Authentication Bypass#

I navigated to the login page at http://10.67.152.216:8080/gallery/login.php. Suspecting a lack of input sanitization, I attempted a standard SQL injection payload in the Username field to bypass authentication.

• Payload: admin’ OR 1=1 — -

• Password: password (Any value works)

The application accepted the payload, treating the condition 1=1 as true, and logged me in as the administrator.

Database Enumeration (SQL Injection)#

Once inside the dashboard, I confirmed the CMS version is 1.0. I searched for known vulnerabilities using searchsploit.

I identified an SQL Injection vulnerability in the id parameter (reading 50198.txt exploit file).

Exploitation (Burp Suite)#

To replicate the exploit’s Proof of Concept (PoC) exactly, I captured the specific HTTP request triggering the vulnerability.

1. Intercepting the Request:

I configured my browser to proxy traffic through Burp Suite and clicked on an image within an album. I captured the GET request containing the vulnerable id parameter and saved it to a file named test.req.

2. Enumerating Databases:

I passed the captured request file to sqlmap to identify the backend databases.

1
sqlmap -r test.req --dbs

sqlmap identified the backend DBMS as MySQL and listed the available databases.

File Upload Vulnerability#

With administrative access confirmed, I navigated to the “Albums” dashboard. I created a new album and discovered that the image upload feature lacks proper file type validation, allowing for the upload of PHP scripts.

Exploitation Steps:

1. Payload Preparation: I prepared a standard PHP reverse shell (PentestMonkey), modifying the $ip to my VPN address and the $port to 1337. You can use your preffered port :)

2. Upload: Inside the new album, I uploaded the malicious php_reverse_shell.php file.

3. Listener Setup: I started a Netcat listener on port 1337 to catch the connection.

1
nc -lnvp 1337

4. Execution: I clicked on the uploaded file icon in the dashboard to execute the script on the server.

Initial Access:#

I successfully established a reverse shell connection as the www-data user.

Shell Stabilization#

Upon receiving the connection, the shell was limited (non-interactive). I stabilized it using Python to spawn a fully interactive TTY.

1
python3 -c 'import pty;pty.spawn("/bin/bash")'
2
export TERM=xterm
3
# (Ctrl+Z to background)
4
stty raw -echo; fg

Discovery: The Backup Directory#

My persistence paid off when I investigated the /var/backups/ directory. I discovered a non-standard folder named mike_home_backup.

1
ls -al /var/backups/

Inside this directory, I found a .bash_history file that was readable by my current user (www-data).

The history revealed the critical mistake: the user accidentally typed their password directly into the command line while trying to run sudo -l.

Credential Found: b3stpassw0rdbr0xx

Switching Users#

I used this leaked password to switch to the mike user.

Now authenticated as Mike, I retrieved the user flag.

Answer 4

What’s the user flag?

THM{REDACTED}