We went over the good reasons that Command and Jaxxie can be useful for us as
system administrators.
Now let's get into some bad stuff.
You may notice on the desktop above bay or excuse me on the Calibox in the top
right corner as I move the notepad QQ out of the way.
That we have two files one called not dot C and not dot X E.
And the reason for this is because I've created a very simplistic as you can
see inside of the notepad QQ folder or program and also meant for you.
But I've written a very simplistic knobsled for a Windows operating system.
Totally innocent as it seems and have compiled it into not dot exe so that way
it can be ran on a Windows system.
Now what this is going to do is fill the RAM space or basically the processor
space with a bunch of nonsense, mostly zeros as you can see here as we have not
be incensed.
Now this is a little bit tongue of cheek and we'll be getting into knobsled a
little bit more in detail as the course continues.
But I just want to give you an example here for a second. So I've created this
code and I've compiled it and I've put it right here on the top right not not
exe.
Now I'm going to attack a Windows 10 system with it.
Well bear with me here because you're probably wondering how are we going to
get it on a Windows 10 system.
Yeah, remember this site.
That's right.
We're back to our bwap.test for the Windows 10 bwap I asked server.
And one of our previous skills we actually went through and did some directory
traversal and uploaded a malicious PHP file.
Definitely go check that out because that's going to be kind of important here
for the purposes of this exercise.
Now I'm going to go in and log in to our bwap website.
And I'm going to go to the unrestricted file upload.
You may remember this because this is where we uploaded that bad.php file that
we did in that previous skill.
I'm going to go ahead and choose my file that on the desktop and go into knob.
exe that I've created for Windows and upload it.
And inside of our Windows 10 system that's running IIS you can see here that it
did in fact zoom in for us here.
Upload it to the Windows IIS server for bwap.
Now again, we're not getting into the details of like how this works.
That's for that skill for unrestricted file uploads and directory traversal.
What we're talking about here is that we have the actual attack file on the
system now.
Now before we get into actually command injecting this, let's take a look at
what it does when it's ran on a system.
You may notice that I have the task manager of that Windows 10 system opened up
on the processing tab for a graphical representation.
I'm simply going to right click and go to run as administrator on knob.exe and
sit yes.
And that's what it does. It just opens up blank window and it starts writing
not beside the processing.
I can tell because as you can see here it increased our processing usage up to
about 50% on the system.
Well, that's kind of bad because what I'm doing is I'm attacking this system
with a knobsled that basically sends it into a fail open state because it's
hung up on all the processing and can't think anymore.
So again, if you want to take a look at the actual file itself or not by all
means go ahead and I'll have it below as well as a simplistic code.
But this is the exe running on the system. Now you may also notice that I had
to run it as an administrator on the system individually.
So far we haven't command injected anything.
What we did was we tested to make sure that this particular knobsled is in fact
running like it's opposed to and so far it is.
So I have to go into the either the details and find not.exe and ended there or
I have to go through and end it in the window.
And if I'm going to end it in the window so that way I can show you the formats
at the same time.
Boom. And then as soon as I close it, it goes down back to back to normal
system operations and you know that inside of task manager, you have that event
ID.
That is a correlated with it along with the process ID that shows us what
exactly took place.
And if you're definitely into the security aspect of this, check out security
plus a CASP here and see why I say here on CBT nuggets because there should
have been an alert for that much processing out of nowhere to trigger an IDS or
an IPS alarm.
That out of the way. Now we got to find a way for us to be able to go through
and manipulate this web server to run that from the background.
And that's exactly where our directory traversal skill went when we previously
touched on that.
Now that we have our bad PHP or a way to be able to browse that directory and
execute those files in a reverse.
Semi reverse shell remotely, we can invoke not.exe on the system from the Kali
box.
So inside of our Kali box, we go back to the bewap since we uploaded it down.
And also I want to point out to that I have burp suite open for this. You don't
have to. I'm just doing it from here is of course, happened at this point.
But you go into the images folder where the file was actually uploaded.
We go ahead and right here. I want to delete this out so that way we could get
a clearer picture of what's going on.
And then I'm going to zoom in for us. Be WAP.Test. Be WAP image is bad.PHP
equals command equals.
Now we know that this file is in the images folder because that's where we
actually uploaded it to and we verified it.
So really we don't have to do any more directory traversing back to our route.
You can just invoke it from here.
But remember we had to do a run as a administrator in order to do that on the
actual Windows 10 system itself. Will it work from here.
Let's look.
So I'm going to zoom out and then I'm going to type in
nop.exe and just hit enter and I want to point out to while I'm doing this, I
have an eye on the processing right here on the Windows 10 system. Keep an eye
on that.
So here we go back over. I'm going to press enter and we're taking a look and
would you look at that right above me.
The Windows 10 system is already started to eat up half of its processing power
.
I'm going to zoom in. It's going to pause it, but I'm going to zoom in on it so
you can see it better. Right there. Right at 50%. Well, there's a couple of
things to take away from this.
First and foremost, that is a command injection attack of the best kind.
We used IIS running as a system service account on the host system running as a
system slash administrator to invoke another command, meaning we have one
command and now another one inside of it.
In fact, we ran it three shells. The IIS service account running IIS bad.php
invoking that shell and then inside of it for that third layer.
Was the not.exe that we wrote and see on our Kelly box. So we delivered wrote
it, compiled it, delivered it and executed it on the actual target system, all
using command injection.
And this is where command injection can really get bad for us because in this
test environment is pretty easy for us to be able to trigger some of these
hacks against the system for practice.
And because we haven't really enabled all the safety devices and features on
our target systems. That's okay. We're still trying to learn.
But we do know that there is a way for us to be able to go in and send a system
into a fail state of whatever kind be it for a DOS attack or DOS attack.
All while using command injection and then we have to start looking through the
logs and getting into the ugly side of dissecting everything to really figure
out what's exactly going on with something like this occurs.