Trick

Machine Profile

OS: Linux Difficulty: Easy IP: 10.10.11.166 Domains: trick.htb, preprod-payroll.trick.htb, preprod-marketing.trick.htb Pwned: 9 Jan 2026 (user + system) Key techniques: DNS zone transfer · SQLi auth bypass · LFI · fail2ban service file abuse

---

Reconnaissance

Port Scan

22/tcp   open  ssh         OpenSSH 7.9p1 Debian
25/tcp   open  smtp        Postfix
53/tcp   open  domain      ISC BIND 9.11.5
80/tcp   open  http        nginx 1.14.2

The Coming-Soon Trap

Port 80 serves a Start Bootstrap "Coming Soon" theme. The contact form pretends to submit but actually just redirects to the StartBootstrap marketing page — no real backend.

Bootstrap 5.1.3 has no known CVEs. Dirsearch, gobuster, ffuf, nikto — nothing.

DNS Zone Transfer (the actual entry point)

Port 53 is open and the SMTP banner leaks the hostname trick.htb. Try an AXFR:

dig axfr @10.10.11.166 trick.htb

trick.htb.                  IN  SOA  trick.htb. root.trick.htb. ...
trick.htb.                  IN  NS   trick.htb.
preprod-payroll.trick.htb.  IN  A    127.0.0.1
preprod-marketing.trick.htb. IN A    127.0.0.1

Two internal subdomains revealed. Adding them to /etc/hosts and browsing reveals two new applications.

---

Initial Foothold — SQL Injection on Preprod Payroll

preprod-payroll.trick.htb hosts a login page (/login.php) for a payroll application. Classic single-quote test triggers a SQL error → it's vulnerable.

Bypass authentication with a textbook injection:

username:  ') OR '1'='1; --
password:  anything

Lands inside the payroll admin panel as Administrator. From there a few endpoints leak the local users (/users.php) and the application exposes a search field also vulnerable to SQLi — which can be used to dump database contents.

LFI → SSH Key

The marketing subdomain preprod-marketing.trick.htb has a ?page= parameter that, after the right filter bypass (....//), exposes local files:

http://preprod-marketing.trick.htb/index.php?page=....//....//....//etc/passwd

Pulling /etc/passwd reveals user michael. Pulling /home/michael/.ssh/id_rsa returns the SSH private key.

chmod 600 michael_key
ssh -i michael_key michael@10.10.11.166

user.txt is in ~.

---

Privilege Escalation — fail2ban Action File Write

sudo -l shows:

User michael may run the following commands on trick:
    (root) NOPASSWD: /etc/init.d/fail2ban restart

So michael can restart fail2ban as root. That's not directly useful — but if we can modify what fail2ban does on restart, we get code execution as root.

fail2ban's iptables-multiport.conf action file lives at /etc/fail2ban/action.d/iptables-multiport.conf. Group-write permissions on the action.d directory show:

michael@trick:/etc/fail2ban$ ls -la action.d
drwxrwxr-x 2 root  security 4096 ...

security is one of michael's supplementary groups → we can write to the directory.

The Action File Hijack

Edit iptables-multiport.conf and replace the actionban directive with a payload that copies bash and sets the SUID bit:

actionban = cp /bin/bash /tmp/rootbash && chmod 4777 /tmp/rootbash

Trigger a ban (any malformed request will do — fail2ban is watching SSH and the web app), then restart fail2ban:

sudo /etc/init.d/fail2ban restart

When the next ban fires, fail2ban runs our actionban as root and drops a SUID bash:

/tmp/rootbash -p
# whoami
# root

cat /root/root.txt — pwned.

---

HTB Pwn Confirmation

---

Key Takeaways

• Try AXFR on every open port-53 you see, even on machines that look like web boxes. It's a 5-second command that often hands you the entire DNS landscape.
• "Preprod" / "dev" / "staging" subdomains are where the bugs live. Production gets patched and audited; preprod ships with debug forms and test credentials.
• Group-writable config directories for services that root executes are a classic privesc pattern. Look for: cron.d, fail2ban action.d, supervisor conf.d, systemd unit override directories, logrotate.d.

---

Tools Used

nmap · dig · dirsearch · gobuster · Burp Suite · ssh · Manual SQLi · LFI exploitation