DEV Community

Cover image for VulnNet - TryHackMe Writeup
Yogeshwar Peela
Yogeshwar Peela

Posted on Originally published at exploitnotes.hashnode.dev

VulnNet - TryHackMe Writeup

#cybersecurity #sqlmap #writeup #ctf

Difficulty: Medium

Reconnaissance

Port Scan 

nmap -sCV -A <MACHINE-IP> -oA nmap-VulnNet
Enter fullscreen mode Exit fullscreen mode

Two open ports:

Port Service
22 OpenSSH 7.6p1 (Ubuntu)
80 Apache 2.4.29

The HTTP root served a "coming soon" countdown page for VulnNet Entertainment.

Added the target to /etc/hosts:

echo '<MACHINE-IP> vulnnet.thm' | tee -a /etc/hosts
Enter fullscreen mode Exit fullscreen mode

Virtual Host Enumeration

The main domain revealed nothing interesting, so vhosts were fuzzed:

ffuf -u http://vulnnet.thm \
  -H "HOST: FUZZ.vulnnet.thm" \
  -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-20000.txt -ac
Enter fullscreen mode Exit fullscreen mode

Four subdomains discovered:

Subdomain Notes
api.vulnnet.thm Returns VulnNet API is up!
blog.vulnnet.thm Public blog site
shop.vulnnet.thm Shop frontend
admin1.vulnnet.thm Redirects to TYPO3 CMS login

All four were added to /etc/hosts:

echo '<MACHINE-IP> api.vulnnet.thm blog.vulnnet.thm shop.vulnnet.thm admin1.vulnnet.thm' | tee -a /etc/hosts
Enter fullscreen mode Exit fullscreen mode

SQL Injection → Credentials

Discovering the Injection Point

Visiting http://api.vulnnet.thm confirmed the API was live. Opening the blog at http://blog.vulnnet.thm/post1.php and inspecting via browser DevTools (Network tab) revealed the API call being made in the background — also visible in the page source: