CTF Traverse
Traverse
Bob is a security engineer at a firm and works closely with the software/DevOps team to develop a tourism web application. Once the website was moved from QA to Production, the team noticed that the website was getting hacked daily and wanted to know the exact reason. Bob consulted the blue team as well but has yet to be successful. Therefore, he finally enrolled in the Software Security pathway at THM to learn if he was doing something wrong.
ALL THE ANSWERS ARE IN THE HTML CODE.
<!-- Rest PHP code and html content -->
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>Tourism Website</title>
<script src='/tailwind.min.js'></script> <!-- THIS IS OFFICIAL FILE - DO NOT CHANGE IT -->
<script src='custom.min.js'></script> <!-- THIS IS CUSTOM JS FILE-->
<link rel="stylesheet" href="/style.css">
</head>
<body>
<!-- Navigation Bar -->
<nav class="bg-gray-900 text-white p-6">
<div class="flex justify-between items-center">
<a href="/" class="text-lg font-bold">Tourism MHT </a>
<ul class="flex items-center gap-5">
<!-- <li><a href="/img" class="hover:text-gray-300">Logs</a></li> Please keep all images in this folder -->
<!-- <li><a href=".././logs" class="hover:text-gray-300">Logs</a></li> DevOps team to check and remove it later on -->
</ul>
</div>
</nav>
<!-- Main Content -->
<main class=" mx-auto py-8 h-[80vh] flex items-center justify-center">
<div class="rounded overflow-hidden shadow-lg bg-white p-8 flex ">
<h2 class="text-gray-700 text-3xl py-6"> FINALLY HACKED !!! I HATE MINIFIED JAVASCRIPT</h2>
</div>
</main>
<!-- Footer -->
<footer class="bg-gray-900 text-white flex items-center justify-center">
<div class="text-center p-4">
<p>© 2023 Tourism.mht. All rights reserved.</p>
</div>
</footer></body>
</html>
Questions
What type of encoding is used by the hackers to obfuscate the JavaScript file?
HEX
Output : view-source:http://IP_MACHINE/custom.min.js
// I WILL KEEP THE OBFUSCATED SO NO ONE CAN UNDERSTAND
28 66 75 6E 63 74 69 6F 6E 28 29 7B 66 75 6E 63 74 69 6F 6E 20 64 6F 4E 6F 74 68 69 6E 67 28 29 7B 7D 76 61 72 20 6E 3D 22 44 49 52 45 43 54 4F 52 59 22 3B 76 61 72 20 65 3D 22 4C 49 53 54 49 4E 47 22 3B 76 61 72 20 6F 3D 22 49 53 20 54 48 45 22 3B 76 61 72 20 69 3D 22 4F 4E 4C 59 20 57 41 59 22 3B 76 61 72 20 66 3D 6E 75 6C 6C 3B 76 61 72 20 6C 3D 66 61 6C 73 65 3B 76 61 72 20 64 3B 69 66 28 66 3D 3D 3D 6E 75 6C 6C 29 7B 63 6F 6E 73 6F 6C 65 2E 6C 6F 67 28 22 46 6C 61 67 3A 22 2B 6E 2B 22 20 22 2B 65 2B 22 20 22 2B 6F 2B 22 20 22 2B 69 29 3B 64 3D 75 6E 64 65 66 69 6E 65 64 7D 65 6C 73 65 20 69 66 28 74 79 70 65 6F 66 20 66 3D 3D 3D 22 75 6E 64 65 66 69 6E 65 64 22 29 7B 64 3D 75 6E 64 65 66 69 6E 65 64 7D 65 6C 73 65 7B 69 66 28 6C 29 7B 64 3D 75 6E 64 65 66 69 6E 65 64 7D 65 6C 73 65 7B 28 66 75 6E 63 74 69 6F 6E 28 29 7B 69 66 28 64 29 7B 66 6F 72 28 76 61 72 20 6E 3D 30 3B 6E 3C 31 30 3B 6E 2B 2B 29 7B 63 6F 6E 73 6F 6C 65 2E 6C 6F 67 28 22 54 68 69 73 20 63 6F 64 65 20 64 6F 65 73 20 6E 6F 74 68 69 6E 67 2E 22 29 7D 64 6F 4E 6F 74 68 69 6E 67 28 29 7D 65 6C 73 65 7B 64 6F 4E 6F 74 68 69 6E 67 28 29 7D 7D 29 28 29 7D 7D 7D 29 28 29 3B
What is the flag value after deobfuscating the file?
DIRECTORY LISTING IS THE ONLY WAY
CyberChef -> From HEX Auto
Logging is an important aspect. What is the name of the file containing email dumps?
email_dump.txt
http://IP_MACHINE/logs/
The logs folder contains email logs and has a message for the software team lead. What is the name of the directory that Bob has created?
PLANNING
The first phase of SSDLC is: Planning
What is the key file for opening the directory that Bob has created for Mark?
THM{100100111}
http://IP_MACHINE/logs/email_dump.txt
From: Bob <bob@tourism.mht>
To: Mark <mark@tourism.mht>
Subject: API Credentials
Hey Mark,
Sorry I had to rush earlier for the holidays, but I have created the directory for you with all the required information for the API.
You loved SSDLC so much, I named the API folder under the name of the first phase of SSDLC.
This page is password protected and can only be opened through the key. THM{100100111}
See ya after the holidays
Bob.
What is the email address for ID 5 using the leaked API endpoint?
john@traverse.com
http://IP_MACHINE/planning/
http://IP_MACHINE/api/?customer_id=5
What is the ID for the user with admin privileges?
3
http://IP_MACHINE/api/?customer_id=3
{
"data": {
"id": "3",
"name": "admin",
"email": "realadmin@traverse.com",
"password": "admin_key!!!",
"timestamp": "2023-05-23 04:47:25",
"role": "admin",
"loginURL": "/realadmin",
"isadmin": "1"
},
"response_code": 200,
"response_desc": "Success"
}
What is the endpoint for logging in as the admin? Mention the last endpoint instead of the URL. For example, if the answer is URL is tryhackme.com/admin - Just write /admin.
/realadmin json
The attacker uploaded a web shell and renamed a file used for managing the server. Can you find the name of the web shell that the attacker has uploaded?
http://IP_MACHINE/realadmin/
look code-source for clues.
login and e-mail json
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>Tourism Website</title>
<script src='../tailwind.min.js'></script>
<!-- THIS IS OFFICIAL FILE - DO NOT CHANGE IT -->
<script src='custom.min.js'></script>
<!-- THIS IS CUSTOM JS FILE-->
<link rel="stylesheet" href="../style.css">
</head>
<body>
<body>
<div class="container w-full">
<h2 class="heading">Welcome to Admin Page</h2> OS Version: #84~20.04.1-Ubuntu SMP Mon Jan 20 22:14:54 UTC 2025 <br>Current Time: 2026-08-20 11:17:45 <br>Logged-in User: ubuntu <br>
<br>You can also execute commands using following drop down <br>
<br>
<form method="POST" name="main.php">
<div class="input-field1">
<!--<input type="text" name="cmd" autofocus id="cmd" size="80">-->
<select name="commands">
<option value="whoami">System Owner</option>
<option value="pwd">Current Directory</option>
</select>
<input type="submit" value="Execute" class="bg-black-200">
</div>
</form>
</body>
</html>
Using DIR : Scan the web server (http://192.168.1.224/) for directories using a dictionary file
BurSuit soon..