TryHackMe! Overpass - Authentication Bypass

Hello everybody, my name is Jon Hammond. Welcome back to the YouTube video. We're still looking at some TryHackMe, so let's hop on over to my screen and get to it. I want to showcase the Overpass room because I just kind of found it and I thought it was really kind of interesting and neat idea. I also saw there is Overpass 2 that is out right now and I want to pour into that, but first we got to get through with the starting thing. So this theme or the kind of prompt for this box is what happens when some broke computer science student makes a password manager. I have already submitted flags for this, so please forgive me and that those are visible there, but we'll dive in as how to get to those and find them as we always do. So it says obviously it's a perfect commercial success whenever computer science students try to make a password manager and there's also a little easter egg. They say there is a TryHackMe subscription code hidden on this box. First person to find and activate it will get one month subscription for free. If you're already a subscriber you can just give the code away and do some good stuff, but that has already been claimed. This room is about a month old. I realized my face is kind of in the way so you can't see that message there, but anyway we have our machine IP address. It's up and it's running and I'm connected to the VPN. So let's get started and try and work with it. I will make directory for YouTube Overpass so we have a place to work and I'll get started with an nmap scan while we kind of put together our notes document. So nmap tac-sc for default scripts, tac-sv to search for versions, tac-on so I nmap output to a simple nmap format and of course I'll paste in the IP address. All right, while that's running let's make a simple readme file so we can kind of keep track of things. I tend to do that just because it's good practice. Sometimes while I'm doing this video I might just sort of forget. Please forgive me. And it is currently August 18th 2020 and I'll slap my name in there. Maybe if you just end up like throwing this in GitHub or something or you're just sharing your notes in your repository, who knows what you're working on. We'll just go ahead and copy these prompts here, slap them in. Good enough. Easy peasy. I realize there is a tryhackme API that you could use. It's like a library in Python and I need to tinker with that because I want to write a script that could do something like this for larger rooms that have more information in them because that way you'll just automatically have this readme and you won't have to really work with much. We've got some interesting stuff open. Our nmap scan is up and accessible so let's check that out. Looks like we have port 22 open. So classic SSH. Looks like it's running on Ubuntu. And port 80. HTTP. And it's Golang. Interesting. You don't often see that. Very cool. Okay. Looks like that's it. Looks like we only have those two ports. Just to be safe let's turn off those safe scripts or whatever those are and let's run our all port scan with HackPTAC. Here we go. Let's get started to run that and let's explore that web page while we know that that's a thing. All right. Just opening up the IP address in our web browser. It says welcome to Overpass a secure password manager with support for Windows, Linux, Mac OS and more. This is interesting because you like an actual like relatively somewhat of a web page here. People will use the same password for multiple services. If you're one of them you're risking your accounts being hacked by evil hackers. Overpass allows you to secure different passwords for every service protected using military-grade cryptography to keep you safe. Oh yeah. Okay. Passwords never transmitted over the internet in any form unlike password managers. Overpass does not store your passwords unlike other password managers. Download Overpass today. All right. Let's check out the source. I just hit control U on my keyboard to do that. Looks like they are loading like local JavaScript and console log hello world. So if I were to go back to the page and check out the console tab. Yep. You can see that guy right there. Nice. Cool. Great. I'm also just going to take a look at the CSS file in case they hide anything in there. I think that's kind of good practice. Just something good to do. Images I'm not extremely concerned about. If we kind of run out of things to do we could do like cheesy stego on that or some other reconnaissance. But oh there's an HTML comma here. Yeah right. Just because the Romans used it doesn't make it military-grade. Change this. Ah okay. Romans using secure cryptography that hints towards like ROT13 and Caesar ciphers. Right. So okay that's clearly not incredibly strong cryptography. There's a downloads page. So let's go check that out. Hop on over here. Stay safe against hackers. Use overpass. Oh and they have pre-compiled binaries. And they have the source code. Nice. Okay anything else in this? Overpass go build scripts. These are all in like a specific directory. Oh what's in that about us page? Sorry before I forget. I just kind of want to keep looking around. Anything here in this source? Nope. Nothing. Hiding. Oh I like that Symex is in there. Ninja. Cool. This is really cool. All the TriHackMe guys. I love it. Great. Okay let's take a look at this code that they're showcasing here. Source code and build script. Let's look at this thing. Oh I already have these files downloaded. That's embarrassing. They're still in my downloads folder. Who cares? Illusion. Art. Artifice. Let me make a directory for like source. And let's move downloads overpass dot source. Yeah it's not go. Sorry. Into here. Same thing with build. I still have the the binary itself. .sh. We'll put that in here as well. So let's take a look at those. Let's take a look at the source code. Overpass go. And it's written go. Kind of neat. I wish I could just like write go. Like as well as I could write Python. Because that language is crazy cool. It's able to do stuff like everywhere. Other than the like scripts and binaries being like megs in size. But okay it looks like a pass list entry is a structure. So it has a name and a password and a function for rot 47. Excellent. The secure encryption algorithm blatantly ripped and stolen from this URL. Okay incredible. I will press the I believe button on that and say that that just does regular rot 47. At least for now. If it does do anything else and we just don't see it then whatever. We don't we don't need to worry with it. We can go ahead and reverse engineer it as needed. Save creds to file. Where does it save all these? Does it have a path? Like a default path? Load creds from file. JSON. Input. Oh Python style input function. Neato. Service search. I'm just kind of like slowly cursory looking through these to get an idea for kind of what these functions are and what they do. I don't think like there's no obvious glaring like okay bad eval or unsafe function that might be sticking out. But it's good to kind of peruse through this delete password from service. How's it do that? Print all passwords. It just loops through all of them. Okay. Oh creds path is in home directory dot overpass. Good to know. And that's probably stored in some like martialized or whatever JSON format as we saw up top. Okay. And we have this menu here and just a little command line interface to answer or select one option. That's pretty easy enough. They did have the binaries so we could just kind of tinker with it and play with it. Let's do that. Oh what was that build script? Sorry before I forget. Build script dot sh. Go OS or goos which is always fun. That's in go setting an environment variable for how to install it and work with it. Does it just do it for like literally everything? That's awesome. And echo date hack our builds completed. Oh it's just kind of like command inject command substitution in there to get the date. Maybe we could potentially abuse that at some point. Obviously we're just like we've downloaded this locally. But we are supposed to get into this box somehow. So we should mess with that. All right. Whatever. Let's take a look at the binary. You download it. I have already downloaded it. I'm just going to grab the Linux one. I didn't download because I didn't click it hard enough apparently. But I still have the binary doing error. So let's move that in here and let's look at it. It is. Now I realize typing at the bottom of my screen might annoy you. Sorry. Mark that as executable overpass Linux and run it. There we go. Yeah let's let's just hop over into another window up here. So I'm not at the very bottom of my screen because I heard some people say like hey I don't like to read it because the YouTube play stuff gets in the way. So here we go. Welcome to Overpass. Retrieve a password for a service. One. John. That's it. It died. OK. Retrieve all passwords. John. Oh again this also still exists because of my home directory dot overpass. Man I'm really ruining the illusion here right. So this is Rod 47. This is the weird notation that it's apparently encrypting and storing all this stuff in. Keep note you can normally identify Rod 47 by the weird random sheer amount of punctuation marks. And I'll just do a simple stupid online Rod 47 decoder decrypt. OK. So now you might be able to see I have John. John. John is the name and John is the password. Super boring. But that's how it would simply work. OK. So now that we've looked at this code and we've looked at this source we've looked at this build script. We looked at the executable. I don't see a whole lot else here. And since they give us like an actual Web site sometimes you're like oh wait whoops I've spent so much time exploring a Web site that I forgot to run my regular normal enumeration procedures. So don't forget fire up that simple Nekto. I'll T that to Nekto dot log if I can type. Great. Also do the same with little GoBuster. Do a GoBuster dir tack you with that URL and we'll use a W for my word list and then I store the directory list medium over in my op directory and we will fire that off. We'll see what that comes up with. Realistically we probably should have been running that while we were looking through. Oh did it fail? Is that the right? That is the right IP address. Can I ping that thing? Nope. Sorry. Yep. Is it just because Nekto is working? That's funny. Error running goobster. I don't know if you can see that typo there. Nice. Let's do it again. Maybe I'll stop Nekto. We'll let GoBuster have a little bit of precedence here. Still dies. All right let me pause and figure this out. You know what? It might be that annoying nmap scan beating it up. Maybe I don't need the lasting forward slash. Let's see if that will work. There we go. All right. Turning off the nmap scan just kind of let it do its thing. That's fine. About us. Downloads. IMG. We saw all that already. Oh a slash admin. That is something we had not seen or looked at before. So let's hop over there. Slash admin. Administrator access. Looks like we need credentials. Please log in to access this content. Okay. We could try the basic stupid admin admin. That doesn't work. Admin password. That doesn't work. We could try for basic stupid sql injection or one equals one. Nope. Using two hyphens to do a sqlite comment. Using a hashtag or an octothorpe to do it with the sql syntax. My sql syntax. Switching it up to a single quote or a double quote for strings. None of those work. Okay. Is there anything on this page that's interesting? Another css file. Okay nothing there. Interesting anyway. main.js as usual. Oh but there's a login.js and a cookie.js. That's peculiar. What is that cookie? Oh okay. That's just a regular minified library used in other places. JS cookie. MIT license. So that might not be too interesting for us. How about login.js? Okay yeah. This looks custom. This looks like it's just written specifically for this. So we have a post data function with url data response await fetching a url with the post method credentials headers url form encoded follow it a redirect get the body and then return the response okay sometimes it's not always json that's peculiar encode form data that looks like it just kind of puts it into like a yeah like okay post data format on load which is just we saw in the source code that would like run as soon as the page loaded okay it would look for a login on you clicking submit it will run login function rather than submitting the form as html normally would so this login functions where all the interesting stuff happens okay we have username box which is getting all the information out of that field same thing with passwords and we would log in text content equals nothing creds is just going to be a little dictionary associative array hash table with the values pulled from the fields and we will post to that resource api login with our creds and it'll get a constant status or cookie with the response object from that post data function returning okay and then we do a check on client side code in javascript so if the status or cookie is equal equal equal to incorrect credentials then we know that failed gotcha or otherwise huh oh we set a cookie session token session status window location okay so it brings us to the exact same page it just has a cookie working but that's interesting because what could that value be obviously if it's just not like incorrect credentials it could just be like literally anything right like what what could that be if we were to set that would that work if we just set that to like anything literally we could control that because a cookie is something we can tamper with just as easily let me um try that in curl so let's make go buster shut up and let's try to close out some of these because we don't need these to take up the entire terminal for us um let's hop over to the original page right and let's try and curl that just to get it in the command line i don't have like a cookie editor thing quickly installed like a cookie editor browser plugin or manager on my firefox or my chrome here so i'm just going to use a simple curl for a proof of concept i'm going to specify tag age to use a header will that work i'd have to use like a set cookie thing um i think curl just has like a tac-tac cookies yeah nope cookies is unknown is a cookie yeah cookie requires a parameter okay quick troubleshooting to see if that command line argument actually exists uh so we'll specify what was the name of that session token yeah we'll set it equal to literally anything and we have a private key okay so i guess that did work um since it's all javascript we can probably do the exact same thing um this code would run in the context of this window because it's pulling in that cookie.js so if i were to open up the console again and just slap this this syntax in uh status or cookie is not defined that variable we can just set once again like literally anything now if i were to refresh this page that cookie is set and we can see it in our browser so since you keep forgetting your password james i've set up ssh keys for you if you forget the password for this crack yourself i'm tired of fixing stuff for you also we really need to talk about this military grade encryption nice okay so here's a private key reading that prompt it sounds like we need to crack a password for this thing so let's make a directory for ssh and slap this in here as an id rsa uh don't forget to include a private key at the excuse me include a new line at the very very end of your private key that can trip you up sometimes if it says like unknown of format or something um let's mark it as our own so ch mod 600 and i'm assuming we'll have a username james because it references this this individual james here so let's grab that ip address and try to ssh tack i with that id rsa james at this ip address not a url please thank you see if that will work for us yep i'm totally cool with connecting to it let's do it we need a passphrase okay uh let's do that with john the ripper so i have uh opt rock you dot text i have this regular word list for brute forcing that's just in my op directory there's tons and tons of stuff and i also have john the ripper so that's an opt john the ripper run john if you don't have that installed go grab it off of their github repository it's like magnum ripper john the ripper it's a community edition jumbo john i think it's it's called and then just do it go into the source directory do a dot slash configure and do it make and install it'll build it all for you so super easy super cool let's run john on uh actually we need to convert this specific format right because john will offer some scripts like ssh to john and that will use a file format and kind of convert into something that john the ripper could work with so i'll just make a for john dot text that's good now with that done we can run john on that for john dot text but let me specify the word list here i'll use opt rock you as that word list for him and i'll run for john and let's see if he gets a hit and he does okay so james13 is apparently that password cool cool that's glove fun what are you doing over there john the ripper what are you doing let's just stop that actually because i don't need this extra session when i still have that in my command history this thing connect to it please and the password should be james13 good good good type that right let it connect okay let me pause this video real quick okay that took forever but i have codex union i'm on the box i am ssh'd in so okay in our home directory as this james user i can see a user.txt file which we will clap out here cat that out crap that out all the words and that will give us our points for that user but we also have a little to do dot text which is interesting update overpass encryption yearling has complaining that it's not strong enough yeah write down my password somewhere on a sticky note so i don't forget it wait we make a password manager why don't i just use that test overpass for mac os it builds fine but i'm not sure it actually works ask paradox how we got around how we got the automated build script working and where the builds go they're not updating on the website ah automated build script is it still is it like running here because i know we had that thought we could maybe like get in the middle of that date command running or something okay whatever let's uh see if we have a password he mentioned he has been using the password manager oh and we have an overpass file okay so that hidden directory again right so let's cat out that overpass and we see his information it's simple rot 47 so i had that rot 47 decoder online i could just once again slap that in go name the system pass c dronling picture okay whatever is system referring to like this system system like would i be able to like pseudo tag out like is that his password i'll paste that in okay that is his password but james can't run sudo boring okay um we could do a regular enumeration what's in the is our are there any other users we get into there's a try hack me user nope can't get into that anything in root nothing particularly interesting okay so let's throw like lynn enum or lynn peas in here and see if we can find a way to around this um i am going to use guake which i use as part of my cheesy like poor man's pen test framework ideas uh because i would like to be able to upload or download a file right so i have these commands like upload file with netcat or like wgat or other methods to get a file on the box normally if you're using this with pwncat it's much better and we could get like a pwncat shell if we wanted to but i'll just showcase this one because i think lynn enum might highlight some things a little bit better uh for your learning and for us to walk through this together so let me show you like what that is before i just totally say that this is what we're going to do and then you don't understand any of it so uh let's fire that up in sublime text i'm using my pmp or opt poor man's pen test functions and that will grab like my ip address my local host ip address so it knows or my ton zero ip address excuse me so it knows how to reach the vpn in that box back and forth like a random port it'll specify a file name out of this little dollar sign excuse me out of this command line argument we pass in we'll hide guake which is how i'm using to invoke this and we'll get focused back to our actual window and we will run a netcat listener grabbing this file on our host and then we'll send the command with xte or x automation to simulate typing in on the victim this netcat command to download and pull this file in so that's all that's doing this silly poor man's pen test because i'm like automating keystrokes inside of my reverse shell so i can quote unquote script inside of it you don't have that real functionality but pwncat will let you do that so i would always recommend to use pwncat but i guess i'm just not in this case stupid me let's upload lindt's there we go that's slapped in i'm gonna give it a second check okay yeah guake says it's got everything it's done so let me like close out of that and it just threw it in devshm shared memory because i like to hide in there file that it is a shell script so let's run it and let's dot slash okay marked as executable we're in a ton of stuff i'm using kind of the one of the later versions of lindt's i think or at least newer than i had ran previously because now it'll cache directories or like be able to figure out a lot of good stuff we'll let that go and then we'll start to look through it i guess we can kind of look through it as it's going so nothing wrong with that lindt's we have ping we have netcat incredible old pseudo version good to know kind of exploring and see if there's anything that just jumps out lindt's is great because it'll color code things that are potentially or very very likely a privilege escalation utility useful software we have a lot python with base64 all these things we have compilers goodness root is running some stuff cron cron's in there why are they running cron i wonder if that's that automatic build script cron jobs has some those are all defaults they look like defaults oh what is that line so that's cron syntax so every minute of every day every hour of every day in the month as the user root interesting we will curl overpass.thm looks like a little host name or domain name download source build script.sh and pipe it to bash whoa okay funky that is an obvious and egregious method that we could abuse to privilege escalate because if root's running that then we'll get code execution as root if that's just getting piped into bash can we control that though that overpass.thm where are they setting that domain name that's normally in etc hosts do we have write access to etc hosts that's normally a weird thing host name okay yeah we can see that host name hosts and dns that's that's definitely the output of our etc hosts file but can i write to that that's odd listening port super users are root yep okay tryhackme looks like tryhackme has a lot of privileges he's in sudo blah blah blah rsync stuff possible private keys yep we found those we have those cloud on it files suid files nothing stands out to me capabilities weird to see a cd-rom file okay modified interesting oh gpg stuff that's peculiar writable log files backup files all hidden files there's a lot in here whoa okay i don't need to see all that interesting right of interesting writable files owned by me or writable by everyone that are not in my home directory etc hosts is in the list okay okay cool so if we can modify etc hosts and what we could do is we could act as that curl command right that was in oh boy i gotta find it again now it was the curling overpass.thm slash downloads slash source build script.sh pipe to bash and that would run like every minute right so if i were to try and do that now looks like it's getting okay the one off of this website but let's modify that so right now let me change this profile this will be the victim that we're in and this will be my server my machine because i want to know my ip address if i could type ton zero ip address address show my ip address there and let's modify that etc hosts file because we do have write access in there supposedly and let's change the overpass.thm location and make it my address yeah so that way if i were to ping overpass.thm you can see now i'm actually reaching my attacker machine great so let's make a little directory for ourselves and we'll like fake and simulate like pseudo create the same file structure as what that command is expecting in cron as it's running every minute so let me make let's see it's a downloads source and then we have the script itself so let's make attack p to make all of those directories let's hop in there and let's create a simple bash script build script.sh that will and we can have this do literally whatever we want because that will be executed through bash i think the easiest way to give us accessible root privileges is make the bash binary set uid so that way we'll be able to like i don't know invoke it and keep our root privileges so right now if you check out the permissions on bin bash sure it is an owned by root executable but it doesn't have a sticky bit set or it's not set uid um using that we could just invoke it with tack p and that way we could maintain root readily and easily you could do other things like call back a reverse shell or whatever you want but i want to kind of keep me in this for simplicity's sake all right let's hurry it up because we're getting into a really long video and this really doesn't need to be so let's get back to the root of this directory right let's actually watch this ls tack la and see when it's going to hit looks like i still have like half a minute to go and this will we know from the cron output this will happen on the clock every minute on the minute so let's fire up my http server and that's going to listen on 8000 by default so if i wanted to specify port 80 i could specify that as a last argument but we need root privileges to do that on my ubuntu system so let me pseudo python tack m that type in my password as fast as i can great now we are very very close to the end of the minute so we should see a get request come through on our attacker machine done and we should see this set uid all right so let's stop watching that and let's bin bash tag p and now we're root very very cool we were just abusing that little curl command that's in cron that is a running commands as root and it's pulled from an external resource or at least we can control where that resource is because it's in etc host file that we have write access to so we could hop on over to root and we could simply cat out that root.txt and be done with it nice nice nice uh the easter egg if you wanted to you could go find that uh careful there john if you wanted to do you could go check out try hack me uh that user account that we saw he does have an overpass account so we could cat out that file and see what other information that might have as usual it's just rot47 so we could go hop over to this little decoder decrypt that and kind of cheesy there's a little try hack me subscription code but someone has already found that right no sense trying to submit it but very very neat very very cool very very fun i really liked the idea of this box and that was kind of fun um and it was cool to kind of work through some of those and i like that simple etc host trick so i hope you guys thought that was also very neat very enjoyable um take good if that's something that you want to do as usual i started the readme file and then did nothing with it whatsoever but uh hey thank you guys so much for watching i really hope you enjoyed this video if you did please do press that like button do the youtube algorithm things leave me a comment hopefully subscribe thank you you guys the best thanks so much for watching i'll see in the next take care you