From SQL Injection to OS Command Injection: My Kioptrix Level 2 Lab Journey

A hands-on cybersecurity assessment covering vulnerability discovery, exploitation evidence, risk analysis, and remediation in an intentionally vulnerable Linux environment.

Kioptrix Level 2: Penetration Testing Report — SQL Injection, OS Command Injection, and Legacy System Weaknesses

Author: Cybersecurity Learner
Target: Kioptrix Level 2
Environment: Isolated VMware lab
Target IP: 192.168.162.130
Attacker IP: 192.168.162.128
Assessment Type: Authorized Vulnerability Assessment and Penetration Testing
Status: Application-level exploitation confirmed; root privilege escalation not confirmed.

1. Introduction

As part of my cybersecurity learning journey, I conducted a penetration testing assessment against Kioptrix Level 2 in a controlled virtual lab environment.

The objective was to identify exposed services, investigate application-level vulnerabilities, validate their impact using controlled tests, and recommend appropriate remediation measures.

The assessment identified critical weaknesses in the web application's authentication and system command execution mechanisms. Additional observations included an outdated operating system and software stack, insecure legacy TLS configuration, exposed database connection details, and missing HTTP security headers.

This report documents the confirmed findings, supporting evidence, potential impact, and recommended security improvements.

2. Scope and Methodology

The assessment was limited to the intentionally vulnerable Kioptrix Level 2 virtual machine and its isolated lab network.

The testing process followed these stages:

1. Reconnaissance: Identifying the target and confirming network connectivity.
2. Service Enumeration: Discovering accessible ports and identifying service versions.
3. Web Application Assessment: Reviewing authentication, input handling, and exposed application functionality.
4. Vulnerability Validation: Testing suspected vulnerabilities with controlled inputs and reviewing application responses.
5. Local Enumeration: Examining the operating system, user privileges, file permissions, scheduled tasks, and kernel information.
6. Risk Assessment: Evaluating findings according to their demonstrated impact and potential consequences.
7. Remediation Planning: Recommending corrective measures for the identified weaknesses.

All testing was conducted against the lab target. No production systems were involved.

3. Target Reconnaissance and Service Enumeration

The initial enumeration identified the following exposed TCP services:

PortServiceObserved details22SSHOpenSSH 3.9p180HTTPApache 2.0.52 with PHP 4.3.9111RPCrpcbind443HTTPSApache HTTPS service630RPC-related serviceService identified during enumeration631IPPCUPS/IPP service3306MySQLMySQL service

The target was identified as a legacy CentOS system running a 32-bit Linux kernel.

Get Mohamed ibrahim NaseF’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

Operating system: CentOS 4.5 (Final)
Kernel: 2.6.9-55.EL
Architecture: i686 (32-bit)

These results indicate a significantly outdated software environment. The age of a component alone does not prove that a specific exploit will work, so individual vulnerabilities require separate validation.

4. Confirmed Vulnerability Findings

Finding 1: SQL Injection in the Login Functionality

Severity: High

Affected component: index.php
Category: SQL Injection
OWASP reference: Injection vulnerabilities

Description

The login functionality constructs a SQL query by directly concatenating user-controlled values into the query string.

The relevant source code was:

$username = $_POST['uname'];
$password = $_POST['psw'];

$query = "SELECT * FROM users
          WHERE username = '$username'
          AND password='$password'";

$result = mysql_query($query);
$row = mysql_fetch_array($result);

Because the application does not use parameterized queries, specially crafted input can change the logic of the SQL statement.

Evidence and validation

A controlled authentication-bypass test was performed using the following request:

curl -s -X POST \
  --data-urlencode "uname=admin' OR '1'='1' #" \
  --data-urlencode "psw=test" \
  --data-urlencode "btnLogin=Login" \
  http://192.168.162.130/index.php

The response contained the HTML comment:

<!-- Start of HTML when logged in as Administator -->

The response also exposed the application's authenticated interface, including the ping functionality.

This confirms that the login logic could be bypassed through SQL injection in the tested environment.

Potential impact

• Authentication bypass.
• Unauthorized access to protected application functionality.
• Potential exposure or manipulation of database records, depending on database permissions and query behavior.
• Possible further compromise when combined with other application weaknesses.

Recommended remediation

1. Replace dynamically concatenated SQL statements with parameterized queries.