TryHackMe TakeOver Machine Walkthrough — shaggy

Description: Hey everyone, I’m sharing the walkthrough for the TakeOver machine on TryHackMe. This machine highlights the impact of subdomain takeover vulnerabilities. Let’s get into it. 🍾 🙌 🎉

description:

Hello there, I am the CEO and one of the co-founders of futurevera.thm. In Futurevera, we believe that the future is in space. We do a lot of space research and write blogs about it. We used to help students with space questions, but we are rebuilding our support. Recently blackhat hackers approached us saying they could takeover and are asking us for a big ransom. Please help us to find what they can takeover. Our website is located at https://futurevera.thm Hint: Don’t forget to add the MACHINE_IP in /etc/hosts for futurevera.thm ;)

We start by discovering open ports with Threader3000 , then fingerprint services with Nmap.

Visiting the web application we see a space-themed site. Poking around doesn’t reveal anything obvious. Given the machine name and description, we decide to focus on subdomains.

We use ffuf to enumerate subdomains, first checking the response size baseline and then filtering with -fs.

We find 2 subdomains and add them to /etc/hosts.

Curling the portal subdomain tells us it’s only accessible over VPN.

We repeat the subdomain search over HTTPS, again setting the baseline byte count and filtering.

Two more subdomains discovered via HTTPS.

We add these to /etc/hosts as well.

Navigating to the support subdomain, we inspect its TLS certificate.

We note the DNS NAME listed in the certificate.

That DNS name goes into /etc/hosts too.

Requesting that address returns the flag directly in the URL bar.

Thanks for reading, happy hacking! :)