I'm doing a pentesting example on a web app and I have dumped all the database.
I have a table with the users in plaintext and the passwords hashed.
I have to find the admin's password (I know that it's possible because that is the example's final goal). But admin's password is hashed and cannot be reverse with any lookup table.
Could you please list all the ways via I could login as the admin? That is, what are the many ways I could find the admin's password?
There is a file upload vulnerability because I am able to upload a .php file, but calling system calls via PHP is avoided: "Unable to fork ecc..." so I don't think that uploading a shell is the way. But I will listen to all your suggestions.
The web server is IIS 7.5 and the DBMS is MySQL. Assume that there is no salt.
I hope I'm clear.
Thanks in advance.