Everybody and welcome to the next video.
So in last video we talked about the lost top 10 so in this video we're gonna be talking about using
sequel map as well as manually attacking sequel injection.
Now we've talked about sequel before in previous videos where in this case we're looking at the Structured
Query Language so we're gonna be interfacing with the database.
Now it's important I understand here is sequel injection is not a configuration on the database per
say but it's on configuration on the web application that's actually causing an issue so what I want
to do is first explain how sequel injection works and what it looks like behind the scenes right.
So when we open up a text idea here let's say in we have our our script right we'll do this in Python
just cause you guys are familiar with the syntax at this point.
Now let's say we have a query right.
So query so this query is set to select a first name last name from let's say users from the table users
where I.D. is equal to user input.
Right.
So if we grab this we do user input so we can see here what we're doing is we're taking user input and
directly adding it into this Ideas section.
Now since this query is on its own you might not think anything of it.
However because we're not taking this user input and removing any quotes or any type of query language
like for example we're expecting a digit here a one two three but if we were to do if we did user input
and let's assume that we got this from the user already.
So from the web app if we put in a single quote or a one we'll give it our digits digit and then a single
quote and then doing drop all not drop all let's do let's see order by one hashtag.
Right.
So what this is going to do is make the final query look like this this copy and paste actually
this is what the final query looks like.
Normally when someone actually presents the regular digit.
However when we add this into the mix this is what the query looks like now.
So you can see here we've with our query in our user input which is just this we've closed off the quote
which completes the where idea goes to 1 ordering by so we're executing more sequel statements and because
we've got a quote or maybe there's more to this query words maybe it's not just ideas one but and username
is equal to know test.
Right.
So if that's the case this part right here would be single quotes but this part right here would come
into play after this.
I'm sorry not right there.
It would be
but you can see here because of this this is a this is a comment and sequel.
So it basically means ignore all this.
So what you're doing here is you're taking advantage of it just dumping the text into a query and then
we can do whatever you want we can drop dead.
We can drop the entire database.
We can remove stuff modify stuff.
Select users.
We can do a lot of different things.
But I want you to get an understanding of what this is and what's going on behind the scenes before
we actually go into sequel injection.
Now if this doesn't make too much sense I'll leave a few other different tutorial links above the videos
so you can check out a few different ways that people have explained this.
So for now we're gonna go in close that and we do not need to save it.
So what we're gonna be using for some of these test examples is something called DV W.A. or damn vulnerable
web app.
Now feel free to install this you can install us on.
You can install this on Windows Linux doesn't matter it's just a web application that sits on top of
the patchy with PSP and a my sequel back and I'll leave it to Oliva tutorial link to instruct to installing
this on Cally about the video as well so you guys can play along with this and get familiar and go through
the process.
So looking at that we put in user I.D. one we can see here and we submit it.
We can see our ideas one and we got her some some information right.
So if we give it to we get some more information so it looks like it's interfacing with the database
in some way shape or form.
Now what's important here is that you are up you can see I.D. is equal to whatever so user I.D. I took
equal to two right now.
So if I go on changes to one and launch it we get our different answer.
Now what happens if we do one and our karma like we did before.
What happens then.
So interesting.
So we can see that because the query we finished the comma at the end or the quote at the end technically
as far as if we looked at the.
If you rewind back a little bit you'll see that our query that we made in the text document to showing
you how it works there's still an extra comma in there or an extra quote in there.
So what's gonna happen is it's going to fail.
So you can see here we've got our original quote Our one the quote we added and then some random quote
at the end.
So because of that we can see that we now have an issue so that the syntax is no longer correct you
can't have one quote without a closing one.
So we can also take a second and see this as a Mario DV.
So we can know how we can structure our secret queries accordingly.
Some some sequel databases or databases in general don't use the same exact query language for each
thing.
So because of this we can see we get a syntax error a single syntax error.
Now this is important because this tells us that we've injected some user input from us nuns it's not
sanitized so it's not taking into account that we're removing dashes any special characters.
It's not filtering that stuff out so this is unsanitary user input going into a query that's being sent
to a database and this is very dangerous from web apps perspective.
So just that simple comma at the end broke the web app.
So we're now able to use this to our advantage and try to find out a little bit more information and
maybe get some usernames passwords et cetera and maybe even compromised the server directly just from
that simple this simple error message showing us.
But what's interesting here is for us to be able to interface and grab information from the server we
need to be able to find out what the structure of the table is that we're actually using.
So we're we're actually pointing in the secret query to a certain table and that part's important because
when sequel injection you have to let the first part of the query complete then you can go on with the
rest which is why we leave a one here and we close it with us with a quote because that clue completes
the whole query from the initial standpoint but we need to inject stuff after that that we want to actually
use.
So the quickest way for us to figure out first we need to know is how many columns are in this database
and are in this table that we're working with because we need to be able to provide it all columns when
we're trying to pull data from it which will make more sense in a little bit.
So if we keep the same structure in here and we do order by 1 and then we go ahead and cancel out the
rest of the query.
If we run this now we see that nothing happened.
That's great.
That means we have at least one column to work with.
But based on our initial searches here we can see that there's at least at least two columns depending.
This may or may not be a column.
It probably is but let's say this is just showing us all of our columns.
So we can assume that there's at least three columns.
So if we do two columns and we get nothing.
So that means it's correct.
So if we get three nothing.
Perfect.
So my assumption is based on what it's showing us there's there's two things here.
It's either going to show you all the information or they're going to show you specific parts in most
web applications we're not going to show you the whole table information in this app.
It is because it's for testing and checking for and using and testing for the vulnerability to show
you how it works.
But in a general sense it might only show you new the first name.
Right.
So if we go to four we see that we get a we get nothing here.
Right.
So if we go to five OK.
So while we're at three we'll go ahead and use the actual thing here.
That's going to convert some of the characters for us.
So if we go to three OK.
So we see we get a clause three.
So let's go back to two just to make sure perfect.
So we can see we have two but it fails on three.
Right so that tells me that there are two columns in this database.
There are first name and surname in this particular table.
Not database table.
So this is what this means we have to to work with.
Right.
So what we need to do here next is try to find out what the databases.
So what what database are we currently working with.
So we could try to find out a little bit more about it.
So what we can do here is we can change this to
a union select and then we can use the function database in sequel with no as the last parameter.
And then we're gonna close the quote.
So what's happening here is we're closing we're getting at the one in them or closing the quote just
like normal and then union selects just a way for us to join information from.
So we're actually executing another query and then we're using a union type join in sequel to be able
to join it to the same output.
So essentially it's tacking it onto the end.
So it's we're running our first query which is here we ran our first query and we completed it.
So we should get whatever our ideas go to one.
So in this case admin admin then we're doing a separate join no issuing a search.
So we're doing select database so whatever the current database is in the first column.
So that's important we have two columns to work with based on our order by two was not failing the order
by three was.
So we need to use two columns.
So we you're going to store the data in the first column and we're going to pass null for the rest but
we still need to we still need to close the query and ignore everything after it.
So if we go ahead and run this we can see here we've got our first answer right.
We've got our first are ideas 1.
However if you look down here in our first column where we did database databases we could see DV W.A.
which is indeed the database that we're going to be working with.
So right now we've enumerated the databases that are present so we can take this a step further once
we have the database we need to be able to find out more about the tables.
So we could do this using a very simple way as well.
We can do we still need it when you still need to complete our query next we can do our union select
now what we're gonna do is we're gonna select something specific we're gonna select table name and null
as our second parameter but our query isn't done here.
So if we what we want to do is we want to select this from a particular table.
So we're selecting this data from a specific table.
Now what's important here is in sequel or in a database there's information schema that provides information
about the tables and columns for a database.
So to do this we're going to do from information schema tables where table schema is equal to DV go
away.
And I'm going to go in and close it out.
So I'm actually bringing this out and copy that all open up leaf pad so you guys can see exactly what
I'm typing so closing it.
Didn't select we're grabbing the table name from this particular table which holds the tables for a
particular database.
So where the table schema is from this database.
Right so if we go ahead and run that
we can see we get it quite a bit.
We get our standard one which is our idea of one but then we get guestbook and users.
So this tells me that we have a user's table which might contain passwords.
So let's focus a little bit more on the user's table.
Right.
So if we take the same query that we were working with before we want to grab our column name.
So to do that we have to do something very similar to that column name know from information schema
columns this time where table name is equal to users.
So all we're doing is we're using information schema again instead of tables we're using the columns
and we're wanting to look at the table users.
So this is going to provide us our columns so we can know what we need to search for even further.
So if we take a look at this perfect we can see we get our idea of one just like normal.
Then we get our user I.D. first name last name user password which is that's interesting we want to
use that an avatar for an image.
Last log in failed log in.
How many connections total connections.
OK.
So we get to a little bit more information than we had before.
Right.
So what we're gonna want to do here is very simply select all the users and their password from the
user's table which we've already done with union so again if we do unions select user name or user and
password or grabbing user ID password from users that's it.
That's as simple as it is.
We go ahead and run that
boom.
Now we've got our admin.
We've got our empty five hash it looks like got a user empty five leet empty five Pablo and five Smithy.
So now we can take these launch these into a password cracker such as John the Ripper or anything else.
And then from that we can actually go ahead and gain access if it cracks the password we can use that
to log into this web app as admin.
So this is a really interesting way to pull hashes.
So in some cases this injection might not be in an authenticated way.
So you might be using just a regular part of the web app and not actually logged in as a user.
In this case we're logged in as admin because it's a it's a security testing tool and everything's built
behind that first log in.
So keep that in mind in this example.
However for real examples in the real world you might not even need to log into a web app to be able
to exploit something like this.
So using this allows you to grab the admin hash and if you can crack it you can log in to admin on that
specific whether but what I want to show you guys next in this video is something called school map
which basically takes all of what we just did and completely automates it.
But I wanted you guys to understand what happens behind the scenes and I definitely want you to spend
time after you build a DB W.A. host and test this out and make sure you fully understand cause there's
sometimes an automated tools not going to find everything like you talked about before but for our tool
we're going to need the cookies in the log in information from the site because remember we're behind
a log in.
So in this particular case we need it.
But in other cases we want so for us we're gonna go ahead and grab this.
This session information right so let's go ahead and open this up so there's something called sequence.
Dash age so school map provides a lot of information and a lot of different things we can work with.
Right so we'll go ahead and run that one more time perfect so we can see if we can grab everything from
the database the current user passwords columns we can spawn an interactive shell we can batch things
out we can tamper with different things we can do different you or else be more verbose.
So it's a very interesting tool and it's very useful.
So give us an example of this we'll do the same attack that we just did.
Right.
So if you see a map dash you will grab you are all in a second but we need dash dash cookie.
And the reason we need the cookie is because everything in you are all that we're working with is actually
behind you.
Or it's behind the log.
And so we're going to pass the session ideas so we can work with it.
So let's go ahead and grab the we'll do we'll just grab the one so we'll assume no injection has happened.
Right.
Gordon copy this.
And we'll paste it so we can see here right now.
If we ran this it would start to try to identify which parameters in the URL that we can inject in.
In this case I.D. but we're not going to do that because that takes a little bit of time testing a whole
bunch of different things and it tries to pull everything at once.
But we want to do is find our current database that we're working with.
So dash dash current dash.
So if we go ahead run this.
Oh no I misspelled that to our current what's gonna happen here.
It's gonna go ahead and start em.
If we look a little bit down here we see current databases DV way.
That's perfect.
That's what we want.
So let's take a look at that.
So if we do dash capital D that's mentioning what database we want to look at.
So DV W like then we're going to grab we wanna grab the tables so dash dash tables
and pump that guestbook in users which is exactly what we saw before so taking this a step further we
can keep the tables and do dash T for the table that we want to work with and that's users then we're
gonna dash dash you guessed it columns.
So this is gonna give us all the columns that we have to work with so we can see we've got user avatar
failed log in password user I.D. last long last name.
So again we have the same thing but what we're gonna want to do now is do dash dash.
So this is going to do is it's going to try to dump all of the password hashes so you can see it does
everything from the table so we can see these hashes are exactly what we expected to see before.
But what's interesting is SQL map actually tells us do you want to store the hashes to a temporary file
for further processing.
We're gonna say yes.
Do you want to crack this.
Hell yeah we do.
And that's it.
It goes ahead and launches a dictionary attack using empty Ford.
And if it happens to be in a dictionary it goes ahead and cracks it.
So we can see here that the admin password is password.
Interesting.
Gordon's password is ABC one two three lead is Charlie.
Pablo is let me in and Smith is password so you can see now we've got our passwords to log into the
web.
So if we logged out of admin and logged in as 1 3 3 7 with password Charlie it would let us in.
So this is really good information.
It works pretty well.
It gave us the same information with a quarter of the time but it's also important to understand how
it works.
But what I want to do is take this one step further so you can understand the full length of what sequel
injection is actually capable of.
Now we're going to clear this out and we're going to clear out all of this.
So what I want you guys to do is do dash dash a less dash shell.
Now this is going to do is it's going to launch and try to upload something so we can launch it as ASPCA
GSP or HP.
In this case the web application is HP so we're gonna leave at default.
So we're just gonna hit for do you want to provide full path disclosure.
Not at the moment cause then that requires a lot more transactions back and forth.
And for what readable directory do we want to use it looks like the common directory should be fine
so we'll use one if that's not the case you can use brute force it or you can try a custom location
like Slash temp whatever kind of works for you.
Normally the unless you know the exact path for the web directory then you need to work with it depending
on how it goes.
So we'll use common locations.
All right.
Interesting.
So looks like we got a few warnings but it's is backdoor has been successfully uploaded.
So if we go ahead and do I.T. we'll say a for all.
So we want to retrieve the output every time we type a command and not have to ask for it we can see.
OK we're running as W data.
So we'll see what directory we're in.
Perfect.
So code name.
So it is true that it is on a killing machine.
So if we do if config we can see boom we're on one dot 22 which is indeed our weather that are weather.
So we've got a shell essentially what it's doing is it's really executing a command and then it's actually
it.
The sequel injection based on a file that it uploaded then it's giving you a result.
But this isn't very interactive because if we wanted to do like the eye or anything else like that it
would just block it we can't really do anything.
So how do we take this a step further.
Well what we can do is we can open up a new new command line or new terminal and what we'll do is we'll
do a Let's do it.
These matters.
So if we do M.S. Benham we're going to generate a payload
perfect.
So we're gonna go ahead and generate a payload or an ESF binary.
So something that can run on Linux and we're going to hit we're gonna go ahead and upload this to the
web server via our shell that we already did and then launch the maternity session from our shell and
gain us back a mere typewriter shell in return instead of working with some you know very basic shell.
So this gives us from basic commands to full control of the system as that user.
And we can upload different post modules and run reconnaissance based on that and or even use it as
a pivot point without even needing to escalate yourself to route or admin or route in this example the
admin and windows.
Let's go ahead and do this.
So I'll host is set to 1 2 6 8 1 twenty three and we'll do a port is equal to footfall for four dash
F is gonna be an F binary and dash Oh we're gonna do Shell we'll just call Shell and we'll go ahead
let that run
well I definitely misspelled that misspelled interpreter.
Sorry about that guys.
Let's go ahead and fix that
we go on let that run and we'll go ahead and build out a left binary named shell and what we're gonna
do is I'm gonna show you guys a way for us to actually go ahead and execute this so we go ahead and
look at what we've got here we can see Shell perfect now there's a simple trick Python already has a
built in web service that you can just quickly run from any directory you want.
So Python dash M simple HDP server and then whatever port you want.
So in this case we'll do 80.
Perfect.
So now we've got a port running or we got a web service running.
So we go over to our target which we again we are as WW data we're going to do w get a GDP 1 2 1 6 8
1 twenty three and we're gonna grab slash or actually we need to do port 80 and then we're going to
go slash shell.
So if we go ahead and do a W get on that and add a way to second
failed it's 1 2 1 6 8 1 twenty three and stop this if config Oh we are 20 for my mistake.
Let's go ahead and go back and change our reverse shell to twenty four we'll recompile that always make
sure you check your IP and make sure it didn't change on you.
It's not.
It does happen during engagements.
So just keep that in mind.
So we'll go ahead and run our thing again and we'll go ahead and rerun this.
But as 24 instead so we should go ahead and there we go.
Perfect.
Ellis dash L so we can see we've got our show right there now.
Now we're gonna want to do is we're gonna go and close out this and do MSF console and we're gonna go
ahead and start up a maternal critter listener for the exploit that we just used.
So this allows us to catch that maternity recession and just as a recap interpreter works in two stages.
It launches the initial initial bit to connect back to the listener the maternity listener and once
it connects back the listener will then send back the rest of the payload for the mature bitter shell
itself.
So keep that in mind because if you try to catch a mature spirit or shell with a with net cat or something
it's going to fail every single time.
So keep that in mind so we're gonna go ahead and use exploit mole Ty handler.
Perfect.
We'll set our payload to the same one that we were working with
perfect onshore options.
We'll set I'll host to 1 2 1 6 8 1 24 0 port 2 4 4 4 4.
Go ahead and run this.
So we got our handler and all we need to do is change mod plus XT for executable our shell and we will
do Shell and we'll throw it in the background just in case we don't want this particular prompt to fail
for whatever reason or hang it's going to do that so we come back over here we'll just give this a second
and there we go.
We've go ahead and got armor trooper.
So this looks like it's hang for a second so go and close that out and do session's dash l.
Perfect and we'll do sessions that shot dash high one cool and take a look here.
Looks like we've got quite a bit
looks like our shell died there for a second so we'll go ahead and rerun this sometimes this does happen
without putting in the background this time.
There we go.
So no background didn't like that.
So if we do shell here Shell perfect.
There we go.
Perfect.
We can close out of this.
And then again we have all of our post exploits or post modules that we could ever work with.
And again we've got all the same information at play here.
So go ahead and take some time follow the link above the video download and get installed and running
the DV w a node and play around with it you can use it on the same calling machine as the one you're
locally on.
It works perfectly fine.
Just note that when you launch that you'll be running it on it'll be launching on port 80.
So you need make sure you don't have anything else running but that's how you take something from symbol
sequel injection to dumping data from the sequel from the database itself which does provide a different
leverage but then we can take that a step further with this and actually gain full access to the machine
and from here we can do prevent escalation to gain more privileges.