---
description: https://tryhackme.com/room/neighbour
---

# neighbour

## NEIGHBOUR WRITEUP

_By Jacvbtaylor_

```
       Used openvpn and Kali Linux 
                 https://tryhackme.com/room/neighbour
         completed Nov 12, 2022
```

"Check out our new cloud service, Authentication Anywhere -- log in from anywhere you would like! Users can enter their username and password, for a totally secure login process! You definitely wouldn't be able to find any secrets that other people have in their profile, right?"

### STEP 1: Recon

Using the provided IP and my [nmap automation script](https://github.com/jacvbtaylor/nmapscript), an unencrypted http webserver was discovered on port 80.&#x20;

<figure><img src="https://3506405344-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FAthR6A4VcbL2rS4S7yra%2Fuploads%2F8c1AFPCvdCpQdE9KshOj%2Fimage.png?alt=media&#x26;token=73f2aba8-cb12-4c97-9f2b-74286be4a2f6" alt=""><figcaption><p>NMAP</p></figcaption></figure>

Upon visiting the site, there is a login page with a username and password field as well as some guidance underneath the login button.

<figure><img src="https://3506405344-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FAthR6A4VcbL2rS4S7yra%2Fuploads%2ForLDnpnSNcV2MZBaZKk6%2Fimage.png?alt=media&#x26;token=c2f79aad-f374-4242-9e13-a28fd35cfc94" alt=""><figcaption><p>Login</p></figcaption></figure>

Hitting `Ctrl+U` on the keyboard opens a new tab with the source code. The source code has a message indcating the guest username and password is _guest:guest_ and to stay away from the admin account.&#x20;

<figure><img src="https://3506405344-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FAthR6A4VcbL2rS4S7yra%2Fuploads%2FbzJaNiPYtY4J6WSRYWrs%2Fimage.png?alt=media&#x26;token=4f684987-d941-4434-af0d-951efd1f0f93" alt=""><figcaption><p>Soruce Code</p></figcaption></figure>

### STEP 2: Login

Using the provided credentials, a guest user login was successful. The URL now indicates `/profile.php?user=guest`. Surely it can't be as easy as turning guest to admin to get unauthorized access..&#x20;

<figure><img src="https://3506405344-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FAthR6A4VcbL2rS4S7yra%2Fuploads%2FYOIxFGqKpeD6OV0PLu6t%2Fimage.png?alt=media&#x26;token=7123e35b-39c0-43cc-b587-847b8c5a0d6b" alt=""><figcaption><p>Guest</p></figcaption></figure>

### Step 3: Attack

After changing `guest` to `admin` and requesting the updated URL, the attack was successful. I was now the admin user without knowing the admin password.

<figure><img src="https://3506405344-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FAthR6A4VcbL2rS4S7yra%2Fuploads%2F7UqZt7g1ezpVdgh0PbtT%2Fimage.png?alt=media&#x26;token=3ab05913-f616-4b9d-b0da-e2c46730e4c7" alt=""><figcaption><p>Admin</p></figcaption></figure>

### Remediation:&#x20;

Avoid displaying private object references and guessable direct identifiers. This authentication bypass is accomplished by an IDOR vulnerability which does not properly map validation to the user. If the usernames were replaced with a secure hash or other similar token, pivoting accounts wouldn't be accomplished in this manner.&#x20;
