White Rose-THM Walkthrough

Yet another Mr. Robot themed challenge.

Nmap Scan:

Open Ports: 22 & 80

By going to the given ip we are getting following page:

While doing directory bruteforcing nothing interesting was found:

ffuf -u http://10.10.132.97/FUZZ -w /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt -t 100

Now I will try to find other subdomains using ffuf

ffuf -u ‘http://cyprusbank.thm/' -H “Host: FUZZ.cyprusbank.thm” -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-20000.txt -mc all -t 100 -ic -fw 1

Subdomain found: www, admin

I will add these 2 in my /etc/hosts file as shown below:

As we are given a username and password ,I will login using that:

After I am logged in I am looking for Tyrel Wellick’s phone number. But it is hidden as shown in the picture below:

This was not helpful after clicking the messages button I got a new Password from the chat:

After I changed the query string i.e. ?c=0:

Gayle Bev: p~]P@5!6;rs558:q

When I use these creds i can see Tyrell’s Phone number:

Now I went to the settings and changed the password while capturing request:

After sending it the repeater I removed the password section to, may be generate an error:

By looking at this error i searched and found an exploit the link is given below:

https://security.snyk.io/vuln/SNYK-JS-EJS-2803307