WEBVTT 00:00:00.940 --> 00:00:02.640 For our last foray into sqlmap, 00:00:02.650 --> 00:00:05.290 we'll work on getting that initial foothold into the server. 00:00:05.300 --> 00:00:07.190 Once we've identified a SQL injection, 00:00:07.200 --> 00:00:09.560 we can try and have sqlmap upload a web‑based backdoor. 00:00:10.540 --> 00:00:13.570 This will provide us the ability to run commands on the remote server. 00:00:14.640 --> 00:00:18.150 We can instruct sqlmap to do this by using the os‑shell option. 00:00:18.740 --> 00:00:20.540 Before sqlmap can generate the shell, 00:00:20.540 --> 00:00:22.370 it needs to know what language we want to use. 00:00:23.140 --> 00:00:26.350 Our application is PHP‑based, so we can go ahead and go with the default here. 00:00:26.940 --> 00:00:29.260 Now we'll let sqlmap try and provoke full path 00:00:29.260 --> 00:00:31.950 disclosure just in case it's able to do so. 00:00:33.040 --> 00:00:34.660 We'll go ahead and follow the redirect, 00:00:35.240 --> 00:00:37.280 and we see that sqlmap was unable to automatically 00:00:37.280 --> 00:00:39.050 retrieve the web server document root. 00:00:39.840 --> 00:00:42.870 In order to upload a backdoor, we need a place to upload it to. 00:00:43.540 --> 00:00:46.320 This location has to be writeable by the application. 00:00:46.430 --> 00:00:48.970 Sqlmap is unable to determine the document root, 00:00:49.340 --> 00:00:51.150 so it's asking us how we want to proceed. 00:00:51.160 --> 00:00:53.660 We're going to go ahead and go with a list of common locations. 00:00:54.740 --> 00:00:57.950 Now if you see this cookie header warning from sqlmap from time to time, 00:00:58.440 --> 00:01:01.100 what this means is that the application is sending a new set 00:01:01.100 --> 00:01:04.170 cookie header and sqlmap wants to know if we want to merge them 00:01:04.170 --> 00:01:05.870 together with the ones that we have set. 00:01:05.880 --> 00:01:08.850 We're going to say no and just stick with the ones that we set earlier. 00:01:09.440 --> 00:01:11.590 Now sqlmap is attempting to upload the backdoor and 00:01:11.590 --> 00:01:12.860 is trying different locations. 00:01:13.240 --> 00:01:16.850 This is a two‑part process involving a file stager and the actual backdoor. 00:01:17.740 --> 00:01:21.550 Once this succeeds, sqlmap will create a request to call the os‑shell. 00:01:22.230 --> 00:01:24.150 The prompt then changes to what you see here. 00:01:24.540 --> 00:01:26.970 We can now enter system commands and sqlmap will handle 00:01:26.980 --> 00:01:28.470 executing them via the web backdoor. 00:01:28.470 --> 00:01:32.360 We can run any command that the operating system on the server supports. 00:01:33.240 --> 00:01:35.670 Let's see what user we're running as with the id command. 00:01:36.340 --> 00:01:39.070 Each time we run a command, sqlmap will ask us if we want to retrieve the 00:01:39.070 --> 00:01:42.020 standard output from the command. We can enter yes here, 00:01:42.020 --> 00:01:43.500 or A for always. 00:01:43.720 --> 00:01:44.860 Let's go with always. 00:01:45.840 --> 00:01:48.580 Sqlmap was able to successfully retrieve the output of the command, 00:01:49.040 --> 00:01:51.440 and it looks like we're running as the www‑data user, 00:01:51.450 --> 00:01:52.370 which isn't unusual. 00:01:53.040 --> 00:01:56.070 Let's take a look at the file listing to see if there's anything interesting. 00:01:56.940 --> 00:01:59.330 Configuration directories are usually pretty interesting, 00:01:59.330 --> 00:02:01.170 so let's take a look at the config directory. 00:02:02.040 --> 00:02:06.060 Let's get the contents of the config.inc.php file, 00:02:07.640 --> 00:02:10.750 and up here at the top of the file we can see database configuration, 00:02:10.750 --> 00:02:14.750 and we see the database user and the password. 00:02:16.440 --> 00:02:20.370 As a final example, let's retrieve the contents of etc/password file. 00:02:22.340 --> 00:02:24.400 While this method of access isn't fool proof, 00:02:24.410 --> 00:02:26.150 it may be all that we're able to get. 00:02:26.540 --> 00:02:27.090 From here, 00:02:27.100 --> 00:02:29.930 we can transition to other tools, and I encourage you to experiment with 00:02:29.930 --> 00:02:32.150 this and take this initial foothold to the next step.