# Overpass

**Room Link:** [https://tryhackme.com/room/overpass](https://tryhackme.com/room/overpass)



### Initial Scan

**Kali**

<pre><code><strong>nmap -A $VICTIM
</strong></code></pre>

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FQF9SoKqc6Q9E2jz7TQ7F%2Fimage.png?alt=media&#x26;token=f10bf5ae-fc95-42ba-89a1-af3e26e727e0" alt=""><figcaption></figcaption></figure>

### Scan all ports

**Kali**

<pre><code><strong>nmap -sV -sT -O -p 1-65535 $VICTIM
</strong></code></pre>

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FpCivX30oS50LeOVbq3zV%2Fimage.png?alt=media&#x26;token=45fe28af-ef4d-4a16-ad93-4d6fdf7d704b" alt=""><figcaption></figcaption></figure>



### TCP/80 - HTTP

**Kali**

```
gobuster dir -u http://$VICTIM -w /usr/share/wordlists/SecLists/Discovery/Web-Content/directory-list-2.3-medium.txt -x php,html,txt
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2F8N9RObFAHPOH58B6Sfvp%2Fimage.png?alt=media&#x26;token=1310cec6-f3f6-42e5-8a4c-e257c6222aa0" alt=""><figcaption></figcaption></figure>



<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FR3eO07rmXf2ymeAYNIbB%2Fimage.png?alt=media&#x26;token=0bb0dbaf-92f2-42be-b213-96a792dcecb7" alt=""><figcaption></figcaption></figure>



<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FTr54EYZXOlOHfIUox9Im%2Fimage.png?alt=media&#x26;token=627a39b9-532f-4fe3-b0f0-44ca64e34fd0" alt=""><figcaption></figcaption></figure>



<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FvX2YVzI0QsJTqOdIWzRA%2Fimage.png?alt=media&#x26;token=68e9c2c4-1f92-4e93-8130-a420a891527c" alt=""><figcaption></figcaption></figure>

Click 'Resonse to this request' this will let us see the response and edit it.

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2F9Dm1uhhLuAmN5iO9YRKN%2Fimage.png?alt=media&#x26;token=9c805b8b-2a5c-49f7-bace-3ce28dce582d" alt=""><figcaption></figcaption></figure>





This is the response you get for an incorrect password

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2F27ex5MnUWCzb10ZIvOPi%2Fimage.png?alt=media&#x26;token=d3800626-5ba4-45d6-b3c9-dbb5080c34cc" alt=""><figcaption></figcaption></figure>

I changed it forward to /admin instead

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FlhzBYf1Jm9SLOQj5iFP8%2Fimage.png?alt=media&#x26;token=560080e5-535f-4286-9ff9-143e8199dc1a" alt=""><figcaption></figcaption></figure>



Forward the request, disable FoxyProxy from the browser and see the page.

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FtlEO3RcUiOzYZmDOVVGw%2Fimage.png?alt=media&#x26;token=1de8b4f0-2c2a-4fb5-9b6c-0af7c799b5bc" alt=""><figcaption></figcaption></figure>





### TCP/22 - SSH

**Kali**

```
/opt/john/ssh2john.py id_rsa.pub > id_john.txt
john --wordlist=/usr/share/wordlists/rockyou.txt id_john.txt 
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FLrp59cikX0trCucuUdou%2Fimage.png?alt=media&#x26;token=ad2c6bde-2ee8-4ee2-8de7-d2c60b848582" alt=""><figcaption></figcaption></figure>

**Kali**

```
ssh james@$VICTIM -i id_rsa.pub 
Password: james13
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2Fp2Mm1hpx0VNz8jQdKT8e%2Fimage.png?alt=media&#x26;token=c30f4cad-8443-4b99-87cc-475dbf72142a" alt=""><figcaption></figcaption></figure>



<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FRCBTggDd1uQbfx6pTlS1%2Fimage.png?alt=media&#x26;token=6702d188-2d04-40b1-8f8b-6524c12e165c" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FdCJzVf6JwW6go33ACf4J%2Fimage.png?alt=media&#x26;token=4f1d6e07-1e61-4667-bb60-f8794cd0222f" alt=""><figcaption></figcaption></figure>



Stopped here because I can't finish on Attackbox because port 80 is in use

















