PORT     STATE SERVICE VERSION
22/tcp   open  ssh     OpenSSH 7.6p1 Ubuntu 4ubuntu0.7 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 2e:b2:6e:bb:92:7d:5e:6b:36:93:17:1a:82:09:e4:64 (RSA)
|   256 1f:57:c6:53:fc:2d:8b:51:7d:30:42:02:a4:d6:5f:44 (ECDSA)
|_  256 d5:a5:36:38:19:fe:0d:67:79:16:e6:da:17:91:eb:ad (ED25519)
80/tcp   open  http    Apache httpd 2.4.29 ((Ubuntu))
|_http-title: Let's begin your education with us! 
|_http-server-header: Apache/2.4.29 (Ubuntu)
8000/tcp open  http    Apache httpd 2.4.38
|_http-title: 403 Forbidden
|_http-server-header: Apache/2.4.38 (Debian)

(May 28, 2022, 07:52 PM)iamnoone777 Wrote: I find some endpoint in the exam js file

And you should look at :

POST /classes/Login.php?f=login HTTP/1.1

Host: exam.seventeen.htb

Content-Type:application/x-www-form-urlencoded

Accept: */*

Referer: http://exam.seventeen.htb/?p=products&search=a

Accept-Encoding: gzip, deflate

Accept-Language: en-US,en;q=0.9

Cookie: PHPSESSID=ba748c37fe5ea0c4d511c49449dc532a

Connection: close

Content-Length: 33



username=admin&password=test

(May 28, 2022, 08:11 PM)Exa Wrote: There are three folders under http://seventeen.htb/vendor/:
exams
mastermailer
oldmanagement

(May 28, 2022, 08:18 PM)Exa Wrote: There is an SQL injection vulnerability on http://seventeen.htb/vendor/oldmanagement/ (the stud_no parameter).

INSERT INTO `student` (`stud_id`, `stud_no`, `firstname`, `lastname`, `gender`, `yr&sec`, `password`) VALUES
(1, 12345, 'John', 'Smith', 'Male', '3A', '827ccb0eea8a706c4c34a16891f84e7b');

INSERT INTO `user` (`user_id`, `firstname`, `lastname`, `username`, `password`, `status`) VALUES
(1, 'Administrator', '', 'admin', '21232f297a57a5a743894a0e4a801fc3', 'administrator'),
(2, 'Claire', 'Temple', 'claire', '827ccb0eea8a706c4c34a16891f84e7b', 'Regular');

(May 28, 2022, 08:25 PM)iamnoone777 Wrote:

(May 28, 2022, 08:18 PM)Exa Wrote: There is an SQL injection vulnerability on http://seventeen.htb/vendor/oldmanagement/ (the stud_no parameter).

There is also credentials in http://seventeen.htb/vendor/oldmanagement/db/db_sfms.sql

INSERT INTO `student` (`stud_id`, `stud_no`, `firstname`, `lastname`, `gender`, `yr&sec`, `password`) VALUES
(1, 12345, 'John', 'Smith', 'Male', '3A', '827ccb0eea8a706c4c34a16891f84e7b');

INSERT INTO `user` (`user_id`, `firstname`, `lastname`, `username`, `password`, `status`) VALUES
(1, 'Administrator', '', 'admin', '21232f297a57a5a743894a0e4a801fc3', 'administrator'),
(2, 'Claire', 'Temple', 'claire', '827ccb0eea8a706c4c34a16891f84e7b', 'Regular');

(May 28, 2022, 08:47 PM)Exa Wrote:

(May 28, 2022, 08:25 PM)iamnoone777 Wrote:

(May 28, 2022, 08:18 PM)Exa Wrote: There is an SQL injection vulnerability on http://seventeen.htb/vendor/oldmanagement/ (the stud_no parameter).

There is also credentials in http://seventeen.htb/vendor/oldmanagement/db/db_sfms.sql

INSERT INTO `student` (`stud_id`, `stud_no`, `firstname`, `lastname`, `gender`, `yr&sec`, `password`) VALUES
(1, 12345, 'John', 'Smith', 'Male', '3A', '827ccb0eea8a706c4c34a16891f84e7b');

INSERT INTO `user` (`user_id`, `firstname`, `lastname`, `username`, `password`, `status`) VALUES
(1, 'Administrator', '', 'admin', '21232f297a57a5a743894a0e4a801fc3', 'administrator'),
(2, 'Claire', 'Temple', 'claire', '827ccb0eea8a706c4c34a16891f84e7b', 'Regular');

These credentials are different from the ones I read out via sqlmap. So far, I found three tables containing password hashes. One is for the student login.