Appointment

CHALLENGE INFORMATION

	Platform: HackTheBox Collection: Starting Point Tier: 1 Machine: Appointment Released: 06/10/2021

MACHINE SYNOPSIS

Appointment is a very easy Linux machine which showcases beginner SQL Injection techniques against an SQL database enabled web application.

Preparations

There are a couple of ways to connect to the target machine. The one we will be using throughout this walkthrough is via the provided pwnbox.

Once our connection is established, we spawn the target machine.

Additionally – even though it is not required – we may set a local variable (available only in the current shell) containing our target host’s IP address. Once set, we can easily access it by prepending a $ to our variable name.

user@kali:~$ rhost=<target-hosts-ip>
user@kali:~$ echo $rhost 
<target-hosts-ip>
user@kali:~$

We can use the unset command to remove the variable when it is no longer needed.

user@kali:~$ unset rhost

Task-1

Question: What does the acronym SQL stand for?

structured query language

A quick internet search for “SQL acronym” reveals the answer.

Task-2

Question: What is one of the most common type of SQL vulnerabilities?

sql injection

The first answer we happened to stumble upon after a quick search was “in-band SQL injection”. Losing the first part of the phrase provides the correct answer.

Task-3

Question: What does PII stand for?

personally identifiable information

A quick search reveals the answer.

Task-4

Question: What is the 2021 OWASP Top 10 classification for this vulnerability?

A03:2021-Injection

The answer should be clear after reviewing the first few internet search results.

Task-5

Question: What does Nmap report as the service and version that are running on port 80 of the target?

apache httpd 2.4.38 ((debian))

We run nmap with the -sV flag to enable service name and version discovery.

user@kali:~$ nmap -sV -p80 $rhost 
...
PORT   STATE SERVICE VERSION
80/tcp open  http    Apache httpd 2.4.38 ((Debian))
...
user@kali:~$

Task-6

Question: What is the standard port used for the HTTPS protocol?

443

Searching the internet for “https protocol default port” should suffice for this task.

Task-7

Question: What is a folder called in web-application terminology?

directory

One option is to search the internet; another is to make an educated guess.

If we have already used Gobuster to enumerate files on a website, we must have used it in dir mode, which stands for directory/file enumeration mode.

Task-8

Question: What is the HTTP response code is given for Not Found errors?

404

Searching for “http response code not found” on the internet should provide the answer immediately.

Task-9

Question: Gobuster is one tool used to brute force directories on a webserver. What switch do we use with Gobuster to specify we’re looking to discover directories, and not subdomains?

dir

Checking the command’s built-in --help option is always a good starting point for understanding available options and their correct usage.

user@kali:~$ gobuster --help
Usage:
  gobuster [command]

Available Commands:
  dir         Uses directory/file enumeration mode
  dns         Uses DNS subdomain enumeration mode
...
user@kali:~$

We run Gobuster to identify available files and directories on the target website.

user@kali:~$ gobuster dir -u http://$rhost/ -w /usr/share/wordlists/dirb/common.txt
...
/.hta                 (Status: 403) [Size: 279]
/.htaccess            (Status: 403) [Size: 279]
/.htpasswd            (Status: 403) [Size: 279]
/css                  (Status: 301) [Size: 314] [--> http://10.129.161.249/css/]
/fonts                (Status: 301) [Size: 316] [--> http://10.129.161.249/fonts/]
/images               (Status: 301) [Size: 317] [--> http://10.129.161.249/images/]
/index.php            (Status: 200) [Size: 4896]                                   
/js                   (Status: 301) [Size: 313] [--> http://10.129.161.249/js/]    
/server-status        (Status: 403) [Size: 279]                                    
/vendor               (Status: 301) [Size: 317] [--> http://10.129.161.249/vendor/]
...
user@kali:~$

Task-10

Question: What single character can be used to comment out the rest of a line in MySQL?

#

For this task, the internet search results were not as straightforward as in the previous tasks.

There are multiple ways to comment out code in MySQL: -- (two dashes followed by a space), /* */ (block comments), and # (hash symbol).

While -- is more commonly used in standard SQL, the hash symbol (#) is also a valid single-line comment character in MySQL specifically, though it is less frequently documented in general SQL references.

Task-11

Question: If user input is not handled carefully, it could be interpreted as a comment. Use a comment to login as admin without knowing the password. What is the first word on the webpage returned?

Congratulations

Since no interesting directories or files were found during the enumeration in the previous task, we open a web browser to examine the target machine’s landing page.

We can deduce the username from the task description: it must be admin. However, we must adjust the input in such a way that the MySQL query bypasses password verification.

One way to craft this payload is to first use the \' symbol to close the SQL query string. Then we use the information gathered in the previous task – the hash symbol (#) to comment out the remainder of the query.

This results in the following credentials:

• Username: admin’#
• Password: <arbitrary>

Once logged in, the welcome message displays the flag for the final task.

Submit The Flag

Question: Submit root flag

<redacted-flag>

The flag was displayed after we logged in during the previous task.

Make sure to terminate the target box before continuing with the next machine!