Our university teachers have given us a challenge and they will increase every student grades by 2 points if even one of us succeed.
Here is how I started :
- Analyzed the source code of every accessible webpage of the site
- Searched for interesting common directories (/admin, /phpmyadmin, /mysql ...) and found out that only "/admin" didn't redirect to a 404 page.
- Tried the usual username/password combinations on "/admin" but it didn't work.
- Tried to inject SQL doing
test' or 1=1 --and get the following error message
You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'test\' or 1=1 --' at line 13
- Noticed an HTML comment of a PHP command like this on the homepage once connected :
<?php $_hidden = ['/administrator', '/action.php', '/upload.php', '/config']; ?>
So, I looked more in details at these pages and none of them redirects so it seemed I was on the good way :
- /administrator is not the same as /admin
- /action.php just prints a message "no action specified !"
- /upload.php just prints a formular to select a file and upload it (might be a lure since it redirects to itself and we have to actually add the argument "?send=" manually to the URL to see the message "Thank you ! you can now open your file." but we don't know where...)
- /config is a blank page but its source code contains some weird stuff (a php declaration that isn't in a HTML comment and that yet appears because of a previous XML error in the code) :
<?php //config file define("admin_url", "c54370ec2966cd4f319f12d26f89a0f3a851891029b88326906abc6934463a2b"); ?>
I tried to decrypt what this thing meant by doing all sorts of HexTo... but it didn't returned anything at all ! Weird...
At this moment I decided to proceed differently : install Kali Linux on my machine and use its built in tools to find vulnerabilities.
- nmap showed that the server on which the website is has almost every port closed :
- these services are filtered : ssh, domain, microsoft-ds, mysql
- these services are open : http?, tcpwrapped, imaps?, pop3s?
- Vega revealed a "critical issue" : the access to /etc/passwd and /etc/shadow of the machine, here are the users and their hashed passwords
I thought, here's what I should do now :
- Find out what these hashes hide for at least one user using "John the Ripper" program
- Connect with his credentials using ssh
- Access the database this way
After doing this I can say that I'm stuck. john can't decrypt it apparently because they where crypted using some algorithm he doesn't dispose of...
Do you have any suggestion to keep going ?
Thanks for reading and helping me !