HackMyVM - Shop

 

Shop by D4t4s3c is classiefied as easy, like most machines they are easy if you know how to do it and not so easy if you don't. If you have not seen blind SQL injection before then its not that easy!

Find it

Scan it

So just http(80) and ssh on a high port available.

User

running nikto -h http://10.0.0.22 identified /shop as interesting and again running it against the /shop url point to the way forward with /shop/administrator/

The login page can be manipulated with time based SQL injection.
trying different SQL options for the username 
' or sleep(5)--
and anything in th password field

When executed on the server this changes the SQL query from
Select something from table where user='username' AND password='password'
to
select something from table where user='' or sleep(5)-- everything else is commented out !

So as we cant see the results of anything what we need is a tool to automate blind SQL.
https://sqlmap.org/
Install with sudo apt-get sqlmap or read the manual on the website!

There is probably a quick way to do this but...

sqlmap -u http://10.0.0.22/shop/administrator/ --forms --current-db --dump  

The script asks a bunch of questions but changes the default answer to the most common response (capitalised letter) so just hitting return and seeing what happens works happily!
It tries all the combinations of queries to get data out a char at a time. so its not quick.

After about 8 minutes...

4 accounts and trial and error and we can logon as bart

Escalate to root

I like to run linpeas.sh on a target as it give a good overall scan and the more you look at the outputs of it the more you notice what is normal or out of place.

In the output it does identify that root is running php on port 65000 and serving from /dev/shm

So just stick a reverse shell command in there and call it. I keep and tend to use a reverse shell file from:
php-reverse-shell | pentestmonkey