1

Our university teachers have given us a challenge and they will increase every student grades by 2 points if even one of us succeed.

The challenge : They have built a website using modern technologies (HTML5/JavaScript) and "all" we have to do is getting access to the database that is behind it and recovering a file in it.

Here is how I started :

  • Analyzed the source code of every accessible webpage of the site
  • Searched for interesting common directories (/admin, /phpmyadmin, /mysql ...) and found out that only "/admin" didn't redirect to a 404 page.
  • Tried the usual username/password combinations on "/admin" but it didn't work.
  • Tried to inject SQL doing test' or 1=1 -- and get the following error message

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'test\' or 1=1 --' at line 13

  • Noticed an HTML comment of a PHP command like this on the homepage once connected : <?php $_hidden = ['/administrator', '/action.php', '/upload.php', '/config']; ?>

So, I looked more in details at these pages and none of them redirects so it seemed I was on the good way :

  • /administrator is not the same as /admin
  • /action.php just prints a message "no action specified !"
  • /upload.php just prints a formular to select a file and upload it (might be a lure since it redirects to itself and we have to actually add the argument "?send=" manually to the URL to see the message "Thank you ! you can now open your file." but we don't know where...)
  • /config is a blank page but its source code contains some weird stuff (a php declaration that isn't in a HTML comment and that yet appears because of a previous XML error in the code) : <?php //config file define("admin_url", "c54370ec2966cd4f319f12d26f89a0f3a851891029b88326906abc6934463a2b"); ?>

I tried to decrypt what this thing meant by doing all sorts of HexTo... but it didn't returned anything at all ! Weird...

At this moment I decided to proceed differently : install Kali Linux on my machine and use its built in tools to find vulnerabilities.

  • nmap showed that the server on which the website is has almost every port closed :
    • these services are filtered : ssh, domain, microsoft-ds, mysql
    • these services are open : http?, tcpwrapped, imaps?, pop3s?
  • Vega revealed a "critical issue" : the access to /etc/passwd and /etc/shadow of the machine, here are the users and their hashed passwords

/etc/passwd

root:x:0:0:root:/root:/bin/bash sshd:x:108:65534::/var/run/sshd:/usr/sbin/nologin mysql:x:498:499:MySQL server:/var/lib/mysql:/bin/bash adrien:x:1000:1000:,,,:/home/adrien:/bin/bash marcus:x:1001:1001:,,,:/home/marcus:/bin/bash neo:x:1002:1002:,,,:/home/neo:/bin/bash morpheus:x:1003:1003:,,,:/home/morpheus:/bin/bash trinity:x:1004:1004:,,,:/home/trinity:/bin/bash mario:x:1005:1005:,,,:/home/mario:/bin/bash

/etc/shadow

root:$9$PijavijY12jvzn13auuva123nuizPOLakdiajC.plaBHbdhaOKsj/Plauscgfte/1N8nb/OKujcbyze913ndalka.:15716:0:99999:7::: sshd:*:15716:0:99999:7::: mysql:$6$ojeeijnYHAEFOkasA1CbyAna5oiZEOIJ4ZE.Yuhafk12caok138HjcaknBYCoaezf/Ojazyhva1E3EHiqsjaIJE.Pkjs.:16934:0:99999:7::: adrien:$9$Biyaldj12jualojzef12.paljsgYUHnokfbAYkjqs912bhuca12ndlau12byPLiaz/LjqCVcZnuePlayr12lcja09.NUaa.:16934:0:99999:7::: Marcus:$5$laUYECvnidvjuzv.PLvazebyusikciojez12uidvhijcbzaTGDZAj/LPauhvz12NYXHQSAjsga8U3jxa.Jpzz.:16934:0:99999:7::: Neo:$7$IuzefjoOKOIEFH.JAEyuekvnurpofjrzoij7nu.uefjze18423nu1368/LiazjCEjJzejapluvzebNU.Azed.:16934:0:99999:7::: Morpheus:$5$OKazhe123Enizdolxahd.huvzjPAuvzrnAEkqjfzebu12nE8ndfn8skhid/iejv13nudscvarvnuiNEZo123nuiqdc.Pmoo.:16934:0:99999:7::: Trinity:$5$DAiuvzjhadiujqdhs.DHaehezJjiuzhuiEABhusddsoiefnuiFZNIqlk/Ijgzeioj12nuivzej342nuiczPLiznuirefa.Apll.:16934:0:99999:7::: Mario:$5$IhihejNUEFJoqisjfbzeyvzdskjZNfj8fezh13njidncojfe.sqfnvriZujfzejjh12nicd8123njiJUdjcskvzNCIRZje/uhvzACQhjfds.Qsqs.:16934:0:99999:7:::

I thought, here's what I should do now :

  • Find out what these hashes hide for at least one user using "John the Ripper" program
  • Connect with his credentials using ssh
  • Access the database this way

After doing this I can say that I'm stuck. john can't decrypt it apparently because they where crypted using some algorithm he doesn't dispose of...

Do you have any suggestion to keep going ?

Thanks for reading and helping me !

closed as too broad by tim, kasperd, Anders, Dmitry Grigoryev, Steve Feb 6 '17 at 17:27

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 2
    I'm sorry, but I'm voting to close, as this is too broad and also asking us to attack a specific system. That being said, the login is obviously vulnerable to SQL injection ("You have an error in your SQL syntax") which will grant you access to the db (this is where I would start). There is also a directory traversal (the Vega result) which may grant you access to the db by reading out a file containing the credentials. I would also assume that the file upload will grant you a shell and that there are various other vulnerabilities (the action and config thing). Good luck. – tim Feb 4 '17 at 22:53
  • Try running the Kali utility sqlmap against the site; the fact that you got it to error is actually a good indication that it may be vulnerable. I'd also investigate action.php further as it likely wants input - possibly via a URL parameter, or via POST in which case you can send it via Postman Chrome extension. Combine it with upload.php and you may be able to upload and run an executable script that gives you shell access. – tlng05 Feb 4 '17 at 22:57
  • @tim I thought uploading a shell and using metasploit to get a tcp signal back, establishing the connection, but that's too hard at my level of studies, plus I don't think they would have wanted us to go this far. I suppose the true purpose of this exercise is to use SQL Injection but this far I haven't succedeed because they developed some kind of redirection (that redirects use to a troll page, they have a great sense of humor) when we use certain SQL injection syntax. I understand you're preoccupation but this is only in local domain and they asked us to be creative so here I am ! – Ellon Feb 4 '17 at 22:59
  • @Ellon You can use an interception proxy such as burp to capture a request and then manipulate and resend it multiple times, ignoring the redirect (this isn't necessary to exploit the SQL injection, but it will make it a lot easier and less time consuming). Then it's just a matter of figuring out how their filter works and bypassing it. – tim Feb 4 '17 at 23:04
  • @tlng05 The action.php page is litteraly void, I mean except that message, there is no trace of a formular in the source code or either of the fact that it's waiting for a certain GET parameter, which is weird since upload.php can use some GET send parameter apparently as mentionned previously. I'll return to this tomorrow morning and will keep you informed about the result of sqlmap. – Ellon Feb 4 '17 at 23:06
1

hackmyfortress.com (French security company) offers the same challenge (exactly all the same vulnerabilities you mentioned). The only difference is that if you access the file in the DB they don't reward you with 2 measly points on your grade but with 30 000$. Your teacher is a real scammer for taking advantage of his students like that ;)

EDIT: here is the link to the hackmyfortress challenge: http://hackmyfortress.com

Bait example : http://hackmyfortress.com/upload.php?../../etc/shadow

  • 1
    that's why he would increase every student grades by 2 points, get them all to want to be the hero of the class. that's some full metal jacket 2#!t right there. – J.A.K. Feb 5 '17 at 4:49
  • It's a duplicate. Our website doesn't have the same interface. But I see the idea, thanks for the link I'll check into it ! – Ellon Feb 5 '17 at 9:56
  • @Ellon SERAUM started the open challenge to prove that their solution is extremely robust, how could your teacher duplicate it unless he works for them and have access to their security solution? Unless he bought the solution for $$$$ which seems highly unlikely. Ask your teacher and let me know what's his answer.EDIT: FYI all the information you found was intentionally left their as a lure to make you believe you found something. A professional security company would never leave that their if those were real threats to the system. The breach is obviously not anywhere near those lures. – TryingHard Feb 5 '17 at 10:18
  • I have downvoted your answer. Firstly, because this is in no way an answer to the question. Secondly, because if there is 30 000$ to win, this isn't probably not the same difficulty as for the exercice gave by the teacher. Basically, you're telling that anyone giving hacking challenge is a scammer. – Xavier59 Feb 5 '17 at 12:50
  • "Secondly, because if there is 30 000$ to win, this isn't probably not the same difficulty as for the exercice gave by the teacher." Your comment makes no sense. Did you even read the question? Did you even read my response? Did you check the links? Did you make any research as to why the so-called teacher's exercise and the contest are exactly the same challenges? Didn't you understand that there is no teacher or exercise? " you're telling that anyone giving hacking challenge is a scammer." Where do I say that? I told the OP his teacher lied to him and that the teacher wants the reward. – TryingHard Feb 5 '17 at 13:22
0

Vega revealed a "critical issue" : the access to /etc/passwd and /etc/shadow of the machine, here are the users and their hashed passwords

Here is your solution ... if you have access to /etc/shadow then the webserver is running as root and has not been configured to restrict access to files outside of document root. For instance if you hit the server at http://<address>/ you will presented with index.html however you could try something like http://<address>/../../etc/passwd you can keep adding ../ till you hit it. Once you get the file then you know the relative location of file system root ... this will allow you to check for other things like:

  • http://<address>/../../root/.ssh/id_rsa
  • http://<address>/../../etc/mysql/my.cnf
  • To recap I've tried sqlmap that didn't return any kind of vulnerability on /admin /administrator /action.php /upload.php /upload.php?send= /config. Weird, especially considering the error message that appears when trying to do a simple SQL injection manually through the formular. So I tried some directory traversal, but again I can't find anything like a /root or a /mysql directory. I keep looking into it. – Ellon Feb 5 '17 at 10:01
  • Oh by the way I also tried writting a php file that contains a form with action="action.php" and 3 inputs named admin_url login password and tried to send them the value found in the /config page source code but nothing happened, I also tried to send them with GET parameters through the URL but again nothing... I'm really stuck right now, don't know what to do next. – Ellon Feb 5 '17 at 10:02
  • Well vega got the password file somehow, it might be worth looking into how exactly it did it. My first guess was directory traversal as explained above ... but its possible it did it through other means. IMO read through the exact message the tool gave you about the exploit and then read the vega documentation. – CaffeineAddiction Feb 5 '17 at 11:29

Not the answer you're looking for? Browse other questions tagged or ask your own question.