Appointment is a Very Easy Linux machine that introduces SQL Injection (SQLi) vulnerabilities in web applications. The machine runs a simple login page vulnerable to SQL injection, allowing authentication bypass and flag retrieval.

Path to root, at a glance:

  • Scan the target → discover port 80 (HTTP) running Apache
  • Visit the web application → find a login page
  • Perform SQL injection to bypass authentication
  • Retrieve the flag from the successful login page

Nmap

┌──(r3vpwnx㉿r3vpwnx)-[~/CTF/HTB]
└─$ sudo nmap -Pn -A 10.129.124.108                 
Starting Nmap 7.99 ( https://nmap.org ) at 2021-10-06 09:13 -0400
Nmap scan report for 10.129.124.108
Host is up (0.43s latency).
Not shown: 999 closed tcp ports (reset)
PORT   STATE SERVICE VERSION
80/tcp open  http    Apache httpd 2.4.38 ((Debian))
|_http-title: Login
|_http-server-header: Apache/2.4.38 (Debian)
Device type: general purpose|router
Running: Linux 4.X|5.X, MikroTik RouterOS 7.X
OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5 cpe:/o:mikrotik:routeros:7 cpe:/o:linux:linux_kernel:5.6.3
OS details: Linux 4.15 - 5.19, MikroTik RouterOS 7.2 - 7.5 (Linux 5.6.3)
Network Distance: 2 hops

TRACEROUTE (using port 554/tcp)
HOP RTT       ADDRESS
1   406.72 ms 10.10.14.1
2   407.01 ms 10.129.124.108

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 26.74 seconds

The scan reveals:

  • Port 80/tcp: HTTP (Apache 2.4.38 on Debian)
  • Title: “Login” - indicates a web login page
  • OS: Linux (4.15 - 5.19)

The Application

Visiting http://10.129.124.108 in a browser reveals a login page with username and password fields. The page appears to be vulnerable to SQL injection.

Exploitation: SQL Injection

Understanding SQL Injection

SQL Injection is a code injection technique that exploits vulnerabilities in an application’s database query layer. Attackers can manipulate SQL queries by injecting malicious input into user-controlled fields.

Testing for Vulnerability

The classic test for SQL injection is to enter a single quote (‘) to see if it breaks the query:

Username: admin'
Password: anything

If the application returns an error, it’s likely vulnerable to SQL injection.

Authentication Bypass

To bypass authentication without knowing the password, we can use a comment to terminate the SQL query and make it always return true:

Payload:

Username: admin
Password: test' OR 1=1#

How it works:

SELECT * FROM users WHERE username='admin' AND password='test' OR 1=1#'

The SQL query becomes:

  • password=’test’ - checks if password matches (false)
  • OR 1=1 - always true, bypasses the password check
  • # - comments out the rest of the query

Since 1=1 is always true, the query returns the admin user’s record, bypassing authentication.

Flag Retrieval

After successful login with the SQL injection payload, the page displays:

Congratulations!
Your flag is: e3d0***********************672
image

Task Answers

  1. What does the acronym SQL stand for? Structured Query Language
  2. What is one of the most common type of SQL vulnerabilities? SQL Injection
  3. What is the 2021 OWASP Top 10 classification for this vulnerability? A03:2021-Injection
  4. What does Nmap report as the service and version on port 80? Apache httpd 2.4.38 ((Debian))
  5. What is the standard port used for HTTPS protocol? 443
  6. What is a folder called in web-application terminology? directory
  7. What is the HTTP response code for ‘Not Found’ errors? 404
  8. What switch do we use with Gobuster to specify directories? dir
  9. What single character can be used to comment out a line in MySQL? #
  10. What is the first word on the webpage after bypassing login? Congratulations