HackTheBox - Example Machine 🔗

This is a sample CTF writeup demonstrating the content structure for CTF challenges.

Machine Info 🔗

• Platform: HackTheBox
• Difficulty: Medium
• Points: 30
• Category: Web

Enumeration 🔗

First, let's start with a basic nmap scan:

nmap -sV -sC -oA example 10.10.10.100

Results show:

• Port 22 (SSH)
• Port 80 (HTTP)
• Port 3306 (MySQL)

Initial Foothold 🔗

The web application has a login form vulnerable to SQL injection:

' OR '1'='1' --

Privilege Escalation 🔗

After gaining initial access, we find a misconfigured sudo permission:

sudo -l
# User can run /usr/bin/vim as root

Flag 🔗

The root flag was found at /root/root.txt.

Lessons Learned 🔗

• Always sanitize user input
• Principle of least privilege for sudo permissions
• Regular security audits are essential