The London Bridge (THM)
The London Bridge is falling down.
Hello EveryOne today i wanted to catch Up with the machines i miss so we having The London Bridge Today shall we ?
Enumeration.
So with rust scan we can see that we have port 8080 and port 22 opens which is HTTP and SSH. So let's search the web application first let's see what we have.
Using dirsearch we can see the two directories we have and we have to endpoints that accept POST requests which is feedback , upload.
So basiclly now i have access to the machine let me walk you through the process.
find the hidden endpoint.
As you can see the endpoint view_image we have not see it before and it returns 405 which is method is not allowed GET in this case so i tried POST and it works.
Here we have an input image_url mean we can upload url from a link. I stuck here for a while but i check the hint and it says something about hidden parameter and using arjun i was able to find it.
SSRF
SSRF is an exploit which allow the attacker to access the internal services from the server it self as if it ask from the localhost.
Which is www in this case so i tried multiple stuff here and SSRF was the way to go.
And here i have tried "localhost" and "127.0.0.1" and they does not work which appear to be some sort of filter. So now we want to dig more into the internal network.
So here the file we used is just a file contain numbers from 1..10_000. Now let's dig more into port 80
As you can see in the image it appears to be linux home folder which maybe contains .ssh folder let's check that out.
As you can see in the images above we find the ssh key as well as a using name. So now let's login into ssh.
Root access.
So as for the root access i search a lot and using linpeas i saw this.
After searching more a bit o found an exploit can exploit this vlun
i tried most of them and the one that works is exploit.dbus.sh. I think i know why, This exploit take advanges from the mishandle of the nested user space In Linux, user namespaces allow processes to run with different user and group IDs than they have on the host. This means that, inside the namespace, a process can have root-like privileges (UID 0), even if it's running as a normal user on the host system. And also we can see that in the SUID we has.
Which is related somehow to the exploit it self digging more into exploit will be a later job but for now let's enjoy the rootness.
Charles password.
to get and idea of how to extractr the password at first i thought that we only need to crack the hash and we will be able to get his password and i was wrong. I tried with john but nothing came out. But once i step into charles home directory i know what i need to do.
We have a mozilla folder which usually contains a firefox stored passwords. So can we crack it.
Using the above two resources we will be able to do that all we need to do is to transfer the charles home directory into our machine using a python server. And then crack it using firefox_decrypt.py
I have charles directory in my machine now we just run the code.
And here it is.
Conclusion.
Last updated
