Lab: Example Machine
A walkthrough of the Example lab — SQLi to foothold, then SUID abuse for root.
Overview
Retired lab machine — easy difficulty, Linux target.
IP: 10.10.x.x | OS: Linux | Rating: Easy
Recon
nmap -sV -sC -p- 10.10.x.x -oA scans/initialOpen ports: 22 (SSH), 80 (HTTP).
Foothold
The login form at /login is vulnerable to UNION-based SQLi.
Payload hint
' UNION SELECT 1,username,password FROM users-- -Privilege Escalation
Found a SUID binary at /usr/local/bin/example. GTFObins has an entry.
/usr/local/bin/example -p
Discussion