# Appointment (Tier 1)

## <mark style="color:blue;">Description</mark>

* **Tier&#x20;**<mark style="color:green;">**->**</mark> 1
* **Difficult** <mark style="color:green;">**->**</mark> Very Easy
* **OS** <mark style="color:green;">**->**</mark> Linux
* **Tags&#x20;**<mark style="color:green;">**->**</mark> Databases / Apache / MariaDB / PHP / SQL / Reconnaissance / SQL Injection

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FCPBNitMimFsHLyh2m3ge%2Fimage.png?alt=media&#x26;token=ff934966-29cc-4d27-8f83-569825c46ad0" alt=""><figcaption><p><a href="https://app.hackthebox.com/starting-point?tier=1">https://app.hackthebox.com/starting-point?tier=1</a></p></figcaption></figure>

## <mark style="color:blue;">Write-up</mark>

* With some research, I started answering the first questions

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2Fb7RNmM33g7Y5nYRlvYO1%2Fimage.png?alt=media&#x26;token=8d66b3d5-0197-4d5a-86f1-522a201ffba2" alt=""><figcaption></figcaption></figure>

> Answer: _**Structured Query Language**_

***

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FJQbFweRop0BhXFbwoS0A%2Fimage.png?alt=media&#x26;token=5eca4008-add0-40f4-9bd2-58fa1759007a" alt=""><figcaption></figcaption></figure>

> Anwer: _**SQL Injection**_

***

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2Fpwp7C6vQtXkldYhhTrKG%2Fimage.png?alt=media&#x26;token=ae8abbc1-9137-454c-82ca-81ae2fba5fcf" alt=""><figcaption></figcaption></figure>

> Answer: _**A03:2021 Injection**_

***

* Then, I did an initial scan using [_Nmap_](../../../networks/tools-and-utilities#nmap)

<pre class="language-bash" data-line-numbers><code class="lang-bash"><strong>nmap -p- -Pn --min-rate 2000 10.129.228.241
</strong></code></pre>

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FoetrwJgPGcAChlx7MVOA%2Fimage.png?alt=media&#x26;token=e935d96b-d332-4beb-bafb-c32e245cb8ca" alt=""><figcaption></figcaption></figure>

***

* I continued doing an exhaustive scan on the open port to know about the services running

{% code lineNumbers="true" %}
```bash
nmap -p80 -sVC 10.129.228.241
```
{% endcode %}

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FirYcDcMn83AD5F77jIuK%2Fimage.png?alt=media&#x26;token=4da29792-3073-4324-b6b8-c01178303c84" alt=""><figcaption></figcaption></figure>

***

* With that and some research, I answered the next questions

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FCF0HSYSauEinYwsfico7%2Fimage.png?alt=media&#x26;token=b887b47a-c26a-4d27-8232-84353039dd1d" alt=""><figcaption></figcaption></figure>

> Answer: _**Apache httpd 2.4.38 ((Debian))**_

***

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FpomEx0HSfuDGkgQmPpZQ%2Fimage.png?alt=media&#x26;token=51c383b2-469a-491c-9867-afd29132a55e" alt=""><figcaption></figcaption></figure>

> Answer: _**443**_

***

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2F9KvIorO8rANbhcaasNrO%2Fimage.png?alt=media&#x26;token=e8aef979-287e-4bdd-8501-e643e284798b" alt=""><figcaption></figcaption></figure>

> Answer: _**Directory**_

***

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2Fbg2KN6snSbch8kZ8lzGD%2Fimage.png?alt=media&#x26;token=4990b7e6-e9eb-4902-9b85-e2fd79de415e" alt=""><figcaption></figcaption></figure>

> Answer: _**404**_

***

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FtBHtGpWD0PbPD6UKIjYg%2Fimage.png?alt=media&#x26;token=9f4ac59e-a867-43a7-8eed-d9caecec2f97" alt=""><figcaption></figcaption></figure>

> Answer: _**dir**_

***

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FovJUu4vRohEmT2x32AbS%2Fimage.png?alt=media&#x26;token=bb12e34e-2e83-4619-8441-3955f0bcf238" alt=""><figcaption></figcaption></figure>

> Answer: _**#**_

***

* As I found an HTTP service running on port 80, I went to the browser to explore the content being deployed. I found a simple login page and tried to log in with some default credentials, but it didn't work

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2F4dwuefw77KUgZn5q4k61%2Fimage.png?alt=media&#x26;token=e07009bb-b1c4-4138-ac5e-84acc85b3a56" alt=""><figcaption></figcaption></figure>

{% hint style="success" %}
To learn more about the HTTP protocol, you can go [here](../../networks/protocols/http)
{% endhint %}

***

* So, looking for another way to get through this, I tried doing some basic _SQL Injection_ tests, assuming that was the way the credentials were being validated.  After some tries, I found out that by using the username _admin'#_ and providing any password (a basic test for _SQLi_ in PHP-based pages), I gained access, and a message with the flag was displayed

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2Fi9Ut4jOIGHUPLgywpwYx%2Fimage.png?alt=media&#x26;token=8a646e44-d2fe-452b-b617-1be0abef511a" alt=""><figcaption></figcaption></figure>

{% hint style="success" %}
To learn more about Authentication bypass via SQLi, you can go [here](../../database-attacks/specific-scenarios/sql-injection/authentication-bypass)
{% endhint %}

***

* With this, I answered the last question

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FukW0fv01D4q23JXSCcbe%2Fimage.png?alt=media&#x26;token=16c1aa33-c8c4-41b5-88bc-f75dc3fa8343" alt=""><figcaption></figcaption></figure>

> Answer: _**Congratulations**_

***

* And finally, I got the root flag and pwned the machine

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FiRa4uP83mEE1KVtqIsBo%2Fimage.png?alt=media&#x26;token=b0cab404-34a7-40f0-bc9b-ab02667bb564" alt=""><figcaption></figcaption></figure>

> Answer: _**e3d0796d002a446c0e622226f42e9672**_
