Napping Walkthrough - Tryhackme

Walkthrough
Room: Napping
Platform: tryhackme
Explanation of Vulnerability:
This system exhibits a vulnerability related to the 'target="_blank"' attribute, a known attribute that attackers can exploit to control or misuse the 'href' argument. In this specific case, the victim system hosts a service known as 'Free Blog Promotion,' where users can submit blog links. Interestingly, the individual responsible for reviewing these submitted links is an Administrator.

Furthermore, it has come to our attention that this Administrator is utilizing an outdated web browser, often referred to as a 'vulnerable browser.' This browser version employs the default attribute value of 'rel' as 'opener,' which introduces a potential security risk. This risk can lead to a 'reverse tabnabbing' attack. (For a deeper understanding of reverse tabnabbing, you can watch a non-malicious explanation here: Link to Explanation).

The attacker, exploiting this vulnerability, creates a deceptive webpage that redirects users to a malicious website. Due to the Administrator's use of an outdated browser, the 'reverse tabnabbing' attack proves effective. The attacker simply replicates the content of the Admin login page, leading the Admin to believe they've been logged out (an easy trick to fall for, especially if the Admin is feeling drowsy or napping). Subsequently, the Admin attempts to log in again, unknowingly providing their credentials to the attacker.

To compound this issue, it appears that the Administrator employs the same password for their SSH account, creating an additional security risk. The subsequent privilege escalation becomes relatively straightforward, as the 'bin vim' binary appears to have a vulnerability that can be exploited for root access.

Preventive Measures:
To mitigate this vulnerability, it is essential to employ the 'rel' attribute as 'noopener' or 'noopener noreferrer' when necessary. Regularly updating applications, including web browsers, is crucial for maintaining security. Additionally, staying alert and avoiding excessive sleep during critical tasks is highly advisable.

Reference:
For more information on reverse tabnabbing and related security concerns, you can refer to the following resource: Reverse Tabnabbing - HackTricks