HTB - Soccer
TL;DR - Foothold through Tiny File Manager running with default credentials, uploading a PHP web shell. A hidden vhost soc-player.soccer.htb exposes a ticket feature that talks to the backend over a WebSocket, and its id field is blind-SQL-injectable. Bridging the WebSocket through a small local HTTP shim lets sqlmap automate the extraction, leaking the player DB credentials, which are reused for SSH. Root comes from doas allowing player to run dstat, whose external-plugin mechanism loads an attacker-controlled Python module. ...