Download the VM and start it. It has a web application hosted which is configured to boot at start so you can put the VM in the background. Simply find the address of the application and start pentesting.
Challenge Goal : Find the file flag.txt and read its content.
First we start by finding the IP of machine here i used the netdiscover command.
ID, Name, Roll, Marks it looks like it is fetching this data from sql database so lets try SQL injection.
this POST request have data=NjIxNzI5NTgx it base64 encoded value of 621729581.
lets try with simple payload ' OR 1=1 # but it is not working after few tries i tried 621729581 OR 1=1 base64 encode and it gives us all the entries hooray, and that is successful SQL injection.
payload=
data=<@base64>621729581 OR 1=1<@/base64>
<-- I'm using Hackvertor burp extension.
we know the number of columns it is 4 : ID, Name, Roll, Marks.So the payload for union attack would be:
payload:
data=<@base64>621729581 UNION SELECT NULL, NULL, NULL, NULL<@/base64>
It gives us the result in response so payload is correct and we also know the data types it should be Integer for ID, Roll, Marks and String for Name so we can put this values in payload.
payload:
data=<@base64>621729581 UNION SELECT 1, "name", 2, 3<@/base64>
response:
Now we can try to extract the databases'name, tables'name, columns'name.
so we can only upload jpg file but how it is checking for file type extension? let's do one experiment rename the jpg file to php if error it is looking for extension and if successful it is checking MIME type.
Record updated successfullyThe file has been uploaded
so MIME type it is.
We have to create polyglot PHP/JPG payload. how i do it is open jpg file and append php payload at last so let's create simple.php payload.
Record updated successfullyThe file has been uploaded and file is uploaded successfully but where ?
we have column name profile_picture in users table, if you remember that we still have SQLi.
payload=
data=<@base64>621729581 UNION SELECT 1, gRoUp_cOncaT(0x7c,profile_picture,0x7c), 2, 3 fRoM users<@/base64>
result = |../assets/uploads/simple.php|
so our file is at http://192.168.1.21:42710/assets/uploads/simple.php
We have shell but we can't access /home/heathrow we need to escalate our privilege. first thing that comes in mind is linpeas.sh let's move that to victim machine i create local server with python python -m http.server 80, to transfer file because we normally don't have internet access in victim machine.
change permissions to +x : chmod +x linpeas.sh
Now run the file: ./linpeas.sh
Analyzing the output we have first suggestion for [CVE-2022-0847] DirtyPipe:
