search

✅Jarvis (Medium)

hashtag
Lesson Learn

hashtag
Report-Penetration

Vulnerable Exploit: SQL Injection, LFI

System Vulnerable: 10.10.10.143

Vulnerability Explanation: The machine is vulnerable to SQL Injection which could allow us to query arbitrary data from databases and get credential to login on phpMyadmin. On phpMyadmin version is vulnerable to LFI which could allow us to execute command and gain initial access.

Privilege Escalation Vulnerability: Misconfigure privilege permission

Vulnerability Fix: Sanitize user input and least privilege

Severity: Critical

Step to Compromise the Host:

hashtag
Reconnaissance

hashtag
Enumeration

hashtag
Port 80 Apache httpd 2.4.25

Going through port 80, we just see a webpage. Viewing the source code but nothing is interesting.

Let run the gobuster to check if there any hidden directory as well as Nikto.

By click all the buttons on the webpage, there is only /room.php not static.

hashtag
SQL Injection (Mysql)

Once I have added ' to the end, it doesn't show anything.

I have tried UNION SELECT 1 but still the same. After adding from 1,2,3 to 7 it's just display.

Likely it's vulnerable to SQL Injection. By Comparing the parameter below, if it doesn't return to the original page, which mean something wrong. If it returns back to original page, which mean it vulnerable to SQL Injection.

We can assume SQL query like

As we can see the the Cost is in parameter 3. We can replace for testing.

We can refer to MySQL Cheat Sheet of PentestMonkeyarrow-up-right.

hashtag
Exploitation

hashtag
SQL Injection

Listing the DBs with group_concat() function will put all the value of different into one field.

Checking on other databases.

Now we have seen the username and password. Let save hash to a file and crack it if it's weak.

We can use hashcat to crack the hash.

Let try to login with credential that we got. It worked !

hashtag
SQL Load File

We can use function to load the files. We can load the room.php file to check source code.

Save the base64 code into a file and decode it back.

Seem like the code connect to database via connection.php file.

Let save the base64 code and decode it back on bash.

hashtag
Shell as www-data

Let enumerate on the phpadmin to figure out the version. Notice that it run on phpMyAdmin 4.8.0. Searching for public exploit of the version.

https://blog.vulnspy.com/2018/06/21/phpMyAdmin-4-8-x-Authorited-CLI-to-RCE/arrow-up-right

On exploit 44928.txt, it match with the blog post as It's vulnerable to LFI.

So let start the exploit process. Go to SQL to inject sql query.

Then, go to Storage > Cookies > phpMyAdmin > Copy the value.

Let grab php reverse shell, change the IP and port. Then start HTTP Server.

Let execute the sql query once again but this time we inject the download script.

Let perform LFI once again to execute our sql query.

Let start our netcat listener on port 4444 and go to execute the shell.php file.

hashtag
Privilege Escalation

hashtag
Shell as pepper

We are now on the machine, but we don't have permission to read the flag file.

Let check if there is any misconfigure on sudo -l.

hashtag
Auto script python

There are 3 functions we can use, Statistics, List the attackers IP, Ping an Attacker IP.

We can input IP with Ping function and its going to execute the command ping. There is filter which special character that forbidden. But we can use $(command) function to execute.

Let create a bash reverse shell into a file /tmp/shell.sh. Start our netcat on port 5555.

hashtag
Shell as root

Find the misconfigure of SUID.

hashtag
/bin/systemctl

Going through GTFOBinsarrow-up-right, we can perform privilege escalation by /bin/systemctl.

We can create a file with .service extension.

Let start our netcat listener on port 6666.

We cannot link the file on /tmp folder. Let move it to /home folder to link.

PreviousHaircut (Medium)NextMagic (Medium)

Last updated