TryHackMe HackerNote Writeup

for me to practice for the eJPT exam i tried to tackle into different rooms from this link: https://github.com/maisamnoyan/eJPT/blob/main/Free%20TryHackMe%20Labs%20for%20eJPT.md so i decided to try to make every writeup for all the rooms provided from this link, so i said to myself, let’s try to work on publishing a writeup for this room, hackernote, it is a web application when you’ll work on username enumeration using specific worldlist, after that you’ll work on performing a basic privilage escalation exploit:

rate: Medium

Task 1: Reconnaissance

Which ports are open? (in numerical order)

Here we’ll use nmap for port scanning and discovering open ports on our website

nmap scanning

Ans: 22,80,8080

What programming language is the backend written in?

Ans: go

Task 2: Investigate

During task 2, i was instructed to create an account with username and password, i tried to login to a different account that doesn’t exists, of course it won’t give you anything , but when i tried to login with my account but with an invalid password , i noticed that it takes longer time than looging in using different credentials , this timing difference triggered my brain into assuming that it might be some sort of user enumeration that you can perform

Create your own user account

No Answer Needed

Log in to your account

No Answer Needed

Try and log in to an invalid user account

No Answer Needed

Try and log in to your account, with an incorrect password.

No Answer Needed

Notice the timing difference. This allows user enumeration

No Answer Needed

Task 3: Exploit

for the Exploit part , i tried to work on a python script that will perform that timing attack to find the valid username that associates with this platform , you will mostly when executing this script , you’ll find a lot of users , i tried to test all of them , until one user that i found took longer time to give me an answer , that user is james , so i discovered the user i’m about to login to.

this is the script that i used (not mine)

note: do not forget that there is an open ssh port , this might give us something

#!/usr/bin/env python3
import sys
import requests
import time

def main():
    host = '10.10.207.22'

    with open(sys.argv[1]) as f:
        usernames = f.readlines()
    usernames = [x.strip() for x in usernames] 

    for username in usernames:
        start = time.time()
        creds = {"username":username,"password":"notimportant"}
        r = requests.post("http://{}/api/user/login".format(host), data=creds)
        done = time.time()
        elapsed = done - start
        if elapsed > 1:
            print("[*] Valid user found: {}".format(username))

if __name__ == '__main__':
    if len(sys.argv) < 2:
        print("Usage: {} /path/usernames/file.txt".format(sys.argv[0]))
        sys.exit(1) 
    main()

i executed the script and as i said i found too many users , used all of them until i found james, the only valid user there

Try to write a script to perform a timing attack.

No Answer Needed

How many usernames from the list are valid?

Ans: 1

What are/is the valid username(s)?

Ans: James

Task 3: Attack Passwords

for this part, after we discovered the user james , it’s time for us to discover the password ,

i created a wordlist coming from the hint that gave us in the task : “my favourite colour and my favourite number” so i downloaded task files , which are two .txt files under the name colors.txt and numbers.txt , and then i combined them using hashcat-utils using ./combinator.bin

combining the two files into wordlists

and in our case we have 180 potential passwords that one of them can be used as a password for james.

then i performed an api attack after learning from that HTTP POST request using hydra

we found it , the password that the user james is using is blue7

so i went back and logged in using the credentials that i found and i found something really interesting

ssh password for james

remember from the nmap scan, that we found an open ssh port , now we know why

Get Dhiasaid’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

i logged in using those credentials

ssh connection succeded

then i typed ls to check if i’ll find something , i found the user flag that is stored in the user.txt flag

user.txt flag

Form the hydra command to attack the login API route

Ans: No Answer Needed

How many passwords were in your wordlist?

Ans: 180

What was the user’s password?

Ans: blue7

Login as the user to the platform

Ans: No Answer Needed

What’s the user’s SSH password?

Ans: dak4ddb37b

Log in as the user to SSH with the credentials you have.

Ans: No Answer Needed

What’s the user flag?

thm{56911bd7ba1371a3221478aa5c094d68}t

Task 5: Escalate

now we move on to my favorite part , the privilege escalation , if we had access to the user , we need to have access to the root too , so with that i tried to look for something , until i found that when you try to login in as root , you’ll see things , but it is not default because there is a vulnerability when you set a setting as pwdfeedback , and there is a CVE about it

below is some informations related to this vulnerability that talks about it

CVE description for pwdfeedback

i downloaded the exploit from this link and i compiled it since there is a makefile there ,

compiling using make

then i did an SCP (secure copy files) from my instance to james’s SSH instance

after executing the exploit on james’s instance , i got access to the root instance so i went to /root and i found the root.txt , where we got the flag

What is the CVE number for the exploit?

Ans: CVE-2019–18634

Find the exploit from https://github.com/saleemrashid/ and download the files.

Ans: No Answer Needed

Compile the exploit from Kali linux.

Ans: No Answer Needed

SCP the exploit binary to the box.

Ans: No Answer Needed

Run the exploit, get root.

Ans: No Answer Needed

What is the root flag?

thm{af55ada6c2445446eb0606b5a2d3a4d2}

Task 6: Comments on realism and Further Reading

Read, explore, learn.

Ans: No Answer Needed

** thank you for reading my writeup and don’t forget to give it a clap **