TryHackMe Exploitation and Weaponisation Room Writeup

#cybersecurity #tryhackme #exploit #writeup

TASK 2

Nmap flags a Windows 7 host with SMB on port 445, hinting at MS17-010. Which Metasploit auxiliary module would you run before loading the exploit?

Answer: auxiliary/scanner/smb/smb_ms17_010

While checking the HTTP response headers during a web application penetration test, you noticed that the application does not implement the HTTP Strict-Transport-Security (HSTS) header. Which of the following actions would you perform?
a) Attempt to demonstrate an SSL stripping attack
b) Document it and move on

Answer: b

TASK 3

You've gained command injection on an internal app running on a Linux server. What's the first command you run to prove execution without touching the disk?

Answer: whoami

While testing a web application, you confirmed that an SQL-injection vulnerability could be exploited. What SQL query can you attempt to inject in order to check the privileges of the database user?

Answer: SELECT SYSTEM_USER

TASK 4

What example of a high-value action can be abused to hijack user accounts and escalate access?

Answer: Password Reset

When exploiting an IDOR vulnerability in an online learning platform, which among the following roles could be targeted in order to demonstrate the greatest impact?
a) User
b) System Administrator
c) Teacher

Answer: b) System Administrator

Because the person with the highest authority

TASK 5

During a web application penetration test, you discovered a stored XSS that can be viewed by other users. What cookie attribute must be set to False in order to demonstrate cookie theft?

Answer: HttpOnly

Among the three options below, choose two that can be chained in order to demonstrate greater impact. Answer Format: a,b
a) An XSS in a support chat
b) A source-code disclosure vulnerability that exposes hashing functions
c) An IDOR in the change-password flow that requires a hashed email address

Answer: b,c

Vulnerability chaining is the process of using the output from one vulnerability as a trigger to exploit another vulnerability.

Here, the reason options b and c match is based on a direct cause-and-effect relationship:

The constraint in option c: Even if there is an IDOR vulnerability in the password reset flow, the request requires verification of the victim’s hashed email address, so the exploit will not work on its own without this information.

The key in option b: The source code disclosure reveals which algorithm and method the system uses to hash emails.

Combined effect: The target user’s email is hashed using the disclosed function, and this value is then appended to the IDOR request to change the password.

Thus, a “source code leak”—which on its own would be considered moderate—and an “IDOR” that is limited by parameter constraints are combined to directly result in a full account takeover.

TASK 6

You need to test one request parameter in Burp Suite in order to capture a clear evidence. Which module can be used to achieve this?

Answer: Repeater

You confirmed an SQL-injection vulnerability and wanted to automate the exploitation without causing unintended damage to the environment. Which flags and values can you use to retrieve only one row from a table? E.g., --level=5 --risk=5