Basic Pentesting CTF
Port canning with nmap
Every successful penetration test or CTF challenge begins with thorough reconnaissance. To discover open ports and identify running services on the target machine, I turned to Nmap, the industry-standard network mapper.
nmap -sC -sV -T4 10.129.147.136
Fuzzing Hidden Paths with Gobuster
With the initial reconnaissance complete, it was time to dig deeper. I used Gobuster to perform directory and file enumeration, searching for hidden directories, potentially exposed files, and interesting endpoints that could reveal more about the target’s structure.
gobuster dir -u http://10.129.147.136/ -w /usr/share/wordlists/dirb/common.txt
Web Fuzzing & Uncovering `/development/`
Continuing the enumeration phase on the web server, directory brute-forcing revealed a very interesting and sensitive endpoint:
http://10.129.147.136/development/Navigating into this directory felt like checking a developer’s leftover workspace. Inside, two specific text files immediately caught my attention:
`dev.txt`
`j.txt`Inspecting the contents of these files is a crucial step, as they often contain debugging notes, internal comments, or accidental credential leaks that lead to the next breakthrough!
Deep SMB Enumeration with Enum4linux
To gather comprehensive details about the target’s SMB configuration, workgroup information, and password policies, I ran a full enumeration scan using `enum4linux`:
enum4linux -a 10.129.147.136
Credential Brute-Forcing via SSH with Hydra
With a potential username identified (such as `jan`) from our earlier reconnaissance, the next logical step is to test for weak passwords against the SSH service using hydra, a powerful and fast login cracker.
hydra -l jan -P /usr/share/wordlists/rockyou.txt ssh://10.129.147.136
Gaining Foothold via SSH
With valid credentials in hand, we can now establish a secure interactive shell session on the target machine:
ssh jan@10.129.147.136Entering the password successfully drops us into the remote terminal. We have officially secured our initial foothold! From here, the real privilege escalation journey begins.
Post-Exploitation
Get 0xNOVA71’s stories in your inbox
Join Medium for free to get updates from this writer.
After successfully establishing our initial foothold on the target system, we navigated to the home directory of user `kay` (`/home/kay`) and ran a detailed listing command to inspect hidden files and directories:
ls -lah
Accessing the `.ssh` Directory & Extracting the Private Key
After navigating into the target user’s home directory, we explored the hidden `.ssh` directory to look for authentication keys and configuration files:
cd .ssh
ls -lah
After locating the `id_rsa` private key inside the target user’s `.ssh` directory, we need to bring it over to our local machine, secure its permissions, and crack its passphrase if it is protected.
Saving and Securing the Private Key
Copy the contents of the `id_rsa` key from the target machine, save it into a local file named `id_rsa`, and restrict its permissions so that your local SSH client will accept it:
chmod 600 id_rsa
Cracking the SSH Private Key Passphrase with John the Ripper
Since the extracted SSH private key (`id_rsa`) was protected by a passphrase, we converted it into a compatible format using `ssh2john` and ran a brute-force attack using **John the Ripper** alongside the `rockyou.txt` wordlist:
john - wordlist=/usr/share/wordlists/rockyou.txt id_rsa.hashWhat is the username?
jan
What is the password?
armando
What service do you use to access the server(answer in abbreviation in all caps)?
SSH
What is the name of the hidden directory on the web server(enter name without /)?
development
What is the name of the other user you found(all lower case)?
kay
What is the final password you obtain?
heresareallystrongpasswordthatfollowsthepasswordpolicy$$
