Hack the Box — Sequel
--
HTB Tags: #Linux #SQL #SQLi #MariaDB #WeakPassword
This is the second box in Tier 1, as part of the Starting Point series, with a focus on database access through an open port on a Linux target. As usual, let’s start by enumerating with the standard commands, ping and nmap and see where we get to.
ping
ping $IP -c 4
nmap
nmap -sC -sV -A $IP -p-
ports
Checking the port details on speedguide we see that this is normally an SQL port. It is showing as a MariaDB. One of the many applications/variants of MySQL, a service designed for database management: creating, modifying, and updating databases, changing and adding data, and much more.
We should try to see if we can access the database remotely. MySQL clients usually authenticate with the service with a username/password combination, however, we should test for password-less authentication, in-case there might be an intentional mis-configuration, which would database creators/managers to allow them to log into the service during the deployment stage of the project to easily interact with it before making it available to the rest of the community. Let’s try to log in as root, and see if we can get full privileges.
mysql
mysql -h $IP -u root
So now we have access to the MariaDB, we can start to enumerate the file. You can utilise help in this stage both for client and server either by:
\h
help contents
These commands are well outside the remit of this walk through, but worthwhile learning in the long run when you start to understand and appreciate the amount of databases on these vulnerable systems.
So let’s check out the database itself.
show databases
We can see four databases are visible. Let’s check out the htb as it seems to be appropriate! Let’s access a table by using it.
use htb
Now we have the two tables. Lets look at them in order. In this case the * is a wildcard for ALL, so in normal speech it would be select all from table config
select * from config
OK we now have the flag which ends this challenge.
summary
This was a nice introduction into sql databases. The basic commands that we used to move between the online databases are well worth learning.
- SHOW databases; [Prints out the databases we can access.]
- USE {database_name}; [Set to use the database named {database_name}.]
- SHOW tables; [Prints out the available tables inside the current database.]
- SELECT * FROM {table_name}; [Prints out all the data from the table {table_name}.]
In the same way a basic sql online course will definitely be worth while as you progress through your hacking/pen-testing career.
