Hack The Box - Europa Part 1

🎯 Objective

Obtain the user flag on the Hack The Box machine Europe by enumerating the web app and exploiting it for code execution.

🗺️ Target & Scope

• Host: 10.10.10.22
• Virtual hosts (added to /etc/hosts):
  text Copy

  10.10.10.22   www.europacorp.htb
  10.10.10.22   admin-portal.europacorp.htb

⚡ TL;DR

1. Basic recon (Nmap) + vhost discovery.
2. SQL injection against admin-portal with sqlmap → dump creds.
3. Crack MD5 and log in to the admin portal.
4. Use Tools → templated command execution (replace /ip_adress/ → REMOTE_ADDR) to run system commands.
5. Read user flag directly.

🔎 Recon

Nmap (top ports + service detection)

nmap -sC -sV -T4 -oA europe_initial 10.10.10.22

🌐 Web Enumeration

• Added the two discovered hostnames to /etc/hosts:
  text Copy

  10.10.10.22   www.europacorp.htb
  10.10.10.22   admin-portal.europacorp.htb

• Dirb/gobuster in the background revealed the admin portal:

💉 SQL Injection → Admin Creds

Enumerated the login form with sqlmap:

sqlmap -u 'https://admin-portal.europacorp.htb/login.php' --form --dbs --batch
sqlmap -u 'https://admin-portal.europacorp.htb/login.php' --form -D admin --all --batch
sqlmap -u https://admin-portal.europacorp.htb/login.php --data "email=whatever&password=whatever" --tables -D admin

Cracked the dumped MD5 with an online cracker:

Logged in as admin. The UI looked like a light-weight CMS; most actions didn’t change state, but the Tools tab did.

🛠️ Post-Auth Code Execution (Tools)

Inside Tools, there is a server-side routine that evaluates/prints content with a placeholder-style pattern. Experimentation showed that the sequence "/ip_adress/" is replaced with the client REMOTE_ADDR. By injecting shell content around it, arbitrary commands can be executed.

Request tampering & decoding in Burp:

Verified RCE by issuing simple commands (ls -la, cat ./...) via the Tools panel:

Read the user flag directly once filesystem access was confirmed:

📦 Loot

• ✅ user.txt retrieved (see screenshot above).

📜 Commands Cheatsheet

# Recon
nmap -sC -sV -T4 -oA europe_initial 10.10.10.22

# sqlmap (form-based, enumerate DBs and admin schema)
sqlmap -u 'https://admin-portal.europacorp.htb/login.php' --form --dbs --batch
sqlmap -u 'https://admin-portal.europacorp.htb/login.php' --form -D admin --all --batch
sqlmap -u https://admin-portal.europacorp.htb/login.php --data "email=whatever&password=whatever" --tables -D admin

🧠 Notes & Lessons

• Don’t forget vhosts: resolving admin-portal.* unlocked the whole path.
• When Tools/Utilities exist inside a CMS, look for template placeholders or string substitutions that can be coerced into command execution.
• Quick wins: If RCE is clunky, read flags directly via file reads before investing time into stable shelling.