Swsctfjournal5

Topic: The Marketplace

The sysadmin of The Marketplace, Michael, has given you access to an internal server of his, so you can pentest the marketplace platform he and his team has been working on. He said it still has a few bugs he and his team need to iron out.

Can you take advantage of this and will you be able to gain root access on his server?

As always, spawn the machine and run a nmap scan.

Launch the browser and head to the IP address of the machine. The website is a marketplace platform. I can register and login to the platform.

Try logging in as admin.

User not found

See if sign up works with a new user work.

Returns a signed up succesfully message.

Now let me log in back with the same credentials.

And we get in.

I tried to create some new listings but realized they block tese type of requests but do not sanitize them. So I added an XSS script to see if it worked.

I noticed we can actually send listings to admins.

From what i saw in the hint box, I went onto PayloadsAlltheThings saw this payload.

I started a listener on mhy machine.

When i continued to report to admins, i got a response on my listener.

I copied the cookie and use a cookie editor and changed my current token.

With the admin token, i could go in /admin.

Upon clicking any one of the users, I saw that I could do a sql injection easily.

I tried appending ‘ at the back of the url.

I again tried, but this time with a union injection.

?user=-1 union select (user()),2,3,4 — -

Now to determine the database.

user=-1 union select (select group_concat(SCHEMA_NAME) from INFORMATION_SCHEMA.SCHEMATA),2,3,4 — -

To get the tables out.

user=-1 union select (select group_concat(TABLE_NAME) from INFORMATION_SCHEMA.TABLES where TABLE_SCHEMA = ‘marketplace’),2,3,4 — -

I noticed the messages table.

user=-1 union select group_concat(user_to, message_content), null, null, null from messages

I got the flag in user.txt by running cat.

Run sudo -l

Generate netcat reverse shell payload on my machine.

Inject payload into a script for backup.tar to run.

Once opened, change the permissions of the files and run it.

I get a shell on my listener.

Heading to GTFObins, I found the command to let us break out of the docker and give us a root shell.

I got in as root.