SunshineCTF 2019: Wrestler Book (Explicit SQL Injection)

Key Takeaways

[Music] hello everybody welcome back from the YouTube video my name is John Hammond and we're looking at the sunshine CTF we've moved into the web category this challenge is called wrestler book and I'm kind of excited to show it to you I really like this kind of challenge I think it's some fun sequel injection so let's get right to it wrestler book is the social network for wrestlers by wrestlers wrestle book is exclusively for wrestlers so if you didn't get an invite don't bother trying to view our profiles rude all right so let's check out what this link is and welcome to wrestler book sign in to view your profile cool ok let's just see if we can login with anything guest guest nope thanks LastPass I don't need that extra security right now your login name or password is invalid try again okay what about admin admin still nothing admin password still nothing LastPass is just gonna keep trying dude give up are they all right this is a CTF challenge so let's try some sequel injection right we got iterations or some possible combinations but we can use be using here the string might be with a single quote the string might be with a double quote and that would cover the terminating string you've also got the comment the comment might be two hyphens or it might be a hash tag or it might be about forward slash star if we can get away with that so let's just try some of them we can try like admin and then - let's do or one equals one and then comment that - - and I'll paste that in for the passage as well okay it looks like that got me in that or one equals one is going to just straight-up return the first result in fines looks like that happens to be Hulk Hogan we retreat some information from him we've got Hulk Hogan username Hulk Hogan age 65 and then a title and then flag is not available ok dang so can we reproduce that without an or 1 equals 1 or will we just straight-up fail like will our sequel injection work even without that ok we get a login password that's fine good so now we can try now we know we have in our minds we got a valid sequel injection some kind of vulnerability so what that means is we may or may not have explicit results returned to us as and we can see some of our some of our requests displayed on the screen because that's very very valuable that means we don't have to do any crazy tricks like a blind sequel injection where we only get a threshold we can control a yes or a No whether or not something actually returns or doesn't return so well that's the next step now that we found the sequel injection vulnerability we can pretty much always do blind except it requires some scripting and some more logic and some hardcore stuff so the other option is check do we have explicit and the way you can just test for that is to see if you can actually run another query alongside the Select statement that's already happening so a union select and then see if you can actually get any result returned back to you so let's try that Union Select and then let's just say one column to see what we've got and I'll copy and paste that in that errors but that means we have errors which is good maybe we can actually help figure out what's going wrong what's happening debugging or our queries here selects to the left and right of Union do not have the same number or result columns okay this is the next part of the test when you're using the Union select statement because the Select statement that happens originally the first the actual query that the server and the website does on its own that's going to be using a specific number of columns it might receive my age my name and my phone number and that's three columns so in my Union select I also have to have select one select to select 3 so it will still return something if it's the wrong number that we're supplying it's just gonna arrow out just like this so thankfully we can see the error so we know that that's happening but what we normally do is just go ahead and increment until we find which of these is gonna get us a result and this might take a little bit especially considering we know that this application already returned a lot of information to return an age and returned the title and returned to etcetera so let's try four that's gonna take nothing again and I'm fumbling around with my cursor I'm sorry let's go to six and it doesn't matter how long does takes dude you might if you know you've got an error and you know something may vary will return you can go up to 30 he'll like you're a determined attacker okay so now we've got a result now we've got five as our name username is one four six and seven we got a page return and we know that what we've been selecting is actually being displayed to us that means we have explicit sequel injection so now in one of those fields we can get some good stuff we can actually start to do our own select statements and try and leak out information I do this a lot with github John Hammond miscellaneous I have a sequel injection cheat sheet that might help leak out the entirety of a database if you don't know anything like if you don't know what the database name is if you don't know what a table name is if you don't know what column you're looking for this will help you figure it out if you can find one of those injection points and actually determine whether or not this returns for you so if we want to select group can cat schema name from information schema maybe we could get this to return something and let's say that five spot let's put that in parentheses and spit that in there copy and paste that for password as well and looks like that failed in this case okay you know what sometimes we give the devil's due cut our losses we know that we still have something in five can we select anything can we select hello right as a string let's see if we can do it yes that returns hello for us okay so we can we can still run our select statements that's not gonna that's not going to hold us back what can we get is users a real table like if you select something from and then a table if it doesn't exist let's say a table that doesn't exist that's fine that will say no such table a table that doesn't exist or it will just rate up err if we it won't return anything if you aren't seeing these errors another challenge what we can do then is try and determine does a table named users exist and that's normally what it's called right if it's a sensible program so we paste that in and that returns for us so we now know that users exist okay we can also probably determine some like like column names right we know we have user name age title flag we can try that let's select age and we don't need string quotes for that anymore because we're getting a real result back age was 65 just like we saw in Hulk Hogan okay so how about select flag n/a so that's the non-applicable that we saw earlier that doesn't help us because we could select flag from users where maybe username is equal to admin or something and maybe that would be what we're looking for let's try that no dice okay so let's try another route I went back and I because I still had my sequel injection cheat sheet in mind I know I have some fields that I can get with group concat and that's this group can cats index here that will take a column that is a lot of results of vertically right and it puts them all together so it makes them horizontal so it will use a comma at the delimiter by default I think you can specify something else but that group can cat will let you show all of the results all the rows that will return to you all in one in one result so that's very cool we can actually take advantage of that to say let's group concat every flag column like everything every flag row and we don't need to specify where user name is anymore because it's just going to give us everything so let's hit that copy/paste the throat and password just to be safe and blah-blah-blah-blah-blah cool we've got example flag and now we have sun just another sequel ciao cool so there's our flag when I first ran this I think my zoom in was off because I wasn't as zoomed in as I was and I'm doing this for real so it looked like it cut off the response and was like well that sucks I can't really see it all that well so what I had done is actually opened up developer tools with f12 and in the network I would reload the page get it to resend so in that post request once I've got it responded to me I can see the response and that way I could actually view it in a much better way and control it that way so there is our flag that was the exploit some cool sequel injection I really like I really like sequel injection explicit is very very fun especially because I feel like I've successfully weaponized that with the sequel injection cheat sheet and blind is fun too because it takes a little bit of fun troubleshooting and a good script so you could submit that flag 100 points and that is wrestler book in the sunshine CTF web the category sequel injection stuff hey I hope you guys enjoyed this video if you did like the video please you like comment subscribe I would love to see you on the discord server there is a link in description I'd love to see you on patreon I'd love to see on PayPal just be a part of the same thanks again guys minutes [Music] [Music] [Music] [Music]