[mascon]

can somebody drop the hash this shit is taking forever

dont do time-based, other injection methods work too

The only thing that worked was Stacked Query, basically changing the admin password hash to something like md5 of '1234' and using that pw to login, but I don't see anything interesting and the hashes can't be cracked with rockyou and john.

What do you mean it's faster? Elaborate please

I don't really know what u mean, but boolean-based blind is possible:
sqlmap -r req2.txt --dbms=mysql --technique=B -T users -D monitorsthree_db --dump
U get hashes and crack with hashcat -m 0.
Login to vhost cacti

I'm not sure how you detected it, probably because you supplied the request from burp and I did it manually. I did level 5 and risk 3, and it only found time based and stacked query. I managed to dump it after an absurdly long time and crack with john, actually I'm almost at user

[osamy7593]

can't import package in cacti why

This forum account is currently banned. Ban Length: Permanent (N/A Remaining)
Ban Reason: Asking for rep is not allowed

[wtfduw]

Use the metasploit module : exploit/multi/http/cacti_package_import_rce
You'll be able to land a shell as www-data

This forum account is currently banned. Ban Length: Permanent (N/A Remaining)
Ban Reason: Leeching | http://c66go4clkqodr7tdjfu76jztjs7w7d3fajdeypxn73v4ju3dt7g5yyyd.onion/Forum-Ban-Appeals if you feel this is incorrect.

[noidontwant]

can't import package in cacti why

multi/http/cacti_package_import_rce

[chappy]

Use the metasploit module : exploit/multi/http/cacti_package_import_rce
You'll be able to land a shell as www-data

for all people
that the module does not install for msfconsole
use this
and shell rm /tmp....
https://github.com/Cacti/cacti/security/...-g5qc-pj88
i got a shell with this

This forum account is currently banned. Ban Length: Permanent (N/A Remaining)
Ban Reason: Scraping | https://breachforums.ai/Forum-Ban-Appeals if you feel this is incorrect.

[deku76]

any hints for after www-data can get to user

[drunkp]

any hints for after www-data can get to user

marcus has a user account in cacti.

[teky]

this got me shell https://github.com/rapid7/metasploit-fra...pull/19196

This forum account is currently banned. Ban Length: Permanent (N/A Remaining)
Ban Reason: Leeching | https://breachforums.ai/Forum-Ban-Appeals if you feel this is incorrect.

[grisun0]

http://127.0.0.1:8200/login.html
Once you gain access to the user Marcus, there is a port that can be accessed with the command
ssh -L 8200:127.0.0.1:8200 marcus@10.10.11.30 -i sessions/id_rsa_marcus

[mamadoubarla]

the user flag was so fucking easy wtf ahahahahahaha