Napping Walkthrough - Tryhackme

Walkthrough Room: Napping Platform: tryhackme Explanation of Vulnerability: This system exhibits a vulnerability related to the target_blank attribute a known attribute that attackers can exploit to control or misuse the href argument.
In this specific case the victim system hosts a service known as Free Blog Promotion where users can submit blog links.
Interestingly the individual responsible for reviewing these submitted links is an Administrator. Furthermore it has come to our attention that this Administrator is utilizing an outdated web browser often referred to as a vulnerable browser.
This browser version employs the default attribute value of rel as opener which introduces a potential security risk.
This risk can lead to a reverse tabnabbing attack.
For a deeper understanding of reverse tabnabbing you can watch a non-malicious explanation here: Link to Explanation. The attacker exploiting this vulnerability creates a deceptive webpage that redirects users to a malicious website.
Due to the Administrators use of an outdated browser the reverse tabnabbing attack proves effective.
The attacker simply replicates the content of the Admin login page leading the Admin to believe theyve been logged out an easy trick to fall for especially if the Admin is feeling drowsy or napping.
Subsequently the Admin attempts to log in again unknowingly providing their credentials to the attacker. To compound this issue it appears that the Administrator employs the same password for their SSH account creating an additional security risk.
The subsequent privilege escalation becomes relatively straightforward as the bin vim binary appears to have a vulnerability that can be exploited for root access. Preventive Measures: To mitigate this vulnerability it is essential to employ the rel attribute as noopener or noopener noreferrer when necessary.
Regularly updating applications including web browsers is crucial for maintaining security.
Additionally staying alert and avoiding excessive sleep during critical tasks is highly advisable. Reference: For more information on reverse tabnabbing and related security concerns you can refer to the following resource: Reverse Tabnabbing - HackTricks

Источник: rutube.ru