--- title: "HTB: Cobblestone" url: https://daily.dev/posts/htb-cobblestone-jxhw7xtg4 source_url: https://0xdf.gitlab.io/2026/08/15/htb-cobblestone.html type: article source: "0xdf hacks stuff" published: 2026-08-15T15:02:54.542Z updated: 2026-08-15T15:33:44.942Z tags: ["php", "sql"] reading_time: 75 upvotes: 0 comments: 0 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # HTB: Cobblestone **[0xdf hacks stuff](https://daily.dev/sources/0xdf)** · 75 min read · 0 upvotes · 0 comments ## Summary A walkthrough of the Hack The Box machine Cobblestone, a cluster of Minecraft-themed PHP sites spread across subdomains. The attack chain starts with a second-order SQL injection used to leak application source, followed by stored XSS to hijack an admin session, then Twig server-side template injection for code execution as www-data, hardened by AppArmor. Database credentials are cracked to gain SSH access, and Cobbler running as root is abused via default credentials and an authentication bypass to gain a root shell. A bonus section explains why the SQL injection crashes the page. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How does a second-order SQL injection differ from a regular SQL injection in a PHP application? A second-order SQL injection occurs when unsanitized user input is stored in a database first, then later retrieved and concatenated into a new query without sanitization, triggering the injection at that later point rather than immediately. In one example, a URL value submitted through a prepared statement insert is later pulled from the database and inserted directly into a raw SQL string in a second query, causing the injection. _daily.dev surfaces writeups like this for developers hardening apps against stored-input SQL injection._ ### How can Twig's createTemplate function lead to server-side template injection? Passing raw user input directly into Twig's createTemplate() method and calling render() on it allows an attacker to inject Twig template syntax that executes arbitrary template logic, since the input is compiled and rendered as a template rather than treated as plain data. Restricting this to admin-only access does not prevent exploitation once an attacker gains admin session control through another vulnerability like stored XSS. _Developers vetting Twig usage patterns can track SSTI pitfalls like this on daily.dev._ ### Why would a PHP SQL query break when an ID parameter contains a quote but not when it contains a trailing letter? PHP's loose type coercion converts a string like "1abc" or "1.1e1" to the leading numeric value when used in numeric contexts, so queries built with such values still resolve to a valid integer ID and succeed. A raw single quote instead gets treated as literal data inserted into a query, which can break the SQL syntax and crash the page depending on how the query is constructed downstream. _daily.dev helps developers stay sharp on PHP type-juggling quirks that cause subtle backend bugs._ ## Similar posts on daily.dev - [HTB: HackNet](https://daily.dev/posts/htb-hacknet-ytv8gsdvp) · 0xdf hacks stuff · 0 upvotes · 0 comments - [HTB: Gavel](https://daily.dev/posts/htb-gavel-rtb5bp6m9) · 0xdf hacks stuff · 0 upvotes · 0 comments - [HTB: Orion](https://daily.dev/posts/htb-orion-p1pnwvkbh) · 0xdf hacks stuff · 0 upvotes · 0 comments --- Tags: [#php](https://daily.dev/tags/php), [#sql](https://daily.dev/tags/sql) [View this post on daily.dev](https://daily.dev/posts/htb-cobblestone-jxhw7xtg4)