# SQL Injection 101

{% embed url="https://app.cyberranges.com/scenario/59bb8cec8b68ef17d2962512" %}

**Classificação** : Fácil

**Criador** : Pentester Lab

**Ferramentas** : nmap, sqlmap

**Missão:** Este desafio exige que você aproveite uma vulnerabilidade de injeção de SQL para obter acesso ao console de administração e executar comandos do sistema.



**Enumeração**

Começamos por enumerar a máquina com o `nmap`

<figure><img src="https://4024756925-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FZbLrq3t9Su3CqGmkXz7o%2Fuploads%2FIjCjPtRfTe5fK5U2QVAc%2Fimage.png?alt=media&#x26;token=adaec564-31ab-4dbf-ad01-824322c727ee" alt=""><figcaption></figcaption></figure>

Visitando a porta 80, notamos que existe um site hospedado

<figure><img src="https://4024756925-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FZbLrq3t9Su3CqGmkXz7o%2Fuploads%2FteZJkPMdIA60KcCfLs88%2Fimage.png?alt=media&#x26;token=43c49412-9617-48f5-a7a3-362b0e9ce3fb" alt=""><figcaption></figcaption></figure>

O site é vulneravel ao sqli

<figure><img src="https://4024756925-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FZbLrq3t9Su3CqGmkXz7o%2Fuploads%2FINEbQjYqhV79mx8oQwzI%2Fimage.png?alt=media&#x26;token=30859d5a-b736-40bd-8974-2afe1d131ddb" alt=""><figcaption></figcaption></figure>

Usamos o sqlmap para enumerar as bases de dados existentes&#x20;

```
sqlmap -u http://192.168.125.150/cat.php?id=1 --dbs
```

<figure><img src="https://4024756925-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FZbLrq3t9Su3CqGmkXz7o%2Fuploads%2FwPhi7md2jlsdogaVl0nd%2Fimage.png?alt=media&#x26;token=f0881985-b65d-48c5-b722-26d2c5916b20" alt=""><figcaption></figcaption></figure>

Vamos despejar todas as entradas de tabelas de bancos de dados DBMS

```
sqlmap -u http://192.168.125.150/cat.php?id=1 -D photoblog --dump-all
```

<figure><img src="https://4024756925-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FZbLrq3t9Su3CqGmkXz7o%2Fuploads%2Far9HVudcSm26RoUgV8fq%2Fimage.png?alt=media&#x26;token=a16997ad-18d7-4ea3-bfe5-c0799a2eaf68" alt=""><figcaption></figcaption></figure>

Fizemos login com as credenciais encontradas, e descobrimos que é possivel carregar um arquivo png, vamos tentar carregar um shell

<figure><img src="https://4024756925-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FZbLrq3t9Su3CqGmkXz7o%2Fuploads%2FAvtJ2qyEeIL7UOmiYU53%2Fimage.png?alt=media&#x26;token=c7455bb0-dbf6-44e6-b302-261edc7cfaf6" alt=""><figcaption></figcaption></figure>

#### Exploração

Usamos [Reverse-shell.php](https://github.com/pentestmonkey/php-reverse-shell/blob/master/php-reverse-shell.php), fizemos algumas alterações

<figure><img src="https://4024756925-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FZbLrq3t9Su3CqGmkXz7o%2Fuploads%2FTGvZfMAC6cuW3ZulKbbk%2Fimage.png?alt=media&#x26;token=39df7df0-e16b-493d-9e44-c0f750125a14" alt=""><figcaption></figcaption></figure>

Quando tentamos fazer o upload do arquivo, recebemos um erro de extensão, neste caso, vamos tentar bypassar isso

<figure><img src="https://4024756925-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FZbLrq3t9Su3CqGmkXz7o%2Fuploads%2FWopLI4AvLxNuhYgcUo9g%2Fimage.png?alt=media&#x26;token=3b877189-4395-4bb1-a6e4-ad1a82f352ff" alt=""><figcaption></figcaption></figure>

Após mudarmos a extensão do arquivo, conseguimos carregá-lo

<figure><img src="https://4024756925-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FZbLrq3t9Su3CqGmkXz7o%2Fuploads%2FJAYIk05J1FB9X0k2WOkW%2Fimage.png?alt=media&#x26;token=1a9c436e-2822-4ca0-bc9a-ea1ab92ce71c" alt=""><figcaption></figcaption></figure>

Após carregarmos o aquivo, recebemos o shell reverso em nossa máquina

<figure><img src="https://4024756925-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FZbLrq3t9Su3CqGmkXz7o%2Fuploads%2Fgrd2Q7PRiSUg8f3dn2MH%2Fimage.png?alt=media&#x26;token=63dc031c-3153-4382-8d86-95c41116c43e" alt=""><figcaption></figcaption></figure>
