Vaccine is a multi-stage machine that starts with an FTP server containing a password-protected ZIP archive, cracks the archive with John the Ripper, uses the extracted credentials to access a web application, then exploits SQL injection with sqlmap to achieve a shell. Privilege escalation uses a misconfigured sudo rule. This machine ties together credential extraction, automated SQLi, and Linux privesc in a realistic chain.
| Skill | Why it matters |
|---|---|
| ZIP password cracking with zip2john + John | Password-protected archives are common in backup exfiltration scenarios |
| sqlmap for automated SQL injection | The industry-standard automated SQLi tool — used when manual injection confirms vulnerability |
| sqlmap OS shell and file read | Escalating from SQLi to OS command execution via sqlmap's built-in features |
| sudo -l for privilege escalation | Checking what commands a user can run as root is the first privesc check on any Linux host |
Inspect index.php — the source code for the web application login. It contains hardcoded database credentials and the password hash for the admin account.
Login to the web app at http://10.129.x.x/ with admin / qwerty789. The dashboard shows a car search feature with a URL parameter — a clear SQLi candidate.
Confirm injection with sqlmap. Provide the authenticated session cookie so sqlmap can access the protected endpoint.
sqlmap detects the injection, identifies PostgreSQL as the backend, and drops into an os-shell. Upgrade immediately to a proper reverse shell.
| Flag | What it does |
|---|---|
| -u URL | Target URL with injectable parameter |
| --cookie | Session cookie for authenticated endpoints |
| --dbs | Enumerate all databases |
| --tables -D db | List tables in a specific database |
| --dump -T table -D db | Dump all rows from a table |
| --os-shell | Drop into an interactive OS shell via SQLi |
| --file-read /etc/passwd | Read a file from the server filesystem |
| --level=5 --risk=3 | Increase aggressiveness for harder targets |
| --batch | Suppress prompts — use defaults automatically |
| --technique=U | Restrict to UNION-based injection only |
The postgres user can run vi as root on a specific file. Since vi can spawn a shell from within itself, this is a clean privesc.
sqlmap's --os-shell goes directly from SQL injection to command execution in a single step — but it leaves significant forensic traces. In a real engagement, manual exploitation is preferable for stealth.
| Concept | Real-world relevance |
|---|---|
| Source code in backup archives | Backup ZIPs on FTP servers regularly contain hardcoded credentials and connection strings |
| MD5 for password storage | MD5 is not a password hash — it's a checksum. Cracking MD5 passwords takes seconds with rockyou.txt |
| sqlmap --os-shell | Fastest path from SQLi to shell — but noisy. Manual UNION-based exploitation is more surgical |
| sudo -l is always step one | Check sudo permissions immediately on every Linux shell — it's the most common privesc path in CTFs and real assessments |
⚠️ Legal Disclaimer: This content is for educational purposes only. Always ensure you have proper authorization before testing