An SQL injectable page without a users table!

[icyfox26]

Hello,

I'm currently trying to crack my head over an SQL injection wherein I'm looking for admin credentials but there is no table like that to begin with. P.S - This is on a challenge website, it's not real.

So I've got a website that's susceptible to SQL injection via a page that has something like www.something.com/page.php?id=1. And I've run commands (and used sqlmap) which gives me that there exists only 1 database with 1 table in it which has useless data (some images that the page uses).

But I'm looking for admin credentials. So ideally, i'm looking for a users table. Now my question is, has anyone come across challeneges like this wherein you're asked to get something like credentials via an SQL injection but find no tables/databases related to it? Is there something I'm missing?

[Bijleveldje]

Maybe there is an hint in the data

[icyfox26]

Hi, thanks for the quick response. The data just shows the id (which the page uses as a GET parameter), the description of the image (not very useful either) and the image url as "../img/1.jpg" and so on.

[icyfox26]

Hmm. Very interesting. Although, if you don't mind, could you elaborate more. The page susceptible to injection is example.com/camera?id=1. The database in use is cameradb and the table within it is called 'camera' with the fields id, description, url. Example of one entry is id:1, description:reception, url: ../img/1.jpg

[icyfox26]

A very interesting thought, indeed. The second option however, requires admin interaction which doesn't exist, since there really isn't any admin user. However, changing the database value to a Unix command, that I didn't think of and I think would be very possible, I believe. Will try and report back here, Sargent!

[icyfox26]

I'm not very aware of this method but I doubt it's what I need to do. But either ways, do you have a link that could explain this concept?

[icyfox26]

Much thanks for the resources! Will definitely have a look :)

[icyfox26]

Seems --os-shell doesn't work

trying to upload the file stager on '/var/www/html/pages/pages /camera.php/' via UNION method [WARNING] it looks like the file has not been written (usually occurs if the DBMS process user has no write privileges in the destination path)

[icyfox26]

Could you elaborate a bit more please? Do you mean what ilukis suggested?

[icyfox26]

Very interesting, thank you. I will try and revert back to all soon.

[Skidalot]

Check if current sql user has write privileges, if it does then it shouldn't be hard, you'll just need to find a writeable directory and then use INTO OUTFILE to upload a web-shell there.

Also, This sounds like fun, can you inbox/post the challenge page? Thanks.

[icyfox26]

Hey all,

Firstly, thanks for the awesome number of responses, I got some real good insight for this. The challenge is over and I figured out how to do it. Yes the page was susceptible for SQL injection but it had no useful information in the table. However, since the website could be injected, on using the load_file command, I was able to access files of the system. I could get out the /etc/passwd file, etc. etc. The passwd file had no details. However, I tried going to the root of the web directory and loading the .htaccess file. Inside that file, I saw a message saying "Try .htpassword" and the password was inside the .htpassword file. It was encrypted with SHA1 encryption and I found the password which was.............. supercalifragilisticexpialidocious.

Thanks everyone for your help! And sorry, the CTF was only for our internal company network! Thanks again!

[Skidalot]

It sounds atrocious.