[Learning] Kioptrix level two -- injection

Links:

watch the HD video online: http://vimeo.com/f4l13n5now/kioptrix2

Description:

"This Kioptrix VM Image are easy challenges. The object of the game is to acquire root access via any means possible (except actually hacking the VM server or player).
The purpose of these games are to learn the basic tools and techniques in vulnerability assessment and exploitation. There are more ways then one to successfully complete the challenges."
                                                                                                                                 --------- Kioptrix team

Attacker:

Backtrack 5 R2
IP: 192.168.1.15/24

Victim:

Kioptrix level 2
IP: 192.168.1.102/24

vulnerability & exploit:

1, SQL Injection & Command Injection
2, ip_append_data() ring0 Root Exploit

Attacking process:

1, discover the vulnerable services:
use NMAP to probe the opening ports and services

nmap -sS -sV -O 192.168.1.102 -v

found the following services:
[1] HTTP service running on port 80
2, exploit vulnerable services:
[1] exploit SQL & Command injection vulnerability to get remote shell
[2] exploit ip_append_data() ring0 Root Exploit to get root privilege

Reference:

[1] Kioptrix download link
[2] Tutorial on g0tmi1k's Blog