For now, I'm just going to go in and add the I user account.
Two permissions on this file with the standard read, execute and read.
I'm going to go OK, OK.
And then we're going to go back a page and refresh.
And we still don't probably because of desktop users and all that stuff.
So let's go to this PC C drive users.
So I am just going to go in and add I user to the desktop for learner as well,
too.
Go into edit, add I you S are.
And then we're going to make sure read and execute or allowed.
Okie dokie, okie dokie, go back in here and refresh.
Now we can see it.
Sorry about that.
And but this is something.
The reason I'm leaving this in is because these are things to think about when
we're
starting to browse around the system, make it sure that we know commands like
who am I to
understand what permissions we do have on the actual system itself.
I user is a standard account that comes with IIS and that's something that you
refer back to the IIS documentation to see what permissions they have on the
system by default.
But there's secret.txt.
Now let's go a little bit further.
I'm going to delete the DER in a motor instead put in type, which is kind of
like a cat inside
of POSIX based systems.
And I'm going to at the end put in the secret dot T X T.
And you can see there clearly that this is in fact a secret, but it ain't no
more.
So we're able to browse around the directory and get into bits of information
based on
our permissions and get other critical system information as well.
Again, we're running this like a standard command prompt inside of Windows and
we're limited
by the permissions at this point.
Here in a few other skills, we're definitely going to be getting into gaining
access, pivoting
and all this other stuff.
But I just want to pause here for a second.
And then when we come back in the next portion of the skill, we'll start
plotting out some
of the evil things that we're going to do all in the name of goody goodyness.