Game Zone
SQLi Initial Foothold - Reverse SSH tunneling PrivEsc
Last updated
SQLi Initial Foothold - Reverse SSH tunneling PrivEsc
Last updated
Starting off with the nmap scan
The SSH service version doesn't seem to be vulnerable plus we don't have any valid credentials, So our only attack vector is port 80
Visiting the http service we get a login page
Tried some default credentials like admin:password, admininstrator:password and admin:admin - none of them worked !
Now our only option is to try some boolean based Sqli payloads such as ' or 2=2 --
Got redirected to another page called /portal.php
Since there was a space after my sqli payload => It confirms that the server in the backend is MySql
There is another input field, which considers the user input and select the game name directly from the DB => Which makes it more vulnerable to SQLi, Inorder to exploit this let's trick the DB by inserting few SQL queries
agent47 : ab5db915fc9cea6c78df88106c6500c57f2b52901ca6c0c6218f04122c3efd14
On cracking this password we get videogamer124 - Now let's login as agent47 via SSH
The escalation vector is only via the Reverse SSH tunneling concept, So what is it ?
Reverse SSH tunneling or Reverse SSH port forwarding specifies that the given port on the remote server host is to be forwarded to the given host and port on the local side
Why are we doing this ?
Let's assume if a site was blocked, we can forward the traffic to a server we own and view it via our localhost:<PORT>
Let's enumerate what are all the services running on the box using ss or netstat
We can see that a service running on port 10000 is blocked via a firewall rule from the outside, Using an SSH Tunnel we can expose the port to us locally !
Visiting our localhost:10000 gave us a Webmin portal - Tried agent47's credentials and we get in !
We find the version for this webmin interface - Tried searching for some public exploits and luckily we had a metasploit one
Set the options and run the exploit to get R00T :)
