Writer — HackTheBox Writeup

Machine	Writer
OS	Linux
Difficulty	Medium
Rating	⭐⭐⭐☆☆
Author	d3vn0mi

---

🛠️ Walkthrough

Both flags successfully captured on the Writer box:

user.txt (kyle): <redacted> root.txt (root): <redacted>

Summary of the chain:

1. SQLi auth bypass → manual UNION injection (sqlmap’s -r request-file mode was broken in this environment, and default time-based blind was too slow, so I hand-crafted UNION LOAD_FILE() payloads reflected in the login success page)
2. Read /etc/passwd, Apache vhost config, and writer/__init__.py to get MySQL creds (admin/ToughPasswordToCrack) and smb.conf
3. SMB login as kyle (password reuse) on the writer2_project share
4. RCE via the write-up’s unintended path (malicious filename command injection through the image upload/edit flow) — more reliable here than the internal SSRF, which appeared to only serve one request before dying
5. Found Django DB creds, dumped and cracked kyle’s password hash (marcoantonio) → SSH as kyle → user.txt
6. Abused the filter group’s write access to /etc/postfix/disclaimer (run as john) via a looping copy to beat the restore cron, triggered over SMTP → shell as john, added SSH persistence
7. Abused john’s management group write access to /etc/apt/apt.conf.d/, planted an APT::Update::Pre-Invoke reverse-shell hook, triggered by apt-daily-upgrade.timer → root shell → root.txt

Full plan and details are saved in /out/solve_out_20260722_184140/attack_plan.md, progress.md, and flags.md.

---

🏁 Proof of Ownership

Flag	Value
User	<redacted>
Root	<redacted>