HackTheBox - Gavel

This video demonstrates the exploitation of Hack The Box machine "Gavel," focusing on a unique SQL injection technique by manipulating column names within prepared statements to bypass standard protections and gain initial access 0:04.

Key Takeaways:
• The machine features a novel SQL injection vector where the attacker controls the column name in a prepared statement, allowing for significant manipulation of the SQL query structure 0:08.
• Initial enumeration involves running Nmap with default scripts, version detection, and verbose output to identify open ports and service versions 0:27.
• The core exploitation relies on source code analysis of the PHP web application to understand how the input is processed and how the injection can be leveraged effectively 0:19.
• Post-exploitation requires reversing a binary to understand its behavior, which is crucial for escalating privileges and completing the challenge 0:21.

The summary highlights how creative SQL injection techniques can simplify subsequent stages of a penetration test by revealing critical vulnerabilities in the application logic.

Sources:

• 0:04 Introduction to the Gavel machine and its unique SQLi vector
• 0:08 Explanation of injecting into column names in prepared statements
• 0:19 Importance of PHP source code analysis
• 0:21 Need for binary reversing for privilege escalation
• 0:27 Initial Nmap scanning strategy