Overpass.

01 · The attack model: map who gets to decide

The room exposes web and SSH services. Web access first leads to an administration area whose client-side code controls a session marker. That marker reveals a source bundle, which explains how the password manager handles a local credential. An SSH session then exposes a root-owned updater. The final question is not whether cron can run a script. It is who can influence the hostname and response that root executes.

02 · Build a small service inventory

Start with the private address assigned to the running room. A small scan gives you the reachable services and enough version context to choose a web or SSH branch. Save the output because later observations should be connected to facts, not remembered loosely.

export LAB_IP="<tryhackme-assigned-ip>"
mkdir -p nmap
nmap -sC -sV -Pn -oA nmap/overpass "$LAB_IP"

-sV asks for service versions, -sC runs Nmap's default scripts, and -oA records evidence in three formats. The room presents HTTP and SSH. That is a normal-looking pair, so the next move is simple web discovery rather than guessing users or passwords.

# Representative result, not an observed scan
22/tcp open  ssh
80/tcp open  http

03 · Session trust: the browser cannot grant access

Use the site's visible routes, links and a constrained content discovery pass to find the administration surface and downloadable material. Limit the wordlist and status codes so the action remains evidence gathering, not traffic generation.

ffuf -u "http://$LAB_IP/FUZZ" -w /usr/share/seclists/Discovery/Web-Content/common.txt -fc 404 -t 20 -of json -o content-discovery.json

On the room's admin route, inspect JavaScript as part of the application's security design. The important question is whether the server authenticates a protected endpoint or whether the front end merely checks whether a cookie has a value. OWASP's authentication testing guidance calls out fixed client-controlled parameters as an authentication-bypass risk.

curl -s "http://$LAB_IP/admin/" -o admin.html
grep -Eo 'src="[^"]+\.js' admin.html
curl -s "http://$LAB_IP/<admin-script>" -o admin.js
grep -nEi 'cookie|session|login|redirect' admin.js

In this authorised room, the client code exposes a session assertion that can be altered in a lab browser or intercepting proxy to reach admin content. The lesson is narrower than cookie manipulation: protected endpoints must validate an unexpired server-side session and authorise the requested action. A front-end redirect is presentation logic, not access control.

04 · Source review: distinguish encoded from protected

The admin content points to an Overpass source bundle. Download it locally and read the code before trying any credential. A source review answers two useful questions: where the application stores data, and whether an apparent secret is encrypted, hashed or merely encoded.

mkdir -p overpass-source
unzip <lab-source-archive> -d overpass-source
rg -n -i 'password|hash|encrypt|decrypt|rot|ssh|config' overpass-source

The room's password-manager implementation uses a reversible transformation for the stored value. Reversible obfuscation can hide text from a casual glance; it does not establish a security boundary. Decode only the lab value locally, verify that the result is structurally plausible, and keep it out of notes, screenshots and shell history. The actual password is intentionally not published here.

Before using a recovered lab credential, ask what claim it tests. Here, it tests the SSH user boundary indicated by the source and room artefacts. It is not permission to re-use the value across services or outside the room.

05 · User access is evidence, not the finish line

Use the redacted, room-only result to authenticate once to the user account identified by the lab. Then establish the local authority model before looking for escalation: identity, groups, scheduled jobs, service files, writable locations and the provenance of anything a privileged process consumes.

ssh <lab-user>@"$LAB_IP"
id
cat /etc/crontab
ls -l /etc/hosts

The significant evidence is a root-owned cron entry that retrieves a build script through a hostname and pipes the response to a shell. The Linux crontab(5) documentation explains that system crontabs name the user context before the command. Here that context is root, so every boundary in the retrieval chain is privileged.

06 · Root cron update: when name resolution becomes code control

A cron job that executes remotely fetched content combines three decisions: which host a name resolves to, whether the connection identifies the intended server, and whether the retrieved artefact is approved. In Overpass, a lower-privileged account can influence the local host-resolution entry used by the root job. A writable configuration file therefore becomes part of a code-execution path.

# Read-only evidence first. Do not publish the room's exact line or live address.
grep -nE 'curl|wget|bash|sh' /etc/crontab
getent hosts <lab-update-hostname>
ls -l /etc/hosts

For a controlled lab proof, use the smallest harmless artefact possible. Host an approved test script that writes the effective identity to a temporary proof file, redirect only the room's update hostname according to the room's boundary, then wait for one scheduled interval. Do not use a remote-shell payload and do not use this technique outside the fictional machine.

# Lab-only proof shape. Use your assigned room address and a harmless artefact.
mkdir -p lab-update/downloads/src
printf '#!/bin/sh\nid > /tmp/overpass-lab-proof\n' > lab-update/downloads/src/buildscript.sh
python3 -m http.server 80 --directory lab-update
# Restore the room mapping after the one scheduled proof.

This verifies the trust failure without publishing a privileged-shell recipe. The durable defensive fix is to stop executing remote content directly. Root should resolve a pinned endpoint over authenticated transport, download to a controlled directory, verify a signature or digest against a trusted key, and execute an approved local artefact. If any check fails, the job should stop.

07 · Decision log: recognise the stop conditions

The admin page is visible but actions fail

That can mean the browser gate changed while the server still enforces authorisation. Treat it as a working control, not a reason to keep modifying cookies. Compare a protected request with and without the session state, then stop if the server rejects both.

The source value does not decode cleanly

Do not guess transforms indefinitely. Verify the exact source version and whether the value is a hash, an encoded sample or a fixture. Source tells you the function to reason about; it does not justify spraying SSH.

SSH works but the cron path is absent

Return to the evidence. Inspect the system crontab and relevant service configuration, then check whether the intended hostname resolves locally. A successful user shell is not proof that every published detail still applies to the current room image.

The update does not reach the harmless test server

Restore the lab mapping and read the job configuration again. Confirm the scheduled interval, path and network reachability. Do not broaden the redirect, modify unrelated names, or leave the environment changed after testing.

08 · Findings, fixes and detection opportunities

MITRE ATT&CK maps scheduled-task abuse to T1053.003: Cron. A privileged scheduler that creates a network connection, receives unverified data, then starts a shell is a stronger signal than an isolated curl command.

09 · What transfers beyond this room

• Every protected route needs a server-side decision. A client redirect, hidden button or cookie value is never access control.
• Source code explains attack surface. Look for how secrets are generated, stored and recovered before testing a credential.
• Privilege is a supply-chain property. A root job inherits the risk of every DNS answer, URL, certificate, file and interpreter it trusts.
• Prefer harmless proofs. Demonstrate identity or controlled file creation in a lab before reaching for an interactive payload.
• Repair chains as chains. Hardening SSH does not fix a root updater that accepts unverified network content.