> For the complete documentation index, see [llms.txt](https://writeups.adityadindi.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://writeups.adityadindi.com/tryhackme/walkthroughs-easy/overpass-2-hacked.md).

# OverPass 2 - Hacked

![](/files/-MdYJUfyt-p9KbpoO9eL)

## Task 1: Forensics - Analyze the PCAP

Lets download the PCAP file and open it in wireshark

![](/files/-MdYK6GCLYMBcxb1FZEK)

As they asked what is the URL of the page they used to upload a reverse shell lets look at the http packets

![](/files/-MdYKpC9cZ9kj41GwjUw)

Lets follow the TCP Stream

![](/files/-MdYL0cjjQzUpq2dJCo0)

We have the page

Next we need to find the payload the attacker used to gain access.

Looking at another http file, we can see this

![](/files/-MdYLXLOrhwYj_jgZfCF)

Next lets look at a random file in wireshark, we see this 

![](/files/-MdYLyZIw_55zFNZTnOH)

We have the password. Scrolling down a bit we see the link the attacker downloaded that is used for persistent on the machine

![](/files/-MdYMGPhY0T1_Pdx8ng8)

In the same file, we can see how many of the system passwords were cracked.

![](/files/-MdYMfyQ9gjX55jVtErw)

We are done with the questions in this task

![](/files/-MdYMmRBhSOFpVmf9oM9)

## Task 2: Research - Analyze the code

Lets look at the code of the backdoor the attacker downloaded by downloading it to our machine

Looking at the main.go file, we see the default hash for the backdoor

![](/files/-MdYPUCoUWecfHFlt8nj)

Scrolling to the end of the file, we see the salt for the backdoor

![](/files/-MdYPdht8KzUDb5cOPxa)

We can find the hash the attacker used in the same pcap file we opened earlier

![](/files/-MdYPttHWn2Wz1v6KWE2)

Lets crack the hash using hashcat

![](/files/-MdYTeYRs2RgFhK5-JGn)

![](/files/-MdYTi_gkqooj2I63RxY)

## Task 3: Attack - Get back in

Lets run a nmap scan to see open ports on the machine

![](/files/-MdYUb0vtsCpqkK8btyk)

Lets visit the website

![](/files/-MdYUk9w5-A_xabsESt5)

Lets now follow what the attacker did and get into the machine. Lets login through ssh on port 22 as the user james and use the password we cracked earlier.

![](/files/-MdYVe3ClALmoZXIrhqL)

Lets read the user flag

![](/files/-MdYVqf6hBRdcbqxZbpS)

Lets look for SUID files and see if we can find any interesting ones.

![](/files/-MdYWKFZkfLCT0d6cxvm)

This is one is interesting and not common, lets check it out

![](/files/-MdYWUYE7MZvgjgVEEAx)

So it gives us a shell as the user we want, lets try running it so that we can get a root shell. This can be found on GTFOBins

![](/files/-MdYWje7E_Pc9WCFwx6Y)

![](/files/-MdYWqwRaLEO15FL0gLb)

We are now root , lets read the root flag

![](/files/-MdYWzRsU0eGkJSXc0l0)