HTB Gavel

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://0xdf.gitlab.io/2026/03/14/htb-gavel.html
• Blog Title: HTB: Gavel
• Suggested Section: Pentesting Web -> File Inclusion/Path traversal (add/extend: Exposed /.git source disclosure + git-dumper) AND Pentesting Web -> SQL Injection (add/extend: ORDER BY / identifier-based SQLi with backticks, PDO limitations) AND Pentesting Web -> Command Injection / RCE (PHP) (add: runkit-enabled rule engine code execution) AND Linux Privilege Escalation -> (add: PHP sandbox escape via php.ini overwrite when file write primitives exist)

🎯 Content Summary

Scope / attack chain (end-to-end)

HackTheBox Gavel (Linux) hosts a PHP auction website. The post’s full compromise chain is:

1. Web misconfiguration: public /.git/ exposure → reconstruct full source with git-dumper.
2. SQL injection: exploit a “novel SQL injection technique” that bypasses PDO’s backtick-quoted prepared statement style to dump the database.
3. Credential at...

   🔧 Technical Details

   Exposed /.git → full source recovery: If a web server exposes the Git metadata directory, an attacker can reconstruct the repository (often including commit history) and audit the application offline. Tooling example: install git-dumper (e.g., uv tool install git-dumper) and run git-dumper http://TARGET/.git OUTDIR/ to fetch HEAD, index, refs, and objects/. This frequently reveals hidden endpoints, SQL query construction, secrets, and privileged functionality.

   SQLi via user-controlled SQL identifiers despite PDO: PDO parameter binding protects values but not identifiers (table/column names). If an app concatenates a user-controlled identifier into SQL (commonly for ORDER BY) and only wraps it in backticks (e.g., ORDER BY `<input>`), this is not true parameterization and may be bypassable, leading to DB d...

   🤖 Agent Actions

   Summary of updates:

   1. Added exposed /.git source disclosure with git-dumper workflow to src/pentesting-web/file-inclusion/README.md and added the blog to References.
   2. Added ORDER BY / identifier-based SQLi (PDO limitation) guidance to src/pentesting-web/sql-injection/README.md and added the blog to References.
   3. Added runkit-enabled PHP rule engine RCE notes to src/pentesting-web/command-injection.md and added the blog to References.
   4. Added PHP sandbox escape via php.ini overwrite to src/linux-hardening/privilege-escalation/write-to-root.md and added the blog to References.

   Files modified:

   • src/pentesting-web/file-inclusion/README.md
   • src/pentesting-web/sql-injection/README.md
   • src/pentesting-web/command-injection.md
   • src/linux-hardening/privilege-escalation/write-to-root.md

   Tests not run (not requested).

   If you want, I can also tighten the new SQLi section with concrete payload examples for MySQL/PostgreSQL identifier escape behavior or add a short detection checklist.

   ---

   This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://0xdf.gitlab.io/2026/03/14/htb-gavel.html

Content Categories: Based on the analysis, this content was categorized under "Pentesting Web -> File Inclusion/Path traversal (add/extend: Exposed /.git source disclosure + git-dumper) AND Pentesting Web -> SQL Injection (add/extend: ORDER BY / identifier-based SQLi with backticks, PDO limitations) AND Pentesting Web -> Command Injection / RCE (PHP) (add: runkit-enabled rule engine code execution) AND Linux Privilege Escalation -> (add: PHP sandbox escape via php.ini overwrite when file write primitives exist)".

Repository Maintenance:

• MD Files Formatting: 954 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0