Validation
Gaining Access
Nmap scan:
SQL Injection for RCE
The website contains a simple register function that takes user input.
When proxying the traffic, the POST request is submitted like so:
When viewing our request, this is what we would see:
A quick directory scan reveals there is an account.php endpoint on the machine.
The config.php endpoint presented an empty screen, which I think we have to look into after gaining a shell. Anyways, the account.php file displayed an SQL error when trying to view the player I registered.
Instead of enumerating the database, I directly wrote a webshell into the page.
Then, we can get a reverse shell and enumerate the config.php file we saw earlier.
Privilege Escalation
Within the config file, there was a password, which happened to be the root password.
