1

I was pen testing an Unix web server for a challenge. I need to get root/shell access to the server & have got stuck at a point for quite a while now.

I have access to the web admin console but have not been able to find any RFI vulnerabilities.

Also I have gained access to the mysql database but the remote user does not have any file privileges, nor has permissions on the mysql database(has access to the application database only). The root user has no password set, but access is given only to localhost.

So, I am pretty much stuck at this point. Can anyone provide any ideas how to proceed next?

| improve this question | |
  • 1
    Have you gotten a shell yet? – Henry F Dec 16 '16 at 1:15
  • 1
    Your title says 'escalation' but your question seems to be about getting a shell. You don't provide enough information to help us answer your question. – schroeder♦ Dec 16 '16 at 7:59
  • @John: No I don't have a shell yet – Neel Dec 19 '16 at 0:43
  • @schroeder: Thanks for pointing out the error. I have updated the title. Also there are so many details, if I posted them all the question would become very large. Please let me know the information that should be provided so that I can update the question. – Neel Dec 19 '16 at 0:44
  • @Neel That's kind of the point. Without more specific details, this question is too broad. If you can narrow down the problem, we might be able to help. – schroeder♦ Dec 19 '16 at 7:27
2

Can you launch commands in a shell even with standard user privileges? Look what kernel has with uname -r. Maybe is vulnerable to Dirty Cow exploit, affected kernels. Or maybe you can use the old Semtex exploit. Always should be a directory to write... check for /tmp.

If you have access to the mysql, you can launch system commands from there using \!. Check this out.

The post-exploitation is more difficult sometimes than the first intrussion! Be imaginative. Here are a lot of useful commands. Good luck!

| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.