root@kali:~# nmap -p- -sV -T4 -A -Pn -oX Kioptrix_level_2.xml 192.168.199.170 Starting Nmap 7.80 ( https://nmap.org ) at 2019-10-13 22:30 EDT Nmap scan report for 192.168.199.170 Host is up (0.0013s latency). Not shown: 65528 closed ports PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 3.9p1 (protocol 1.99) | ssh-hostkey: | 1024 8f:3e:8b:1e:58:63:fe:cf:27:a3:18:09:3b:52:cf:72 (RSA1) | 1024 34:6b:45:3d:ba:ce:ca:b2:53:55:ef:1e:43:70:38:36 (DSA) |_ 1024 68:4d:8c:bb:b6:5a:bd:79:71:b8:71:47:ea:00:42:61 (RSA) |_sshv1: Server supports SSHv1 80/tcp open http Apache httpd 2.0.52 ((CentOS)) |_http-server-header: Apache/2.0.52 (CentOS) |_http-title: Site doesn't have a title (text/html; charset=UTF-8). 111/tcp open rpcbind 2 (RPC #100000) 443/tcp open ssl/https? |_ssl-date: 2019-10-13T23:22:09+00:00; -3h09m43s from scanner time. | sslv2: | SSLv2 supported | ciphers: | SSL2_RC2_128_CBC_EXPORT40_WITH_MD5 | SSL2_RC4_64_WITH_MD5 | SSL2_RC4_128_EXPORT40_WITH_MD5 | SSL2_RC2_128_CBC_WITH_MD5 | SSL2_DES_192_EDE3_CBC_WITH_MD5 | SSL2_RC4_128_WITH_MD5 |_ SSL2_DES_64_CBC_WITH_MD5 631/tcp open ipp CUPS 1.1 | http-methods: |_ Potentially risky methods: PUT |_http-server-header: CUPS/1.1 |_http-title: 403 Forbidden 673/tcp open status 1 (RPC #100024) 3306/tcp open mysql MySQL (unauthorized) MAC Address: 00:0C:29:53:19:4C (VMware) Device type: general purpose Running: Linux 2.6.X OS CPE: cpe:/o:linux:linux_kernel:2.6 OS details: Linux 2.6.9 - 2.6.30 Network Distance: 1 hop
Host script results: |_clock-skew: -3h09m43s
TRACEROUTE HOP RTT ADDRESS 1 1.26 ms 192.168.199.170
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 114.78 seconds root@kali:~#
sh-3.00# find / -name '.mysql_history' /root/.mysql_history /home/john/.mysql_history sh-3.00# cat /root/.mysql_history show databases; create database webapp; use webapp; create table users(id INT,username varchar(100),password varchar(10)); show database; select * from users; show databases; use webapp; insert into users values(1,'admin','hello'); select * from users; use mysql show databases; use mysql; select * from users where user=john; show tables; select * from user where user=john; select * from user where user='john'; select * from user; create user 'john'@'localhost' identified by 'hiroshima'; create user 'webapp'@'localhost' identified by 'hiroshima'; create user 'webapp'@'localhost' IDENTIFIED BY 'hiroshima'; CREATE USER 'webapp'@'localhost' identified by 'hiroshima'; update user set password = password('hiroshima') where user = 'john'; use mysql; show users; select * from user; create user 'john'@'localhost' identified by 'hiroshima'; version; -v ; help flush privileges; show databases; use mysql; grant select,insert,update,delete on *.* to 'john'@'localhost'; update user set password = password('hiroshima') where user = 'john'; flush priveleges; use webapp; show tables; update user set password = password('Ha56!blaKAbl') where user = 'admin'; update username set password = password('Ha56!blaKAbl') where user = 'admin'; select * from users; update username set password = password('Ha56!blaKAbl') where username = 'admin'; update users set password = password('Ha56!blaKAbl') where username = 'admin'; select * from users; insert into users values(2,'john','66lajGGbla'); select * from users; sh-3.00# cat /home/john/.mysql_history show databases; sh-3.00#
