Soccer

Platform: HackTheBox | Difficulty: Easy | OS: Ubuntu Author: D3v0o0Nu11 | Date: 2026-02-10 | Status: Solved

Summary

Walkthrough of the HackTheBox machine Soccer (Ubuntu, attack surface: OpenSSH 8.2p1 Ubuntu 4ubuntu0.5 (Ubuntu Linux; protocol 2.0) (22), nginx 1.18.0 (Ubuntu) (80), xmltec-xmlmail? (9091)). Foothold via default credential, sql injection; direct root access from the foothold. Both flags captured and redacted.

Recon

Port scan

 bash read-only • copy allowed Copy
nmap -p- -sVC 10.10.11.194 --min-rate 1000 -Pn

Enumeration highlights

• Detected OS: Ubuntu.
• Open services: http (80), ssh (22), xmltec-xmlmail? (9091).
• Scan used: nmap -p- -sVC 10.10.11.194 --min-rate 1000 -Pn.

Foothold

Vulnerability / Misconfiguration

┌──(D3v0o0Nu11㉿htb)-[~]
└─$ nmap -p- -sVC 10.10.11.194 --min-rate 1000 -Pn
Starting Nmap 7.93 ( https://nmap.org ) at 2023-11-23 22:52 PST
Nmap scan report for 10.10.11.194
Host is up (0.017s latency).
Not shown: 65532 closed tcp ports (conn-refused)
PORT     STATE SERVICE         VERSION
22/tcp   open  ssh             OpenSSH 8.2p1 Ubuntu 4ubuntu0.5 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   3072 ad0d84a3fdcc98a478fef94915dae16d (RSA)
|   256 dfd6a39f68269dfc7c6a0c29e961f00c (ECDSA)
|_  256 5797565def793c2fcbdb35fff17c615c (ED25519)
80/tcp   open  http            nginx 1.18.0 (Ubuntu)
|_http-title: Did not follow redirect to http://soccer.htb/
|_http-server-header: nginx/1.18.0 (Ubuntu)
9091/tcp open  xmltec-xmlmail?
| fingerprint-strings: 
|   DNSStatusRequestTCP, DNSVersionBindReqTCP, Help, RPCCheck, SSLSessionReq, drda, informix: 
|     HTTP/1.1 400 Bad Request
|     Connection: close
|   GetRequest: 
|     HTTP/1.1 404 Not Found
|     Content-Security-Policy: default-src 'none'
|     X-Content-Type-Options: nosniff
|     Content-Type: text/html; charset=utf-8
|     Content-Length: 139
|     Date: Fri, 24 Nov 2023 06:54:01 GMT
|     Connection: close
|     <!DOCTYPE html>
|     <html lang="en">
|     <head>
|     <meta charset="utf-8">
|     <title>Error</title>
|     </head>
|     <body>
|     <pre>Cannot GET /</pre>
|     </body>
|     </html>
|   HTTPOptions, RTSPRequest: 
|     HTTP/1.1 404 Not Found
|     Content-Security-Policy: default-src 'none'
|     X-Content-Type-Options: nosniff
|     Content-Type: text/html; charset=utf-8
|     Content-Length: 143
|     Date: Fri, 24 Nov 2023 06:54:01 GMT
|     Connection: close
|     <!DOCTYPE html>
|     <html lang="en">
|     <head>
|     <meta charset="utf-8">
|     <title>Error</title>
|     </head>
|     <body>
|     <pre>Cannot OPTIONS /</pre>
|     </body>
|_    </html>
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
SF-Port9091-TCP:V=7.93%I=7%D=11/23%Time=65604883%P=x86_64-pc-linux-gnu%r(i
SF:nformix,2F,"HTTP/1\.1\x20400\x20Bad\x20Request\r\nConnection:\x20close\
SF:r\n\r\n")%r(drda,2F,"HTTP/1\.1\x20400\x20Bad\x20Request\r\nConnection:\
SF:x20close\r\n\r\n")%r(GetRequest,168,"HTTP/1\.1\x20404\x20Not\x20Found\r
SF:\nContent-Security-Policy:\x20default-src\x20'none'\r\nX-Content-Type-O
SF:ptions:\x20nosniff\r\nContent-Type:\x20text/html;\x20charset=utf-8\r\nC
SF:ontent-Length:\x20139\r\nDate:\x20Fri,\x2024\x20Nov\x202023\x2006:54:01
SF:\x20GMT\r\nConnection:\x20close\r\n\r\n<!DOCTYPE\x20html>\n<html\x20lan
SF:g=\"en\">\n<head>\n<meta\x20charset=\"utf-8\">\n<title>Error</title>\n<
SF:/head>\n<body>\n<pre>Cannot\x20GET\x20/</pre>\n</body>\n</html>\n")%r(H
SF:TTPOptions,16C,"HTTP/1\.1\x20404\x20Not\x20Found\r\nContent-Security-Po
SF:licy:\x20default-src\x20'none'\r\nX-Content-Type-Options:\x20nosniff\r\
SF:nContent-Type:\x20text/html;\x20charset=utf-8\r\nContent-Length:\x20143
SF:\r\nDate:\x20Fri,\x2024\x20Nov\x202023\x2006:54:01\x20GMT\r\nConnection
SF::\x20close\r\n\r\n<!DOCTYPE\x20html>\n<html\x20lang=\"en\">\n<head>\n<m
SF:eta\x20charset=\"utf-8\">\n<title>Error</title>\n</head>\n<body>\n<pre>
SF:Cannot\x20OPTIONS\x20/</pre>\n</body>\n</html>\n")%r(RTSPRequest,16C,"H
SF:TTP/1\.1\x20404\x20Not\x20Found\r\nContent-Security-Policy:\x20default-
SF:src\x20'none'\r\nX-Content-Type-Options:\x20nosniff\r\nContent-Type:\x2
SF:0text/html;\x20charset=utf-8\r\nContent-Length:\x20143\r\nDate:\x20Fri,
SF:\x2024\x20Nov\x202023\x2006:54:01\x20GMT\r\nConnection:\x20close\r\n\r\
SF:n<!DOCTYPE\x20html>\n<html\x20lang=\"en\">\n<head>\n<meta\x20charset=\"
SF:utf-8\">\n<title>Error</title>\n</head>\n<body>\n<pre>Cannot\x20OPTIONS
SF:\x20/</pre>\n</body>\n</html>\n")%r(RPCCheck,2F,"HTTP/1\.1\x20400\x20Ba
SF:d\x20Request\r\nConnection:\x20close\r\n\r\n")%r(DNSVersionBindReqTCP,2
SF:F,"HTTP/1\.1\x20400\x20Bad\x20Request\r\nConnection:\x20close\r\n\r\n")
SF:%r(DNSStatusRequestTCP,2F,"HTTP/1\.1\x20400\x20Bad\x20Request\r\nConnec
SF:tion:\x20close\r\n\r\n")%r(Help,2F,"HTTP/1\.1\x20400\x20Bad\x20Request\
SF:r\nConnection:\x20close\r\n\r\n")%r(SSLSessionReq,2F,"HTTP/1\.1\x20400\
SF:x20Bad\x20Request\r\nConnection:\x20close\r\n\r\n");
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 97.20 seconds

1. Based from the nmap results, we can identified the machine opens ssh login, running web app at port 80, and xmltec-xmlmail service at port 9091.

2. Scrolling down and clicking the navbar item, shall found nothing interesting.

3. Hence the approach is to do directory listing or enumerate subdomain.

4. Running both with ffuf and dirsearch, found interesting directory named tiny.

dirsearch -u http://soccer.htb -w /usr/share/wordlists/dirbuster/directory-list-lowercase-2.3-small.txt

1. Searching on the internet for h3k tiny file manager default credentials shall resulting to this:

2. We successfully logged in after using the admin cred as admin.

3. Checking all images, seems there's nothing interesting, it goes the same for the .html file.

4. But checking tiny directory, found .php files which hardcoded the creds there.

5. After checked the Uploads directory's permission, found out as admin we are allowed to RWX.

6. Interesting, we can try to upload php reverse shell then.

7. For the php reverse_shell I used --> https://github.com/pentestmonkey/php-reverse-shell.

8. Don't forget to change these:

9. Upload the file inside the uploads directory, then access the endpoint of the uploaded file --> /tiny/uploads/<filename>.

RESULT AT LISTENER

1. We can't get the user flag obviously because we didn't get shell as user.

2. Took me a while to find a foothold which useful to get shell as user.

3. Enumerating /var/www/ found nothing interesting. Remembering the web server is running using nginx.

4. Hence I started to enumerate the nginx settings and luckily found a foothold.

soc-player.soccer.htb

1. Interesting we found the similiar views but there are 3 other navbar item.

2. But this time default credential for admin is invalid.

3. After I tried to create an account with both username and password is admin, found this result.

4. Also there is another endpoint which is /check, this is getting more interesting and this could tell that the interest should be about port 9091 (another open port found at our nmap scan before).

5. Viewing the page source, found that the web application functionalities are based on the WebSocket server which running on port 9091.

6. To check for vulns, we can use an intercepter.

RESULT USING BURPSUITE

1. From the result above, we can conclude that the WebSocket is vulnerable to Blind SQLi.
2. Why blind? Because the query result is not reflected to user interface, but we can only see the result from an interceptor.
3. Nice, to speed this exploitations, I used sqlmap.

sqlmap -u "ws://soc-player.soccer.htb:9091" --data '{"id":"*"}' --dbs --threads 10 --level 5 --risk 3 --batch

-u "ws://soc-player.soccer.htb:9091": Specifies the target URL where the SQL injection vulnerability is suspected.
In this case, it's a WebSocket URL (ws://) for a service running on soc-player.soccer.htb at port 9091.
--data '{"id":"*"}': Specifies the data payload that will be used in the HTTP request. In this case,
it's a JSON payload with a parameter named 'id' set to ''. The asterisk () is often used as a wildcard character in SQL injection attempts.
--dbs: Instructs sqlmap to enumerate the available databases once a SQL injection vulnerability is identified.
--threads 10: Sets the number of concurrent threads to 10. This option can be used to speed up the scanning process by making multiple requests simultaneously.
--level 5: Sets the level of tests to be performed by sqlmap. The level ranges from 1 to 5, with 5 being the most comprehensive and thorough.
--risk 3: Sets the risk level of the tests. The risk level ranges from 1 to 3, with 3 being the highest risk level.
--batch: Runs sqlmap in batch mode, which means it will not prompt for user input during the scanning process. It will use the default options and automatically proceed with the scan.

1. Nice! Now let's dump all tables inside soccer_db database.

sqlmap -u "ws://soc-player.soccer.htb:9091" --data '{"id":"*"}' -D soccer_db --dump --threads 10 --random-agent

1. Great! We found a cred which we can use to login to the remote server.

Proof

User flag: REDACTED

Privilege Escalation

User -> Root/Admin

The exploit provided a shell running with elevated privileges directly, so no separate privilege escalation was required.

Root flag: REDACTED

Flags

Lessons Learned

1. Directory listing using dirsearch.
2. h3k tiny file manager exploitations.
3. WebSocket Exploitation.
4. Using sqlmap for blind SQLi exploitation.
5. Privesc using SUID doas.
6. Making malicious dstat using python --> /usr/share/local/dstat.