Basic Pentesting TryHackMe
So today is the day we look at the room Basic Pentesting from TryHackMe. If you reading this, you mostly would have seen John Hammond’s video on this and if not then you should give it a try. He is insanely good at what he does. Love him!
Anyway, you can find the room here.
Q. Find the services exposed by the machine
A → Just run a simple nmap scan for this:
nmap -sV 10.10.208.139
Q. What is the name of the hidden directory on the web server(enter name without /)?
A → I used dirbuster for this:
dirb http://10.10.208.139
/development is the path which we are looking for:
Q. User brute-forcing to find the username & password
A → We know that SMB port is open so we can enumerate that and look for any info. But before that i hope you know SMB basically is. If not, go through this article and this video. You can and should go through more articles/videos and get to know what and why it exists etc.
I will be using enum4linux for enumerating the port and try to get the info we want:
Once the scan is done, we see the users which have been identified:
Q. What is the username?
A → jan
Q. What is the password?
A → For this, we will be brute forcing using Hydra (HINT says that too):
Password is armando
Get eXpl017’s stories in your inbox
Join Medium for free to get updates from this writer.
I gave ssh protocol for hydra to test because port 22 is open and we can gain access to the server if we get the password.
Q. What service do you use to access the server(answer in abbreviation in all caps)?
A → SSH
Q. Enumerate the machine to find any vectors for privilege escalation
A → I searched a bit by myself but didnt get much info, so next step is to use tools like LinPEAS. I used SCP to send the file to jan in the /tmp directory and then ran it:
We see that kay’s private ssh keys are readable by jan. We copy and use that key to login to kay’s account:
Comes in JohnTheRipper. I recommend you go through this article to understand the process we going to use now.
I stored the above output in john_use.txt file, and then gave that file to john for finding the passphrase, while also giving rockyou.txt as wordlist:
Passphrase for kay’s private ssh keys: beeswax
Q. What is the name of the other user you found (all lower case)?
A → kay
Q. What is the final password you obtain?
A → Now we can login as kay and look for the final flag:
Final Flag: heresareallystrongpasswordthatfollowsthepasswordpolicy$$
Thats all for today! Even i gained a lot of knowledge doing this room and hope you did too.
THANK YOU!!
