We covered web application authentication bypass using the reset feature in addition to Linux privilege escalation using the LD_PRELOAD method. This was part of TryHackMe Road.

By taking advantage of lack of check on the username field, we reset the password and intercept the request with Burp Suite. By changing the username to admin, we were able to reset the admin password and get access to the administration dashboard. We uploaded a web shell and got the first foothold on the machine. Privilege escalation was accomplished by creating a shared object file and make a binary use it to run as sudo. More on Linux privilege escalation notes

Obtenga notas del certificado OSCP

Respuestas al desafío

¿Qué es la bandera user.txt?

¿Qué es la bandera root.txt?

Tutorial en vídeo


Acerca del Autor

Creo notas de ciberseguridad, notas de marketing digital y cursos online. También brindo consultoría de marketing digital que incluye, entre otros, SEO, Google y meta anuncios y administración de CRM.

Ver Artículos