Checkmate
Exploit weak password practices across Marco’s internal systems to achieve full compromise. - by talat118
The following post by 0xb0b is licensed under CC BY 4.0
Our objective is to conduct a password security assessment to identify weaknesses in Marco's authentication practices/ password requirements.
We are task to start by accessing the main application at http://MACHINE_IP:5000.
From there, we will be guided through each stage of the challenge, uncovering and exploiting weaknesses in Marco’s password usage.
Level 1
We visit http://checkmate.thm:5000/ and start with the first level at http://firewall.thm:5001.
We add the host to our /etc/hosts file and visit the page at http://firewall.thm:5001. We have a log in page infront of us.
We catch an example request with Burp Suite to figure out the structure of the request. We see it is a simple http POST request with the parameters username and password. An invalid combination results into a page containing Invalid credentials.
Next, we run hydra to brute force the log in as the preset user admin. For the wordlist we chose rockyou.txt. After a short duration we have a hit.
We use the credentials found to log in to the firewall portal and are successful. Nothing interesting here so far.
We head back to the main page and enter the password found. The password is correct and level 2 gets unlocked.
Level 2
We reach out to level 2. The next target is a job portal. We also. get a clue that common company keywords are used as a password.
We add the following entry to our /etc/hosts file and visit the page. We visit the jobs page and have a lot of company buzzwords infront of us we can use to craft a wordlist.
At http://jobs.thm:5002/login we have the employee login. The preset username is marco.
Again, we catch the request via Burp Suite to grasp the structure of the request.
Our first attempt to gain access using rockyou.txt was unsuccessful. This time, we're going to try creating our own word list.
We run cewl to crawl http://jobs.thm:5002/ to a depth of 2, scraping words from the page content to build a custom wordlist saved as cewl.txt.
Next, we run hydra to brute force the log in as the preset user marco. For the wordlist we chose cewl.txt. After a short duration we have a hit.
We use the credentials found to log in to the portal and find some valuable information like personal details we can use later on to craft new wordlists.
We head back to the main page and enter the password found. The password is correct and level 3 gets unlocked
Level 3
Now we are tasked to visit the social site and retrieve the password. This time the password is dervied from marcos personal information. Luckily we harvested such information earlier at http://jobs.thm:5002/profile.
We add the following entry to our /etc/hosts file and visit the page. We visit the social page. No username is preset this time, but we'll focus on the username marco for now.
We recall the information gathered at http://jobs.thm:5002/profile.
To generate a wordlist with the gathered information we leverage CUPP - a Common User Passwords Profiler. We run cupp in interactive mode and provide all the information gathered like depicted below.
We catch a log in request via Burp Suite to grasp the structure for hydra.
Next, we run hydra to brute force the log in as marco. For the wordlist we chose our crafted one with cupp marco.txt. After a short duration we have a hit.
We use the credentials found to log in to the social page. Here we see some questionable recommendations for a strong password from marco. So A company keyword, which is capitaliued and a year appended finished by an excalmation mark. How creative...
We make note of this information to generate a ruleset to craft a wordlist with the information provided.
We head back to the main page and enter the password found. The password is correct and level 4 gets unlocked
Level 4
Level 4 is a file-related sidetrack. Here, we are required to reconstruct the filenames from the generated SHA-256 hash of the name.
We retrieve the profile picture and make note of the filename.
We try to crack it using hashcat with mode 1400 and are successful.
We had back to the main page and provide the filename found and unlock level 5.
Level 5
This time we are tasked to attack the SSH service using a predictale ruleset based on keywords and formatting. This sounds familiar to the information we found on the social media page.
We recall the information.
We re-use our keywords list gathered via cewl from level 2.
And add a rule to john. The location for exegol is the following.
We add the following rule called checkmate. I takes each word from the wordlist, capitalizes the first letter c, appends the literal string 20 followed by a year-pattern digit range matching 2010–2029 Az"20[1-2][0-9]", and appends an exclamation mark $!.
Next, we run john to generate a new wordlist based on the cewl.txt wordlist we retrieved ealier using cewl.
We run hydra targeting the ssh service. But our wordlist is to big it takes to long.
We're adjusting our rule to limit ourselves to the 2020s, thereby cutting our word list in half.
We run hydra again with the new wordlist, after a short duration we have a hit.
We are able to log in as marco via SSH.
We provide the password found to the main page and are finally done.
Last updated