tryhackme room olympus

Olympus Penetration Test Report

1.1 Introduction The Olympus penetration test report documents the steps, tools, and methodologies used to complete the TryHackMe room “Olympus.” It outlines the vulnerabilities discovered, methods of exploitation, and the remediation strategies. This assessment simulates a real-world penetration test, showcasing the tester’s expertise in ethical hacking and security evaluation. The objective of this report is to demonstrate proficiency in penetration testing techniques by identifying, exploiting, and reporting vulnerabilities, while providing actionable recommendations to secure the system.

1.2 Objective The objective of this assessment was to simulate an internal penetration test against the TryHackMe Room Olympus. The focus was to discover vulnerabilities, exploit misconfigurations, escalate privileges, and document findings with actionable recommendations. By following a systematic methodology, the tester aims to demonstrate proficiency in penetration testing, including reconnaissance, exploitation, and privilege escalation, and provide a comprehensive report.

1.3 Requirements This penetration testing report includes A step-by-step walkthrough of the methodologies used. Screenshots, proof of exploitation, and relevant code snippets. Final findings, including a summary of vulnerabilities and remediation recommendations

2. High-Level Summary The assessment revealed several critical vulnerabilities in the “BackTrack” environment, which were systematically exploited to gain root-level access. By simulating real-world attack scenarios, misconfigurations and insecure practices were identified, leading to the compromise of multiple user accounts and the system’s root privileges. Key vulnerabilities include:

1. SQL Injection : Doesn’t validate and sanitize the user input.
2. Weak password hash methods : The password hash was Familiar.
3. Misconfigured files and sudo permissions : Enabled privilege escalation to another user and sudo user.

2.1 Recommendations To secure the system and prevent future exploitation, the following recommendations are made: • Patch Vulnerabilities: Sanitize user input fields. • Restrict sudo Permissions: Limit users to essential commands and roles. • Secure Web Applications: Enforce file upload restrictions and sanitize inputs block unwanted file extensions. • Review Scripts: Harden and audit scripts to prevent privilege escalation.

3. Methodologies A structured approach was used to complete the assessment. Below is the step-by-step breakdown: 3.1 Information Gathering The information-gathering phase involved identifying the scope of the test and collecting data about the target system. Open ports and services were discovered using scanning tools.

Process: • Scanning: Using tools like nmap to identify open ports and running services. • Service Detection: Identified critical services running on ports 22 and 80

3.2 Service Enumeration In this phase, further information was gathered about the identified services to understand their configurations and potential weaknesses. Process: • Service Analysis: Explored services “Office managing web server” • SQL enumeration : Find an SQL injection vulnerability in search input field

3.3 Penetration The penetration testing portions of the assessment focus heavily on gaining access to a variety of systems. steps :

1. SQL injection attack : Used SQL injection in the search input field and find the usernames and password hashes from database.

2. Credential use : used usernames and cracked password from database to unauthorised access to the internal server.

3. Reverse shell upload : created a malicious .php file and uploaded in chat to admin section

4. shell access : triggered the reverse shell via url to gain access to the system with limited user privileges

3.4 Privilege Escalation Privilege escalation techniques were employed to elevate access from one user to another with higher privileges. Steps:

1. Sudo Permissions Analysis: Reviewed sudo privileges for potential misuse.
2. Custom Scripts: get the SSH id_rsa key from another privilege usres .ssh folder by misconfigured “CPUTILS” funtion.
3. SSH : used the SSH for get the shell of another privileged user.
4. Vertical privilege escalation : find the vulnerable ‘uname -a’ command and find the correct command from online articles to escalate privilege vertically.

3.5 House Cleaning Once root access was obtained, steps were taken to ensure the system was left in a stable state:

1. Removal of Artifacts: o Deleted all payloads, temporary files, and tools used during exploitation.
2. System Integrity Check: o Verified that no residual artifacts or modifications could compromise the system further.

4. Independent Challenges

4.1 Target #1–10.10.12.39 4.1.1 Service Enumeration Port Scan Results IP Address Ports Open 10.10.12.39 TCP: 22, 80, We run nmap to scan the target and found a few ports open.

4.1.2 Initial Access — webpage

and find the hidden directory and test the SQL injection payload in search input field and find the SQL injection vulnerability

“gobuster dir -u http://10.10.12.39/ -w /usr/share/dirb/wordlists/common.txt”

for directory search.

“ ‘or 1=1; — “ for SQL injection vulnerability testing.

then I used the tool SQLMAP

“sqlmap -r req.txt — level 4 — risk 3 — dbs”

fetched the usernames and password hashes from olympus database from the table users.

“sqlmap -r req.txt -D olympus -T users — level 4 — risk 3 — dump”

and I cracked the password for prometheus.

“hashcat -m 3200 hash. txt /usr/share/wordlists/rockyou.txt”

“hashcat -m 3200 — show hash.txt”

User name : prometheus. Password : summertime. Then I find the login page and use this credentials to login .

It was redirect to the home.php and it was a chat section.

The user can upload reverse shell here. But the admin change the file name to encrypted value and it was shown in the database and I am used “SQLMAP” once more to find the file name .

“sqlmap -r req.txt -D olympus -T chats — level 4 — risk 3 — dump — fresh-queries”

And search the hashed file name for run the reverse shell in server.

“nc -lvnp < port no >”

“find / -perm -u=s -type f 2>/dev/null”

To find SUID misconfigured files and functions. It show that the “ CPUTILS “ function is running with “ SUID “ . And it was used to horizontal privilege escalation .

This function is copied the id_rsa file of the user ‘Zeus’. And the passphrase for id_rsa was cracked with the tool “john” .

“ssh2john id_rsa john_format_file”.

ssh passphrase : snowflake.

Then search for further steps like vertical pivilege escalation and find some mis behaves for the command uname -a

“uname -a; w; /lib/defended/libc.so.99”

this command can give you a root shell .