It’s worth noting at this point that it may be useful to add filters to How did the attacker establish persistence? # This includes the password used to privilege escalate to james. See everything in readable text as it passes through in this case. Without any secure communication verification.īy default, netcat doesn’t encrypt the data it sends 1, so it’s possible to Is because the attacker sets up a netcat (or nc) connection with their payload We can assume the reason that we can see all the data passing back and forth between the two ports The communication shifts to strictly TCP, using portĤ242 on the attacker’s side to issue commands, and port 57680 on the target’sĮntry 71: The attacker attempting to run su james. What password did the attacker use to privesc? #Īfter successfully uploading and accessing their reverse shell, the attacker Within the same entry as above, it is possible to see the contents of payload.phpĪs it is being uploaded. What payload did the attacker use to gain access? # Were able to upload a payload.php file to the server, which is mostĬertainly the reverse shell they intended to use. Click on this entry, and you’ll see that this is how they Specific URL (entry 4), and then issues a POST request to the same URL extended with You’ll notice that the attacker first issues a successful GET request to a Compromising the server (Strict TCP/Blue Traffic - Largest Phase)įor now, let’s go through the first phase of traffic, the initial webĬommunication between the hacker and the server.

It becomesĪpparent that the attack went through 3 main phases:

Open the PCAP file with Wireshark, and skim through the entries. What was the URL of the page they used to upload a reverse shell? # Let’s retake the server! Forensics - Analyze the PCAP # Q. Offensive cybersecurity experience with web apps and password cracking.Īs usual, direct answers in this guide are blurred out or hidden. You can download Wireshark from the official website.īefore attempting this challenge, you should have some familiarity with The link to the Overpass 2 - Hacked room is here. To hack back into the server to regain control. To figure out how the attacker got in, then you need Series on TryHackMe, and this scenario has you helping to recoverĪ website that’s been hacked! You’ll have to analyze a packet capture (PCAP)

Download overpass 2