0

I was pen testing an Unix web server for a challenge. I need to get root/shell access to the server & have got stuck at a point for quite a while now.

I have access to the web admin console but have not been able to find any RFI vulnerabilities.

Also I have gained access to the mysql database but the remote user does not have any file privileges, nor has permissions on the mysql database(has access to the application database only). The root user has no password set, but access is given only to localhost.

So, I am pretty much stuck at this point. Can anyone provide any ideas how to proceed next?

|improve this question

closed as too broad by Anders, S.L. Barth, schroeder♦ Dec 16 '16 at 7:59

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    Have you gotten a shell yet? – Henry F Dec 16 '16 at 1:15
  • 1
    Your title says 'escalation' but your question seems to be about getting a shell. You don't provide enough information to help us answer your question. – schroeder♦ Dec 16 '16 at 7:59
  • @John: No I don't have a shell yet – Neel Dec 19 '16 at 0:43
  • @schroeder: Thanks for pointing out the error. I have updated the title. Also there are so many details, if I posted them all the question would become very large. Please let me know the information that should be provided so that I can update the question. – Neel Dec 19 '16 at 0:44
  • @Neel That's kind of the point. Without more specific details, this question is too broad. If you can narrow down the problem, we might be able to help. – schroeder♦ Dec 19 '16 at 7:27
1

Can you launch commands in a shell even with standard user privileges? Look what kernel has with uname -r. Maybe is vulnerable to Dirty Cow exploit, affected kernels. Or maybe you can use the old Semtex exploit. Always should be a directory to write... check for /tmp.

If you have access to the mysql, you can launch system commands from there using \!. Check this out.

The post-exploitation is more difficult sometimes than the first intrussion! Be imaginative. Here are a lot of useful commands. Good luck!

|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.