Sql-Injection

Overview StreamIO is a Windows Active Directory box (domain streamIO.htb, hostname DC) running IIS + PHP with MSSQL as the backend database. The foothold chains a UNION-based SQL injection on a streaming subdomain into credential recovery, a hidden debug parameter that exposes a local file include, and finally a remote file include that reaches a raw eval() for code execution. From there the path is pure credential reuse and Active Directory ACL abuse: database credentials pulled from the web root unlock a backup database with fresh hashes, saved Firefox logins hand over a domain user, and a WriteOwner/Owns edge over a group with ReadLAPSPassword lets us read the LAPS-managed local administrator password and log in as administrator. ...

Overview Altered is a Hard-rated Linux machine built for a UHC (Ultimate Hacking Championship) event. Machine author: ghost-2. Operating system: Ubuntu 20.04 Focal. IP: 10.10.10.x. A Laravel staff dashboard leaks valid usernames through its login errors. The password reset issues a four-digit PIN and throttles by client IP, but the app trusts X-Forwarded-For from any client, so pairing every PIN guess with a fresh spoofed IP defeats the limiter and recovers the PIN. An authenticated API endpoint guards its records with an MD5-looking secret compared using PHP’s loose ==, so sending the secret as the boolean true bypasses the check - and because the id field also accepts a string, it opens a UNION-based SQL injection. The database account holds FILE, so INTO OUTFILE writes a PHP webshell into the web root for a shell as www-data. The kernel is 5.16.0 from January 2022, vulnerable to Dirty Pipe (CVE-2022-0847); a SUID binary overwrite (or an /etc/passwd edit past a pam_wordle gimmick) gives root. ...

Overview Machine author: TheCyberGeek. IP: 10.10.10.x. Recon: only port 80 is open (Werkzeug/Python 3.9.2, a Flask application). SQL injection in the login form: authentication bypass plus a dump of the main database. The admin’s MD5 hash cracks to superadministrator. Subdomain internal-administration.goodgames.htb: a Flask panel, password reuse. SSTI in the profile field: RCE, a reverse shell, root inside a Docker container. Docker escape via a shared bind-mount plus the SUID bit: root on the host. Reconnaissance 1 2 ports=$(nmap -p- --min-rate=1000 -T4 10.10.10.x | grep ^[0-9] | cut -d '/' -f 1 | tr '\n' ',' | sed s/,$//) nmap -p$ports -sV -sC -Pn 10.10.10.x Port 80: Werkzeug/2.0.2 Python/3.9.2, title GoodGames | Community and Store. The footer reveals the domain goodgames.htb. ...

Overview Machine author: ompamo. Debian. A maze box with multiple paths at every stage. Key concepts: cookie reuse between subdomains, NSS + PostgreSQL as the backend for system accounts, command injection in a setuid wrapper, and a x64 ROP buffer overflow. 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 +- XSS (contact form) --------------+ admin.redcross.htb +- SQLi -> crack charles -----------+-> reuse PHPSESSID +- guest account -> cookie ---------+ | v +- Haraka SMTP RCE ---------------+ shell as penelope + +-> user.txt +- cmd injection (iptctl) -> www-data -> PostgreSQL creds -> add a user gid=1000 | v +- gid=27 (sudo) -> sudo su ------+ (unintended) root +- unixnssroot -> uid=0 -> su ----+ (intended) +- BOF in iptctl (setuid) -> ROP -+ (BOF path) | v root.txt Reconnaissance 1 2 3 22/tcp ssh OpenSSH 7.4p1 Debian 10+deb9u3 (Debian 9 Stretch) 80/tcp http Apache 2.4.25 443/tcp ssl/http Apache 2.4.25 Script scans (-sC) hang, so there is a WAF. Run only -sV. HTTP GET / redirects (301) to https://intra.redcross.htb. Add it to /etc/hosts. Domain and directory enumeration: ...

Overview Machine author: TheHermit. Host: Ubuntu, with Docker containers (Debian 8 Jessie). Theme: Star Trek: The Next Generation. Chain: recon, SQL injection in a custom WordPress plugin, credentials in a draft post, Joomla admin, PHP shell upload via eXtplorer, a www-data shell on the host (outside Docker), a SUID stack buffer overflow in /bin/lcars, root. The key trap: there are two different www-data shells. One is in a Docker container (WordPress/Joomla), the other is on the real host (via Apache on 443). Root only comes from the second one. ...