Hackthebox - Cronos

From nmap, there are ssh, dns, and http service opened.

This is the web page.

With zone transfer, I got other domains to access.

There is a login page in admin.cronos.htb.

Run sqlmap to see if there is SQL Injection. And yes, there really is.

I dumped the table users, and get username admin and its md5hash password.

I login with SQL Injection.

We can run traceroute or ping from the web page with user provided parameters.

I tried command injection, and it works.

I can give myself a reverse shell as www-data.

With pspy64, I found that root runs artisan every minute.

It is a php file. I add a command to give me a reverse shell at the end of the file.

And get a reverse shell as root.