Chaining IDOR and Command Injection to Fully Own HwatNetOps

Another box, another win. HwatNetOps is a deliberately vulnerable internal network operations portal and today I'm going to walk through how I chained two vulnerabilities together to go from zero access to reading the flag off the server. Nothing crazy, just clean recon and knowing what to look for.

Recon: What Are We Working With?

The app greeted me with a login page. No hints, no source code, pure black box. I created a throwaway account just to get a feel for the app from the inside.

Spotting the IDOR

Once logged in I headed straight to my profile page. The URL told me everything I needed to know:

http://127.0.0.1:8080/account.php?id=1008

http://127.0.0.1:8080/account.php?id=1008

A numeric ID in the URL with no access control check is a textbook IDOR. The app was exposing full account details including the password in plaintext. I changed the ID and started enumerating other accounts.

Grabbing the Admin Credentials

id=1007 hit the jackpot. Admin account, credentials sitting right there in plaintext.

Username: netadmin Password: N3twork0ps!

Done. IDOR exploited.

Logging In as Admin

Signed out, logged back in with the stolen creds. The navbar now had an "Admin Panel" link that wasn't available to regular users.

Finding the Command Injection

Admin Panel led me to a "Network Diagnostics" tool. It took a hostname and a port and ran a ping against it. Anytime a web app takes user input and passes it to a system command, it's worth testing for injection.

I ran a normal ping first to see the output format, then injected:

127.0.0.1; id

127.0.0.1; id

The server executed it. RCE confirmed.

Enumerating the Server

With code execution in hand I read /etc/passwd to map out the users on the box. At the bottom was a user called hwatsauce with a home directory at /home/hwatsauce.

Listed the directory, found user.txt, read it.

Flag

The Chain

IDOR gave me the admin password. Admin access unlocked the diagnostic tool. The diagnostic tool had no input sanitization so command injection was trivial. From there it was just a matter of poking around the filesystem until I found the flag. Two vulnerabilities, one clean chain, box owned.

Contents