Please enable JavaScript.

Coggle requires JavaScript to display documents.

kioptrix4 (Vuln searching (member login page (lets try login with names…

- - - - got users
  - - - open kioptrix4 website on port 80
- - - - success and also got pass
  - - - lets try login with root or loneferet
        
        fail
- - - - OS command Injection
        
        echo os.system(‘/bin/sh’)
        
        success
- - - - root cred for db is null
- - - - db is running under root
  - - - locate UDF
  - - - check if UDF fun is available
        
        SELECT * FROM mysql.func;
        
        select sys_exec('usermod -a -G admin john');
        
        successfully added john to admin