0

I'm doing a pentesting example on a web app and I have dumped all the database.

I have a table with the users in plaintext and the passwords hashed.

I have to find the admin's password (I know that it's possible because that is the example's final goal). But admin's password is hashed and cannot be reverse with any lookup table.

Could you please list all the ways via I could login as the admin? That is, what are the many ways I could find the admin's password?

There is a file upload vulnerability because I am able to upload a .php file, but calling system calls via PHP is avoided: "Unable to fork ecc..." so I don't think that uploading a shell is the way. But I will listen to all your suggestions.

The web server is IIS 7.5 and the DBMS is MySQL. Assume that there is no salt.

I hope I'm clear.

Thanks in advance.

Improve this question
6
  • 4
    Sounds like a challenge, and if you can't pass the challenge, then it looks like this test did its job.
    – rook
    Dec 10, 2013 at 23:20
  • I dont suppose social engineering is in scope for this pentest? If not, as mentioned above, run the dump through jtr or attack the web-app directly using injection, etc.
    – DawnFreeze
    Dec 11, 2013 at 0:31
  • You could clarify some things. "ways I could login as admin" and "ways I could find the admin's password" are two different things. Do you need to hand in the actual plaintext password of the admin or is it enough to log in as admin?
    – mcgyver5
    Dec 11, 2013 at 0:35
  • and list what you have tried: Which lookup tables did you try? Online ones? rockyou.txt or a larger one? What steps did you take to attack the hashes? What algorithm do you think is used to hash them?
    – mcgyver5
    Dec 11, 2013 at 0:38
  • Social engineering is not in scope and I know for sure that password cracking is not the way.
    – ibrahim87
    Dec 11, 2013 at 8:50

2 Answers 2

Reset to default
4

I have to find the admin's password (I know that it's possible because that is the example's final goal). But admin's password is hashed and cannot be reverse with any lookup table.

You can, however, find a hash collision that computes to the same value. Will it take a long time? Yes, but the amount of time may or may not be feasible, depending on the hashing algorithm used.

Could you please list all the ways via I could login as the admin? That is, what are the many ways I could find the admin's password?

Although they may not seem like it, these are different questions. For instance, if you find a string that hashes to the same (as described above), you won't have the password, but you'll have a password that works.

A more common approach is session stealing, in which you possess the identifier that is supposed to prove you are a user, but don't have the ability to log in as them once that session expires. This is fairly trivial to do any time sessions are transmitted over plaintext.

There are many different attacks you could try, but they depend quite a bit on the specific application - if you could do the same thing on every app, we'd just bundle it into a pentesting tool and cut out the person. It's impossible for us to give you any good advice without knowing the specifics of the app you're trying to break.

And the point of an exercise like this is to learn for yourself, neh?

Improve this answer
1
  • Interesting response, but what I want is retrieve in some way the admin's password in plaintext and not simply login as the admin stealing a session cookie. That is impossible because the example does not simulate other users browsing the site.
    – ibrahim87
    Dec 10, 2013 at 22:35
1

Use JohntheRipper or HashCat or some kind of password cracking software.

Feed in a password dictionary. The password dictionary is a list of LIKELY and COMMON passwords and usually some permutations of these.

Also give the program your hashes.

The program will iterate through the dictionary hashing each password in the dictionary, and comparing each hash to the list of hashes you dumped. If there is a match then the program will tell you.

This is called password cracking.

There are tons of dictionaries out there. rockyou. John. Cain. Just search for them using Google. These dictionaries are nothing special (not a .exe or a .bin or anything) just a .txt.

Happy Cracking

After re-reading your post...it is likely I misunderstood your situation.

You should also try a SQL injection on the login field. I don't want to ruin the hunt for you so I will only say this.

Try entering special MySQL characters and MySQL instructions into the username and/or password fields. See if you are able to get any nice error messages from the web-app. Also see if you can use special sql characters to bypass the web-app checking the password you enter..

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .