Basic Pentesting Room
{Try Hack Me}
Hello Guys,
Now start our machine and let’s dive onto our 1st task……
machine link: https://tryhackme.com/r/room/basicpentestingjt
note: To check the connectivity just ping to that IP address.
Q1. Find the services exposed by the machine.
Ans: To find the service we need to scan all the open ports for the give IP address. So we need to use the tool “Nmap” to find the open ports.
command: nmap -sC -sV -p- <IP> or
command: nmap — open — vv -T5 <IP> for fast scanning the port
we can see that there are 5 ports open with different service on it.
Q2. What is the name of the hidden directory on the web server(enter name without /)?
Ans: /development
For this we need to use a command line tool “gobuster” for directory brute force. It is generally used to find the hidden directories on a webpage. So we will use the url i.e http://<IP> and the wordlist will be “common.txt” which is in “/usr/share/wordlist/dirb/common.txt”
command: gobuster dir -u <url> -w <wordlist path>
here it it the hidden directory is /development.
Q.3 User brute-forcing to find the username & password.
Ans: To find both username and password we will use “enum4linux”, which is an enumeration tool generally used to find more accurate information about a target.
When we visited that directory we found 2 users i.e -K and -J and the usernames are incomplete.
command: enum4linux <IP> -U
Q.4 What is the username?
Ans: jan
We found this in the result of enu4linux.
Q.5 What is the password?
Ans: armando
To find the password for the user “jan” we will use “hydra”, a tool used for brute forcing passwords and username using wordlists. Here we will use the famous wordlist i.e “rockyou.txt”
command: hydra -l jan -P /use/share/wordlist/rockyou.txt <IP> ssh
Q.6 What service do you use to access the server(answer in abbreviation in all caps)?
Ans: ssh, is the service that we will use to access the server.
Q7. Enumerate the machine to find any vectors for privilege escalation
Get M4$T3R_M!N&’s stories in your inbox
Join Medium for free to get updates from this writer.
Ans: As we are having both username and password now try to login to the ssh service to access the server.
command: ssh username@<IP>
Q.8 What is the name of the other user you found(all lower case)?
Ans: kay
To check the other users we have 2 methods
- to check the home directory i.e generally when there is more than one user in a machine a directory with the username is always available in the home directory.
- to check in the /etc/passwd file.
Q9. If you have found another user, what can you do with this information?
Ans: As we found the another user “kay” we will see what’s inside the directory of kay i.e in /home/kay
we found a file with name “pass.bak” which is a backup file, but when we use ls -la to list all the hidden directory and files, there is a directory with name “.ssh”.
move inside .ssh we can see the id_rsa file using which we can switch the user to kay. Now copy the id_rsa file and paste it in a file into your main machine and give the executable permission, and use it to login ssh.
command: chmod 600 id_rsa
command: ssh kay@<IP> -i id_rsa
But after using the same command we require password for it so now we will use the tool “john the ripper” to extract the password from the id_rsa file will use the same to connect with ssh server.
command: python3 /usr/share/john/ssh2john.py > hash.txt
This will convert the file into txt file and using “john” and wordlist rockyou.txt we will find the password for the user kay.
so we found the password for the user kay i.e kay:beeswax.
now with this username and password connect with ssh, use the same command for it.
command: ssh kay@<IP> -i id_rsa
Q.10 What is the final password you obtain?
Ans: heresareallystrongpasswordthatfollowsthepasswordpolicy$$
Now it is our last question for our task 1 and now we need to see what’s inside the “pass.bak: file. To read
command: cat /home/kay/pass.bak
That’s it we have the last flag and we conqured this machine.
“Remember, in the journey of hacking, every challenge conquered is a step closer to mastering the art. Keep exploring, keep learning, and let curiosity be your guide. Happy hacking!”
