The Sticker Shop
https://tryhackme.com/room/thestickershop
Task 1 - Deploy the machine
🎯 Target IP: 10.10.73.89
Create a directory for machine on the Desktop and a directory containing the scans with nmap.
Task 2 - Reconnaissance
I prefer to start recon by pinging the target, this allows us to check connectivity and get OS info.
Sending these three ICMP packets, we see that the Time To Live (TTL) is ~64 secs. this indicates that the target is a *nix, while Windows systems usually have a TTL of 128 secs.
This guide does not provide a path and intermediate answers, but asks us directly for the flag.
Let's capture her right away with a curl curl -i http://tss.thm:8080/flag.txt
2 of spades! :D
Not worry, start to check information scanning open ports:
sudo
run as root
sC
run default scripts
sV
enumerate versions
A
aggressive mode
T4
run a bit faster
oN
output to file with nmap formatting
It looks like there are 2 open ports on the machine: 22 and 8080.
Now, we need to search which services are running on open ports:
The web server is configured on port 8080 and not on 80, let's go there!
Task 3 - Find the flag.txt
Proceeding to enumerate our website using a cmd tool: whatweb "http://tss.thm:8080"
We just know this info through nmap scan results, we'll investigate very well about "werkzeug 3.0 1 python 3.8 10", we will eventually check if it is vulnerable later.
TNow let's open the browser to view the web page (port 8080):
here, there're two products/sticker images that we can only see.
and see page source for checking information disclosure.
but we don't find precious info.
In the meantime I ran a 'directory enumeration' scan with gobuster, which unfortunately returned no results.
Let's move to the second page: "Feedback":
Very good, a textarea where we can write and submit a feedback, it can be an injection point.
Testing the standard XSS payload: <script>alert("XSS")</script> we have no errors, but at the same time nothing is reflected:
let's analyze the thing better by capturing the http request with our dear Burp Suite proxy.
We can see that's a POST request and the following file formats are accepted in the form
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng
Since the possible XSS seems hidden, let's try to see if it allows us to connect to our attacker machine using the javascript method: fetch
Retrieve our attacker machine IP (10.21.31.235)
Go in listening mode with netcat on port 1339: nc -lvnp 1339
and execute into BurpSuite Repeater or directly into textarea this command:
and we receive the request, fantastic!
Based on this and remembering that the flag is in the path /flag.txt, we prepare a payload that allows us to extract the flag in the response:
Flag found!
Last updated