GithubTwitterTryHackMeHackTheBox
Page cover

THM Machine: Overpass

Link: TryHackMe: Overpass

Overview

Overpass 1 logo

What happens when a group of broke Computer Science students try to make a password manager? Obviously a perfect commercial success!

Scanning

Tool: Nmap

Command:

  1. -sC: Scan with common scripts

  2. -sV: Scan with Service Version detection

  3. -A: Scan in Aggressive Mode(Traceroout, OS detection,)

  4. -oN: Save Output in Normal Format

Scan Results/Report

As we can see from the nmap scan report there are 2 open ports

  1. Port 22 for ssh

  2. Port 80 for http

Assumption

As there are two open ports so and now we know our attacking area. SSH required Username and Password or Username and Key to get the system access but that takes time and the success rate is low so we ignore it right now and move into the HTTP. Target has a web server/web application running on port 80 and that has a good area for the attack so we enumerate this and find a way to exploit the system

Enumeration

Web Directories Scanning

Tool: ffuf

Command:

  1. -w: For Directory Scanning Wordlist i.e directory-list-2.3-small.txt from Seclists

  2. :FUZZ: This is a keyword that passes to the ffuf that tells ffuf where they have to start Fuzzing

  3. -u: For give him a URL of the Target

  4. -ic: ignore wordlist comments

OR you can use gobustor for this also

Command:

  1. dir: Tell gobustor that we scan for Directories

  2. -w: For Directory Scanning Wordlist i.e directory-list-2.3-small.txt from Seclists

  3. -u: To tell gobuster to scan in this URL

Results:

Findings:

As we can see from the result that there are hidden directory /admin that have a login panel that required a username and password for login I tried some common passwords like admin:admin and they are incorrect so we bruteforce it for login credentials but in THM hint they say "OWASP Top 10 Vuln! Do NOT bruteforce." so we don't have to bruteforce this we have to find a vulnerability from its source code and press CTRL + U to get the source code and we can see there are three js file on the source

  1. main.js

  2. login.js

  3. cookie.js

The login function is work with the javascript name called login.js as we can see so we can read it to know how login work. As in the login.js file when we see the following function

They are just used if else for login checks. when we enter some credentials they call /api/login to check credentials from creds if the credentials don't match they send a response "Incorrect credentials". Else set a cookie with a javascript function cookie. set with the SessionToken with the value statusorcookie variable response now further check for session token so we can use it with our own made session token with the value of something we want with following js function

Use this function of your browser js console in inspector mode/Develpor Mode use CTRL + SHIFT + I in Chrome to go to inspector mode when you use this function on your browser console they set a cookie with the `session token with the value admin so just reload the page and you got a login to the Administrator area

There you can see some messages to the person named James that says

This message has an SSH private key for user James but this private key has a password on it but we can crack it

Exploitation

So we have an SSH private key for user James but this key has a password set on the key so we have to crack that ssh key password first to login to the system first so to do that we have to copy the private key to a file, for now, I name it id.rsa

Tool: ssh2john

Command:

  1. ssh2john: Script name

  2. id.rsa: Private key file that we want to crack

  3. --wordlist: For wordlist that they use to crack passwords i.e rockyou.txt

  4. id.hash: This will create a file name id.hash and write/redirect all the output of the ssh2john file and save it into your directory

Result:

This command first changes the ssh private key format into a hash format that the JohnTheRipper tool will understand and save it into your system directory with the name id.hash. Now we can crack that hash with john/JohnTheRipper

Tool: john

Command:

  1. john This is a tool used to crack password hashes

  2. id.hash This is the hash file that creates by the ssh2john in the above task

  3. --wordlist= This is used to specify password wordlist i.e rockyou.txt

Result:

This command gives us the password of the private key so now we can login to the James user using ssh

Initial Access

So we have the Private key, Username, and Private Key password so now we are fully capable of login into the system but first we have to change the private key permission as only we can read and write it no one else

Command:

  • This command changes the permission of the private key so only we can read it

Now time to login using ssh

Result:

So we have now access to the James user. use the *ls command to see the files

Cat user.txt file to see the flag.

Privilege Escalation

There is also a file name todo.txt as you can see above and this has the following thing this show on the last line they update the overpass build on the website from somewhere on the system using some unknown method for us

So let's start exploring some priv-escalation vectors

  1. First search some SUID binaries using the find command like following

Result:

So we could not find something interesting in SUID bit binaries so we have to dig more

  1. Search for common files like

  • /etc/shadow

  • /etc/passwd

  • /etc/crontab

  • /etc/hosts

As we can see from above the *crontab file is readable so we can check it

So the crontab the file shows us the method they use to update their overpass build with the latest code. They use curl to the overpass.thm/downloads/src/buildscript.sh and pipe this into bash and they are run as a root so this will be our priv-escalation vector if we can abuse this. We know from the Above that the/etc/hosts file are read and writable so we can use this to change its local DNS file and leverage it into run our own script that gives us a root shell by using the following commands

This is the content of the /etc/hosts file and I change the 127.0.0.1 IP of the 3rd line with my machine IP Address. Now go to your machine and make a directories name downloads/src/ like the following

This will create a downloads directory and inside it they also create src directory

Now go src directory using the following command

Now make a file with the name buildscript.sh

Now write the file with the following revershell in the file

Pentestmonkey PHP reverse shell

Note: Change the IP Address with your machine IP and PORT with 8080

Now start the Python server Using the following command

Note: Start the server on the same directory where you create downloads directory not in the src directory

Now open a listener on the system using the following command

Now wait for the script to execute on the system. When the script executes on the system you got the connection from your nc listener and your got root access to the system

Now cat the root.txt and submit it to Tryhackme

THM Overpass Answers

Q: Hack the machine and get the flag in user.txt

Hint: OWASP Top 10 Vuln! Do NOT brute force.

Q: Escalate your privileges and get the flag in root.txt

PreviousTHM Room: OWASP Top 10 AnswersNextTHM Machine: Overpass 2 - Hacked

Last updated

Was this helpful?