[happywilli]

Hello,

I've been using SQLMAP to inject a webserver on our Test lab and I was able to access it by SQL inject it.
I found a Scheduled cron job that is writeable that I can modify and it runs with root access.

Got any tips on what Code I can run to get ex root access?

//W

[[BLANK]]

There are a lot of choices, pretty much anything that you can do in bash you could do in the cron job. You could setup a reverse tunnel which will be running as root. You could add a new user. You could download and execute a shell script etc.

[happywilli]

There are a lot of choices, pretty much anything that you can do in bash you could do in the cron job. You could setup a reverse tunnel which will be running as root. You could add a new user. You could download and execute a shell script etc.

Thanks for replying.

I've got access to OS-Shell on the webserver.
but I do not have root access. What is your recommendation?

[[BLANK]]

Before going into details, is this a test box of some sort? Are you on a local network with the target host? Or is this a live webserver that you are hacking?

[happywilli]

Before going into details, is this a test box of some sort? Are you on a local network with the target host? Or is this a live webserver that you are hacking?

this is a test lab, through VPN.
webserver is unix machine, PHP.

[[BLANK]]

http://pentestmonkey.net/cheat-sheet/she...heat-sheet

Use one of the reverse shells listed above to create a connection to your local host. Because the cron job is running as root, the reverse shell should also be root. At that point you can do whatever you want with root privileges.

[happywilli]

Use one of the reverse shells listed above to create a connection to your local host. Because the cron job is running as root, the reverse shell should also be root. At that point you can do whatever you want with root privileges.
[/quote]

I downloaded the php shell; php-reverse-shell
I uploaded it and tried to run it and listen to the port assigned but I get error message:
WARNING: Failed to daemonise. This is quite common and not fatal. Successfully opened reverse shell to IP port 443 ERROR: Shell connection terminated

[[BLANK]]

What is the exact php code you are using? Also, does it appear that the target host is terminating shell, or your local host?