How do i get into this one?

[nmabhinandan]

Okay guys first thing first.. i'm a noob and i'm not a hacker. My college ERP software is made up of JSP and runs on apache tomcat server. The admin login page form has not validated. So I successfully bypassed it by using XPATH injection (sql injection for xml databases). Wait theres more.. the servers ssh port is open!!   


If I can do the  xpath injectoin i.e.
[size=78%] [/size]

Code: [Select]

user: admin' and 1=1 or ''='
pass: somestring


it means I can run this one too.. 

Code: [Select]

user: admin' and Runtime.getRuntime().exec("useradd hawkeye; passwd hawkeye password") or 1=1 or ''='
pass: somestring



My plan is to add a new user and connecting the server through ssh.. and the problem is it is not working.. 


Thanks in advance

[Pak_Track]

the problem is it is not working..

That's going to my signature

[Z3R0]

Tomcat, mysql, and ssh are three different services. They do not all share a magical master database. If you want to take over that box, you will have to attack each of those services individually.

For example, find a sql injection vulnerability through tomcat, and get a sql shell. If the user running the sql server is a database admin, then you will have to check that user's file privileges (select file_priv from mysql.user). If you can read files, then look up the /etc/passwd file (load_file('/etc/passwd'), and look for system users. From there, look through the users' home directories and hope some of them have ssh logins. If they do, their private key will be in /home/someuser/.ssh/id_rsa

Then, replace your private key with the private key of the user, and you can ssh into the box without having to know the user's password. Come on dude, 3rd graders know this stuff.

I give this attack scenario because you are far more likely to have read privileges than you ever will compared to write privileges.

EDIT: and make an introduction before asking us for attack methodologies!

[lucid]

Come on dude, 3rd graders know this stuff.

Lol dick