Skills Assessment - Broken Authentication

HTB Content Academy
1

Hi,
Im kinda stuck with the Skills Assessment - Broken Authentication

image
image1398Ă—192 11.5 KB

What I know and tried:
*2 account discovered from support page
*the cookie is hashed and encoded but when I tried to do fixation of the cookie, it results to error (as the image above)
*find password as matches the criteria of password
grep '^[[:upper:]]' /usr/share/wordlists/rockyou.txt | grep '[[:lower:]]' | grep '[[:digit:]]$' | grep '[[:punct:]]' | grep -E '^.{20,}$'
*use the matched passwords to bruteforce (with rate limit) the 2 account found. But doesn’t work.

My questions:
*Should I use dirb to bust directories to find the admin panel ?
*Would I be able to find admin panel when I am not logged in?
*Should I use X-Forwarded-For ? I tried but doesn’t work either.

Our other accounts remain unchanged, you can continue to contact any department by adding your country code as usual.

Should I permutate the short-username list with _country or country codes?

Help me, im stuck :frowning:

2

Hi,

with this question you are already on the right track

3

Hi, Thanks for reply.

would I be able to bruteforce the permutate usernames through support page? or does it use special techniques like timing the response?

4

there is a page where you can write a message to (existing) users. This could be suitable for your preferred approach.
if you still need help, feel free to contact me via dm

5 
import itertools
import numpy


# file that contain user:pass
userpass_file = "country_codes.txt"

# file that contain user:pass
userpass_file1 = "top-usernames-shortlist.txt"

output = []

with open(userpass_file1, "r") as fh1:
    for fline1 in fh1:
        with open(userpass_file, "r") as fh:
            for fline in fh:

                fline = fline.strip()
                concatUser = fline1.strip() + fline.strip()
                output.append(concatUser)

    output = numpy.array(output)
    print(output)

    with open("shortlist_permutation_country_codes.txt", "w") as outfile:
        outfile.write("\n".join(output))

i tried this permuation, even with underscore username( _ )countryCode but still doesnt work.
I cant find any other users aside from guest and support

6

to those who are still finding their way:

my hunch are correct except on the way of my permutation.
I just need to correct the syntax of permutation. Read the “Usernames” section again, you will get hint from there on the correct syntax. You will get a lot more usernames aside from the 2 usernames you already got. And also, use the rockyou.txt then narrow down the possible passwords as per password policy.

thanks @onthesauce and @toshikomi for pointing me on the correct direction.

2 Likes
7

I am not able to escalate the privleges of support related user. @dfgdfdfgdfd

8

did you found valid users other than guest and support ?

9

i did found valid users which is similar to support.

10

filter the rockyou.txt as per password policy.
then use that passwords to bruteforce known usernames.

11

Already did. Got the correct password. But now, I am not able to navigate after this.

12

Inspect the cookie after you logged in and you will be on your way :slight_smile:

13

I decoded the cookie. Main thing is I am not able to predict the role or may something else I am missing.

14

try some basic role names. and also, you need some elevated accounts.
did you manage to get other usernames aside from support accounts?

15

No other username found other than mentioned above. Also, I tried some basic role name like admin and more but didn’t work

16

use my permutation code above

But correct it first by fixing the proper syntax for usernames

Two files required for permutation:

seclists/Usernames/top-usernames-shortlist.txt
country_codes.txt

you should be getting more username aside from support usernames.

1 Like
17

Once you create an account the support page gives you a big clue.

18

When you filtered how did you avoid the “Too many attempts”

19

Use the provided script found in the module about rate limit.
dont forget to update the script to fit in your usage

20

Ok I modified the script for the different cc for admin now I’m going to run it. The hardest part was modifying the script because I was overthinking the submit part smh!