Overpass
🔗 Overpass
Task 1 - Deploy the machine
🎯 Target IP: 10.10.164.129
Create a directory for machine on the Desktop and a directory containing the scans with nmap.
Task 2 - Reconnaissance
I prefer to start recon by pinging the target, this allows us to check connectivity and get OS info.
Sending these three ICMP packets, we see that the Time To Live (TTL) is ~64 secs. this indicates that the target is a *nix system (probably Linux), while Windows systems usually have a TTL of 128 secs.
2.1 - Find open ports on the machine
sudo
run as root
sC
run default scripts
sV
enumerate versions
A
aggressive mode
T4
run a bit faster
oN
output to file with nmap formatting
It looks like there are only two open ports on the machine: SSH and HTTP.
Task 3 - Hack the machine and get the flag in user.txt
We can strat to explore http://overpass.thm (port 80)
In the page source code we don't found nothing of interisting, the good route is to explore website hidden pathes using gobuster:
We found an administrator login page:
Looking at the source code of the page, we see that there are three js scripts, let's go look at them!
The login.js file contains a “login” function, which says that if the response of the authentication request is not “Incorrect Credentials” i.e. if the authentication was successful, it then sets the SessionToken to “statusOrCookie”:
Manually creating a SessionToken cookie with a value of “statusOrCookie” in the browser:
Task 3 - Escalate your privileges and get the flag in root.txt
Now, we're root!
Last updated