Sql-Injection

Overview Machine author: TheHermit. Host: Ubuntu, with Docker containers (Debian 8 Jessie). Theme: Star Trek: The Next Generation. Chain: recon, SQL injection in a custom WordPress plugin, credentials in a draft post, Joomla admin, PHP shell upload via eXtplorer, a www-data shell on the host (outside Docker), a SUID stack buffer overflow in /bin/lcars, root. The key trap: there are two different www-data shells. One is in a Docker container (WordPress/Joomla), the other is on the real host (via Apache on 443). Root only comes from the second one. ...

Overview Machine author: TheCyberGeek. IP: 10.10.10.x. Recon: only port 80 is open (Werkzeug/Python 3.9.2, a Flask application). SQL injection in the login form: authentication bypass plus a dump of the main database. The admin’s MD5 hash cracks to superadministrator. Subdomain internal-administration.goodgames.htb: a Flask panel, password reuse. SSTI in the profile field: RCE, a reverse shell, root inside a Docker container. Docker escape via a shared bind-mount plus the SUID bit: root on the host. Reconnaissance 1 2 ports=$(nmap -p- --min-rate=1000 -T4 10.10.10.x | grep ^[0-9] | cut -d '/' -f 1 | tr '\n' ',' | sed s/,$//) nmap -p$ports -sV -sC -Pn 10.10.10.x Port 80: Werkzeug/2.0.2 Python/3.9.2, title GoodGames | Community and Store. The footer reveals the domain goodgames.htb. ...

Overview Machine author: ompamo. Debian. A maze box with multiple paths at every stage. Key concepts: cookie reuse between subdomains, NSS + PostgreSQL as the backend for system accounts, command injection in a setuid wrapper, and a x64 ROP buffer overflow. 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 +- XSS (contact form) --------------+ admin.redcross.htb +- SQLi -> crack charles -----------+-> reuse PHPSESSID +- guest account -> cookie ---------+ | v +- Haraka SMTP RCE ---------------+ shell as penelope + +-> user.txt +- cmd injection (iptctl) -> www-data -> PostgreSQL creds -> add a user gid=1000 | v +- gid=27 (sudo) -> sudo su ------+ (unintended) root +- unixnssroot -> uid=0 -> su ----+ (intended) +- BOF in iptctl (setuid) -> ROP -+ (BOF path) | v root.txt Reconnaissance 1 2 3 22/tcp ssh OpenSSH 7.4p1 Debian 10+deb9u3 (Debian 9 Stretch) 80/tcp http Apache 2.4.25 443/tcp ssl/http Apache 2.4.25 Script scans (-sC) hang, so there is a WAF. Run only -sV. HTTP GET / redirects (301) to https://intra.redcross.htb. Add it to /etc/hosts. Domain and directory enumeration: ...