Interstellar

Technical Walkthrough

Writeup

Challenge

• Name: Interstellar
• Category: Web
• Difficulty: Medium
• Mode: hybrid

Summary

Interstellar is a PHP/Smarty web challenge where the intended chain combines an

old URL parser differential with a second-order SQL injection.

The working chain is:

1. Register and log in as a normal user.
2. Use communicate.php as an internal POST gadget with a PHP/cURL parser

differential URL.

1. Abuse that internal request to bypass the <secret redacted> == <TARGET> check on

the name-edit action.

1. Store a SQL injection payload as the current user's name.
2. Trigger /, which calls the vulnerable searchUser stored procedure and

evaluates the stored name inside dynamic SQL.

1. Use SELECT ... INTO OUTFILE to write a small PHP command runner into the

webroot.

1. Read the randomized root-level flag path with a shell glob.

Artifact Inventory

Reference analysis/artifact-inventory.json and summarize the relevant files or remote surface.

• files/a12c733c-03de-4b2c-9290-59ba1ef202ea.zip: original HTB archive.
• files/extracted/challenge/src/: PHP/Smarty application source.
• files/extracted/challenge/init.sql: database schema and stored procedures.
• files/extracted/challenge/Dockerfile: deployment detail showing the flag is

moved to a randomized root-level *_flag.txt path.

• analysis/url-parser-probe-pipe.txt: live validation of the parser

differential URL shape.

• analysis/ssrf-edit-probe.txt: live validation that SSRF can mutate the

localhost-only edit path.

• solve/solve.py: final reproducible solver.

Analysis

The source audit found three relevant facts:

• communicate.php validates a user-supplied URL with <secret redacted>,

parses it with parse_url, requires the parsed host to match

/motherland\.com$/, and then calls cURL using only $parsedUrl['host'].

• index.php?action=edit is protected by a direct localhost check using

$_SERVER['<secret redacted>'] != '<TARGET>', but accepts new_name without

sanitization when reached locally.

• init.sql defines searchUser(name) with dynamic SQL:

CONCAT('SELECT * FROM users WHERE name = \'', name, '\'').

The URL payload below passed the PHP-side suffix check but reached localhost

through cURL:

1232://user:pass@<TARGET>:80|motherland.com:80/

That was validated non-destructively in analysis/ssrf-edit-probe.txt by

changing a logged-in user's name through the localhost-only edit branch.

The final exploit stores a second-order SQLi payload as the user's name. A later

request to / calls searchUser($_SESSION['name']), which evaluates the

payload in the stored procedure. The payload writes a small PHP command runner

to a random filename in /var/www/html/, then the solver requests it to run

cat /*_flag.txt.

Solve

Run:

cd <local workspace>
python3 scripts/challenge_exec.py Web/Interstellar --phase exploit --output analysis/flag-candidate.txt -- python3 Web/Interstellar/solve/solve.py --base-url http://<TARGET>:32196 --output Web/Interstellar/analysis/flag-candidate.txt --debug-output Web/Interstellar/analysis/exploit-debug.txt
python3 scripts/challenge_harness.py capture-flag Web/Interstellar --from analysis/flag-candidate.txt

The solver creates a fresh account, performs the internal edit through

communicate.php, triggers the SQLi/webshell write, reads the flag, and writes

only the candidate output file for harness capture.

Flag

Raw flag is stored in loot/flag.txt and intentionally not reproduced here.

Lessons

• Parser-differential bugs must be validated against the exact runtime pair.

Here the PHP URL parser and cURL disagreed in a useful way.

• The SSRF was not the end goal; it was a local-origin primitive that unlocked a

second-order SQL injection.

• The randomized flag filename made INTO OUTFILE more useful than direct SQL

file reading, because a PHP shell could use filesystem globbing.

Source-Backed Dossier

The sections below are merged from companion Markdown notes for the same case. They are rendered after sanitization so the article stays precise without publishing raw flags, credentials, or target-specific secrets.

Notes

Scope

• Challenge: Interstellar
• Category: Web
• Difficulty: Medium
• Mode: hybrid
• Remote instance: none
• Start time: 2026-06-11T22:55:06Z
• Operator: harness
• State file: challenge-state.json

Harness Status

• Current phase: see challenge-state.json
• Next allowed actions: see next-action.json
• Raw flags and sensitive material stay in loot/ only. Do not paste them here.

Artifact Inventory

Evidence Ledger

Key Findings

• communicate.php validates the parsed host suffix but passes only parse_url($url)['host'] to cURL.
• The nonstandard URL 1232://user:pass@<TARGET>:80|motherland.com:80/ reaches localhost on the live service.
• The localhost-only edit branch can store an unsanitized new_name in the active session and database row.
• searchUser concatenates the stored name into dynamic SQL, creating a second-order SQL injection.
• The final exploit writes a small PHP command runner with SELECT ... INTO OUTFILE and reads the randomized root-level flag path using a shell glob.

RAG / Advisory Memory

RAG output is advisory only. Record evaluated retrievals with:

scripts/challenge_harness.py rag-record <workspace> --query "..." --tag MATCHED|PARTIAL|MISSING|<secret redacted>|GENERIC --validation "..."

Secrets/Flags

Raw flags and sensitive material stay in loot/ only. Use scripts/challenge_harness.py capture-flag to validate and record flag capture without printing the value.

Memory Summary

Metadata

• Platform: HackTheBox Challenges
• Category: Web
• Challenge: Interstellar
• Difficulty: Medium
• Source workspace: <local workspace>

Validated Solve Chain

Concepts only. Do not include raw flags, reusable credentials, tokens, cookies, private keys, or live secrets.

1.

Reusable Lessons

-

Dead Ends

-

Tool Quirks

-

Evidence Paths

-

Ingestion Decision

• Proposed for LightRAG: yes/no
• Requires user approval before ingestion: yes

Hypothesis Board

Keep no more than 3 active hypotheses on Easy/Medium and 5 on Hard unless the user explicitly asks for breadth.

Closed Branches