> For the complete documentation index, see [llms.txt](https://itszaiden.gitbook.io/pentesting/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://itszaiden.gitbook.io/pentesting/writeups/dockerlabs/very-easy/injection.md). # Injection SQL injection on the login panel revealed plaintext SSH credentials, allowing direct access to the system. ## 1 - Reconnaissance We begin with a fast Nmap scan to identify open ports: `nmap 172.17.0.2 -p- --open -sS -Pn --min-rate 5000 -T5` **Result: ports 22 and 80 are open** ## 2 - Enumeration Now we run a service/version detection scan, targeting only the open ports we found on the previous scan: `nmap 172.17.0.2 -p 22,80 -sS -Pn -sCV` **Result:**

(Injection) Targeted Port Scan

We tried to find exploits or shellcodes using `searchsploit OpenSSH 8.9p1` and \`searchsploit Apache httpd 2.4.52 but there wasn't any. Our next step will be directory enumeration. With the command `ffuf -w /path/to/wordlist/directory-list-2.3-medium.txt:FUZZ -u http://10.129.129.108/FUZZ` we didn't find anything useful, so we will browse the website,

(Injection) Web Content

## 3 - Exploitation As the machine name is `Injection` we will try a basic SQLi: ``` User: admin' or 1=1# Password: test ``` We logged succesfully and we found potential SSH credentials:

(Injection) Dylan Credentials

Trying them on SSH we log in successfully.

(Injection) SSH Login

## 4 - Summary **Initial Access:** Performed SQL injection on the website login form to bypass authentication and recover plaintext SSH credentials, which granted direct shell access.