Sqli

RaspberryPi device that ran PiHole, which had default credentials. Once foothold was obtained, root was a simple sudo -l.

Eventually landed upon finding SQLi on /room.php?cod=, so we dump databases with sqlmap. Foothold is a simple phpMyAdmin credential login, then a phpMyAdmin 4.8.0 exploit to gain a shell. Root was obtained from exploiting root.service.

Boolean-based SQL injection, which gives access to a database, then we authenticated file fuzz leading to bypassing .htaccess in apache which gives RCE. Once foothold from RCE was obtained, we pivot as mark, find a local hosted web server, and exploit npm to root.

Windows machine first exploited with SQLi, getting admin to a website. Then there is a hidden file, which gives me execution to foothold. Eventually I extracted Firefox passwords, used Bloodhound to find out more about what we were looking at, and got a LAPS password to gain root.

SNMP enumeration to find credentials to gain a shell, which we then route to find Pandora CMS, which wa vulnerable to SQLi, to gain foothold. For root, $PATH was exploited.

Discovered SQLi to then enumerate the database, authenticate as admin, realize it is vulnerable to some sort of max character length exploit, pivoting from www-data to moshe, then yossi, and finally root.

Very intriguing machine, where we exploit multiple different endpoints and pivot in ways where I was precisely mentally evaluated.