search

Union

hashtag
Gaining Access

Nmap scan:

$ nmap -p- --min-rate 5000 10.129.96.75
Starting Nmap 7.93 ( https://nmap.org ) at 2023-05-08 11:22 EDT
Nmap scan report for 10.129.96.75
Host is up (0.0088s latency).
Not shown: 65534 filtered tcp ports (no-response)
PORT   STATE SERVICE
80/tcp open  http

The name implies I should be looking for some type of UNION SQL Injection somewhere...

hashtag
UNION Injection

This reveals a simple website that takes one user input:

If we enter anything, it says that we are eligible to compete in the tournament and gives us a link to challenge.php.

Since this was a UHC box, sqlmap revealed nothing to me, so we have to do this manually. I tried some basic SQL Injection with UNION, and found that it was indeed vulnerable to SQL Injection:

So now we need to enumerate the database and grab the flag.:

Once we submit the flag, we have SSH access, but we still have no password.

hashtag
SSH Creds

Since we still had UNION injection, we can use the load_file function to have LFI.

First we need to identify what files are present on the site. I know that it is PHP-based, so let's start there.

There's a config.php file, and we can read that:

With that, we can SSH into the machine.

hashtag
Privilege Escalation

hashtag
Command Injection -> Sudo

There's another user on the machine:

There isn't much that this user can access. So let's view the website files. The firewall.php file is the one that provided us with access to SSH, and it has some vulnerable code:

This uses the X-Forwarded-For HTTP header variable and passes it directly into a command with sudo. Using this request, we can get another reverse shell as www-data.

When checking our sudo privileges, this is what we see:

PreviousUnicodeNextUpDown

Last updated