Machine Name: Napping
Step1: Identify the ip address of the machine :
step2: Browse the IP address into the browser and see what it response .
I try to bypass the login pannel using sql but it didn’t work and I try to enumerate further
I try to bruteforce the directories presented with this ip doe that I used gobuster
step3: Using Gobuster I try to bruteforce hidden pages .
there are not any hidden directories now I try to perform further scan using nmap see what ports are
open and their version .
Step4: Using nmap to identify the open ports and their version.
There are only 2 open ports one is ssh and another one is http through which we are able to browse the
ip and open the website.
Let’s signup the page with our own username and password and login let’s see what will be the
response.
Then I create an account and get login with that.
Here we need to study the functionality of the website in this we can reset our password, sign out of
your account .
And there is a blog link through we can submit our website link or any kind of link that we insert it will
open it up in new tab it will redirect to that after we click HERE.
For testing purpose I try to insert any random website to test like : [Link]
then It redirect me to the webpage of testphp website
after that I try to enumerate further about how website work then I found something in view source
code section in which we can see that target=_blank.
<a href='[Link] target='_blank' >Here</a></p>
I found this link suspcious and try to research about it .
After searching for minutes I found out that the target=’_blank’ if this kind of link or input field we
found that this kind of input field is vulnerable to tapnapping .
Step5: Understanding tapnapping
Tabnapping is a type of phishing attack where an attacker tricks you by changing a browser tab that
you’ve opened in the background. Here's how it works in simple terms:
1. You click a link that opens a new tab.
2. While you’re busy on other tabs, the attacker changes the content of the new tab (like showing a
fake login page).
3. When you return to that tab, it looks like a trusted site, and you might enter sensitive
information (like your password), not realizing it’s fake.
In short, tabnapping tricks you into giving your personal information by secretly changing tabs you
aren't actively watching.
Working mechanism of tabnapping .
I copy this code and locally hosted my site with this malicious code and then I insert itinto the browser
where I need to insert the link and clicked here.
after that I open the wireshark to monitor what is going after I inject the malicious page into that link
after listening for a minute I get the credential of the user
we get the credential the open port is 22 and 80 now we try to login port 22 which is SSH with this
credentials.
Step6: Login with SSH
we successfully login as daniel through SSH with that credential.
we found that there is another user also adrian.
we found something intresting in adrain directory named [Link]
step7: now we need to perform the horizontal privilege esclation we are login as daniel and we need to
get the access of adrian first .
to get the adrian privilege first we need to go to /dev/shm/adrian_shell.sh file where is our reverse
shell .
then we need to modify the [Link] code we need to insert the path as import os
import os
[Link]('/bin/bash /dev/shm/adrian_shell.sh')
after then listen using netcat and try to run the [Link] through using python3 [Link]
and then we successfully get the adrian shell
then I try linpeas to find out the method through which I can get the root shell .
And I found that /usr/bin/vim is run as sudo
then we try to execute it as sudo and then put :sh , :!/bin/sh
after that I get the root shell.