#sql-injection

This box starts with a website that contains a subfolder named "/tiny", in this subfolder there is TinyFileManager version 2.4.3 vulnerable to CVE-2021-45010. It is necessary to have a user in order to exploit the vulnerability so I proceed with a bruteforce attack by setting the username to admin. Once the password is found and the vulnerability exploited, I enumerate the whole system until I find the nginx vhosts thus discovering the "soc-player.soccer.htb" site. The site uses a WebSocket to communicate with the backend and it is vulnerable to a Blind-SQL-Injection which allows me to obtain player's credentials. Finally to get root I enumerate the system again until I find the dstat software which allows the player's group to write plugins in a specific folder. In this way, however, I still don't have root permissions, to get them you have to enumerate the system again and find some binaries not usually installed such as doas which has a configuration that allows you to run dstat as root.

The box starts with an Unauthenticated SQL Injection on the Wordpress website. Thanks to this vulnerability it will be possible to read the hashes of the users' passwords present in the database. After carrying out a bruteforce attack it will be possible to access the wordpress control panel as a manager user.The next step will be to exploit a second known vulnerability XXE which will allow to read any file like www-data. In the most juicy file of wordpress (wp-config.php) there will be the credentials for the FTP server. By downloading and analyzing the files on the FTP server you will find the credentials to access via ssh as user jnelson. Finally, in the privilege escalation we will have to bruteforce the password that protects the gpg private key used by the passpie password manager. Once the private key is cracked, it will be possible to access the root password saved by the password manager.

This box starts with an SQL injection on the value of the unique PrestaShop custom cookie. The md5 hashed credentials of the user james_mason are saved in the database and I can login with SSH. Later I had to exploit, through a known CVE, IPython 8.0.0 to get code execution like dan_smith. Finally, it will be enough to sniff the unencrypted network traffic towards the local Redis server to obtain the credentials and exploit it (two methods proposed) to own the box.