1
00:00:02,090 --> 00:00:06,440
‫So in the previous lesson, we performed a basic Ossy command injection example.

2
00:00:08,430 --> 00:00:14,250
‫Now, from the very first point to a reverse shell, we've done everything manually.

3
00:00:15,230 --> 00:00:21,440
‫And now, if you're new to this field or even if you're an experienced veteran, sooner or later you're

4
00:00:21,440 --> 00:00:23,750
‫going to want to automate what you do.

5
00:00:25,800 --> 00:00:30,240
‫So you can use tools or code your own.

6
00:00:31,760 --> 00:00:36,230
‫So on this question, I want to use the tool comics for the command injection.

7
00:00:37,150 --> 00:00:39,550
‫Comics actually ships with Karlie.

8
00:00:40,820 --> 00:00:42,560
‫And this is the latest version.

9
00:00:44,850 --> 00:00:52,680
‫However, I couldn't run it due to a bug and I didn't even get to fix the bugs, so instead of using

10
00:00:52,680 --> 00:00:55,050
‫this version, I'm going to use a previous version.

11
00:00:56,720 --> 00:01:02,090
‫So it's a long way around, just showing you that I will go to its GitHub page.

12
00:01:04,320 --> 00:01:07,830
‫And you see under the releases, you're going to see different releases.

13
00:01:08,520 --> 00:01:09,930
‫So I'm just going to download this one.

14
00:01:12,300 --> 00:01:14,520
‫All download the source code and save it.

15
00:01:17,790 --> 00:01:19,350
‫And go to the download folder.

16
00:01:21,160 --> 00:01:22,390
‫Extract the files.

17
00:01:24,470 --> 00:01:26,480
‫OK, so now I'm going to go back to the terminal.

18
00:01:27,460 --> 00:01:29,350
‫And go to that directory.

19
00:01:31,330 --> 00:01:33,190
‫All right, so here are the files.

20
00:01:34,270 --> 00:01:40,360
‫And you can run it directly from here, show options by specifying the H parameter.

21
00:01:42,250 --> 00:01:43,540
‫It has many options.

22
00:01:44,850 --> 00:01:51,810
‫You can test everyone if you like, but I'm going to go on, so go to Firefox's.

23
00:01:53,050 --> 00:01:54,580
‫And send the traffic to berp.

24
00:01:56,720 --> 00:01:58,100
‫We're going to look up.

25
00:02:01,090 --> 00:02:04,240
‫Now, copy this request to a file.

26
00:02:05,720 --> 00:02:08,450
‫And name it, whatever you want to and save.

27
00:02:10,240 --> 00:02:11,830
‫Then let there Cresco.

28
00:02:14,740 --> 00:02:18,580
‫Now we have nothing with Bourbon Firefox.

29
00:02:20,240 --> 00:02:22,400
‫So let's use comix.

30
00:02:24,040 --> 00:02:33,340
‫So type comics dot p y dash r to specify the file that we saved P is for the parameter and the request

31
00:02:33,340 --> 00:02:33,970
‫to test.

32
00:02:34,900 --> 00:02:39,760
‫And all to test and check for everything Comics' tests.

33
00:02:41,460 --> 00:02:42,360
‫And hit enter.

34
00:02:44,170 --> 00:02:45,250
‫So it gets something.

35
00:02:47,040 --> 00:02:50,700
‫OK, I'm not alone, Comics' also displays a password file first.

36
00:02:52,550 --> 00:02:55,850
‫Now, it also enumerates this system in detail.

37
00:02:57,490 --> 00:03:04,330
‫And below, it asks to open a shell style interface, so of course, I hit enter to accept.

38
00:03:06,130 --> 00:03:09,430
‫And this is the comics style, Shel.

39
00:03:10,880 --> 00:03:12,860
‫So now you can run those commands from here.

40
00:03:14,080 --> 00:03:15,420
‫Your name, Dashi.

41
00:03:18,260 --> 00:03:18,920
‫EDD.

42
00:03:21,880 --> 00:03:25,770
‫And comics can also create a reverse shell for us.

43
00:03:27,030 --> 00:03:29,040
‫So type in reverse, TCP.

44
00:03:31,370 --> 00:03:34,340
‫Now, you may recall Métis Point.

45
00:03:36,020 --> 00:03:41,150
‫OK, so set the localhost to the IP address of your Caleigh.

46
00:03:43,580 --> 00:03:48,350
‫And then set the local port on Kalani to listen for the river, his connection.

47
00:03:50,040 --> 00:03:52,970
‫I'm going to say four, four, four, five.

48
00:03:55,030 --> 00:03:57,940
‫And now you must choose which type of shell you want.

49
00:03:58,980 --> 00:04:04,680
‫And let's see, we've already done the net cat style shell, so choose to.

50
00:04:06,760 --> 00:04:14,950
‫Now, you must choose which type of reverse TCP shell, so I'm going to say eight and it will generate

51
00:04:14,950 --> 00:04:15,880
‫the payload for us.

52
00:04:17,510 --> 00:04:20,210
‫And then create a medical resource file.

53
00:04:21,600 --> 00:04:23,880
‫All right, so I'm going to just put the window.

54
00:04:24,980 --> 00:04:27,140
‫Then copy the resource file.

55
00:04:28,090 --> 00:04:31,360
‫And paste it in here and add a Q.

56
00:04:32,230 --> 00:04:36,220
‫For the parameter to start Métis boite in quiet mode.

57
00:04:38,090 --> 00:04:39,320
‫Then hit enter.

58
00:04:41,090 --> 00:04:45,290
‫Now, the U.S. file creates a multi handler with his options.

59
00:04:46,140 --> 00:04:47,640
‫And then exploit.

60
00:04:48,750 --> 00:04:54,450
‫So that way that generated reverse TCP payload on B box connects to the handler and Kelly.

61
00:04:56,220 --> 00:04:58,320
‫And the interpreter session is open.

62
00:04:59,440 --> 00:05:01,000
‫So type this info.

63
00:05:03,060 --> 00:05:07,860
‫And this command shows a short view of the system and the session information.

64
00:05:09,410 --> 00:05:13,310
‫And get Eweida for the user of the session.

65
00:05:14,990 --> 00:05:20,840
‫Now you can run your post modules or do some privilege escalations on the system, that's entirely up

66
00:05:20,840 --> 00:05:21,950
‫to you, whatever you want.

67
00:05:23,180 --> 00:05:24,950
‫Oh, and one last thing.

68
00:05:26,290 --> 00:05:35,080
‫So as I observe this shell, it's not as consistent as a Boyte reverse DCP shells, so.

69
00:05:36,160 --> 00:05:41,400
‫I don't know why this would be, but in your system, it may indeed still be different.