Post cover image
Privilege escalation completed and root access obtained on the DC-9 lab machine.

September 7, 2026

DC-9 (🔐 DC-9 Walkthrough: From SQL Injection to Root Access)

DC-9 Penetration Testing Lab: From SQL Injection to Root Access

By Jari Saikrishna

5 min read

DC-9 Penetration Testing Lab: From SQL Injection to Root Access

A practical journey through web enumeration, SQLMap, LFI, port knocking, SSH, and Linux privilege escalation.

Lab disclaimer:_ This write-up is based on an intentionally vulnerable machine used for authorized cybersecurity practice. The techniques should only be performed in environments where you have permission._

Introduction

The DC-9 machine was one of the most interesting penetration-testing labs I have completed because it required more than simply running one exploit.

The challenge involved connecting several findings together:

Web Enumeration → SQL Injection → Credential Discovery → LFI → Port Knocking → SSH → Linux Enumeration → Privilege Escalation → Root

This lab helped me understand how vulnerabilities in different parts of a system can be chained to achieve complete access.

1. Initial Enumeration with Nmap

The first step was to identify the target's available services.

nmap -sC -sV -p- -Pn <TARGET-IP>

What I learned

  • -sC runs default NSE scripts.
  • -sV detects service versions.
  • -p- scans all TCP ports.
  • -Pn skips host discovery.

The web service was accessible, while SSH initially appeared to be filtered.

Key lesson: A filtered port does not always mean the service is unavailable. It may require additional conditions before access is allowed.

2. 🦊 Burp Suite + FoxyProxy

After opening the web application, I configured Firefox to send traffic through Burp Suite using FoxyProxy.

In Burp Suite:

Proxy → Intercept → Intercept ON

I then submitted a search request through the website.

Burp captured the HTTP POST request.

The important part was the search parameter:

POST /results.php HTTP/1.1
...
search=123

I saved the captured request into:

brup.txt

This request would later be supplied to SQLMap.

None

3. 💉 SQL Injection with SQLMap

Instead of manually modifying the request, I supplied the captured HTTP request to SQLMap.

sqlmap -r brup.txt --dbs --batch

SQLMap identified the injection point in the search POST parameter.

It detected the backend as:

MySQL

and discovered databases including:

information_schema
Staff
users

🧠 What I learned

SQLMap can automate several stages of SQL Injection testing:

Injection Detection
       ↓
DBMS Detection
       ↓
Database Enumeration
       ↓
Table Enumeration
       ↓
Data Extraction
None

4. 🗄️ Dumping the Database

Once the databases were identified, I investigated the Staff database.

sqlmap -r brup.txt -D Staff --dump

SQLMap identified tables such as:

Users
StaffDetails

The Users table contained an administrative account and its password hash.

I then examined the users database:

sqlmap -r brup.txt -D users --dump

This revealed a UserDetails table containing usernames and passwords.

None None None None

5. 🔑 Credential Discovery → Admin Access

The recovered credentials could then be used to authenticate to the web application.

After successful authentication, I gained administrative access.

🎯 FLAG 1

For a public Medium article, I recommend not displaying the actual flag.

Instead, show:

FLAG 1 — Captured
None

6. 📂 Local File Inclusion — LFI

While exploring the application, I discovered a file parameter that could be manipulated.

I tested whether the application could access local files.

The application returned the contents of /etc/passwd.

This indicated a Local File Inclusion (LFI) vulnerability.

🧠 Why this mattered

LFI became important because it allowed me to read files that were not intended to be directly accessible through the web application.

None

7. 🔐 Discovering the Port-Knocking Configuration

The initial Nmap scan showed SSH as filtered.

Using the LFI vulnerability, I was able to investigate the system configuration and locate:

/etc/knockd.conf

The configuration contained the port-knocking sequence.

This was an important discovery because it explained why SSH was not immediately accessible.

🧠 Key concept

Port knocking can be used to keep a service hidden until a predefined sequence of connection attempts is received.

8. 🚪 Port Knocking → SSH

After discovering the sequence, I used the knock utility in the lab.

knock <TARGET-IP> <PORT1> <PORT2> <PORT3>

I then performed another Nmap scan.

SSH was now accessible.

This was a great example of how one vulnerability can lead to another attack surface

9. 🔓 SSH Credential Auditing with Hydra

With SSH accessible, I tested the discovered usernames and password list against the SSH service.

hydra -L users.txt -P password.txt ssh://<TARGET-IP>

Hydra identified valid credentials.

None

10. 💻 SSH Login & Linux Enumeration

After obtaining valid credentials, I connected through SSH:

ssh <USERNAME>@<TARGET-IP>

I started enumerating the user's home directory:

ls -la

An interesting hidden directory was discovered:

.secrets-for-putin

Inside it was:

passwords-found-on-post-it-notes.txt

I examined the file:

cat passwords-found-on-post-it-notes.txt

This provided another password list.

None

11. 👤 Finding Another SSH User

I used the newly discovered password information to perform another credential audit.

hydra -L users.txt -P password.txt ssh://<TARGET-IP>

A second valid SSH account was identified.

I then connected using SSH and continued enumerating the system.

None

12. ⚙️ Privilege Escalation with sudo

The next step was checking the user's sudo permissions:

sudo -l

This revealed a command that the user could execute with elevated privileges.

The key lesson here was:

Always check sudo -l after gaining local access.

Misconfigured sudo permissions can sometimes provide a path to privilege escalation.

13. 📝 Understanding /etc/passwd

I also examined:

cat /etc/passwd

The standard structure is:

username:x:UID:GID:GECOS:home:shell

One particularly important concept is:

UID = 0

UID 0 represents the root account.

For the lab's privilege-escalation path, a specially crafted account entry was prepared using a password hash generated with:

openssl passwd -1 -salt <SALT> <PASSWORD>

The important conceptual point was creating an account associated with UID 0.

None None None

14. 👑 Root Access

After using the permitted sudo functionality in the lab to modify /etc/passwd, I switched to the prepared account:

su <USER>

Then verified the current identity:

whoami

Result:

root

🎯 Root access achieved.

15. 🏆 Final Flag

Finally:

cd /root
ls

The final flag file was present.

cat theflag.txt

🎉 DC-9 completed!

None

🧠 What DC-9 Taught Me

The most valuable lesson from this machine was that penetration testing is not always about finding one huge vulnerability.

It is about connecting multiple findings.

Nmap
 ↓
Web Application
 ↓
Burp Suite
 ↓
SQL Injection
 ↓
SQLMap
 ↓
Database Credentials
 ↓
Admin Access
 ↓
LFI
 ↓
knockd.conf
 ↓
Port Knocking
 ↓
SSH
 ↓
Credential Auditing
 ↓
Linux Enumeration
 ↓
sudo Misconfiguration
 ↓
Privilege Escalation
 ↓
ROOT

Each individual discovery became useful when combined with the next one.

🎯 Key Skills Practiced

Networking & Enumeration

  • Nmap
  • Service enumeration
  • Port states

Web Security

  • Burp Suite
  • FoxyProxy
  • HTTP POST requests
  • SQL Injection
  • LFI

Database Security

  • SQLMap
  • Database enumeration
  • Table enumeration
  • Credential discovery

Linux & Authentication

  • SSH
  • Hydra
  • Linux enumeration
  • /etc/passwd
  • UID/GID

Privilege Escalation

  • sudo -l
  • Sudo misconfiguration
  • Root access