Net Sec Challenge (TryHackMe)— CTF 🚩
The Net Sec Challenge room on TryHackMe is an exciting challenge that tested my skills in utilising core cybersecurity tools like Nmap (for network mapping) and Hydra (for password cracking). I also worked with the File Transfer Protocol (FTP) to download a sensitive text file from a remote server to my local machine. This write-up details how I captured the flags, answered the questions, and completed the lab requirements.
Capture the Flag (CTF) in cybersecurity is a competitive learning exercise where participants find hidden text strings called “flags” by solving security challenges or exploiting vulnerabilities.
The Net Sec Challenge is a room in the Network Security module on TryHackMe. The module introduces passive and active network reconnaissance, using Nmap to perform live host discovery, basic/advanced port scans, OS and service version detection, and a dive into common network protocols — how they work and their potential attacks. Net Sec Challenge wraps off the module by testing these concepts.
Question 1
What is the highest port number that is open and less than 10,000?
To answer this question, I started by running an Nmap scan against the target machine.
I ran the command: nmap -sS 10.112.145.61. This command is used to run a stealthy SYN scan to find open ports without completing connection handshakes. The scan returned a report that confirmed the host was up and a list of six open TCP ports, with their port numbers and services.
Answer: 8081
Question 2
There is an open port outside the common 1000 ports; it is above 10,100. What is it?
Looking at what the previous scan returned, there is no port number that is above 10100. The highest port number returned from the scan is 10001. This indicates that the initial scan failed to capture results for the entire port range. To ensure all ports were scanned and to identify the target port above 10100, I used the -p- option.
-p- is used to scan all 65,535 ports on a target device. As shown in the screenshot above, the second scan utilising the -p- option successfully revealed a new TCP port above 10100.
Answer: 10121
Question 3
How many TCP ports are open?
All open ports identified in the previous scan utilise the TCP protocol.
Answer: 7
Question 4
On port 80, what is the service version value?
The previous Nmap scans (nmap -sS 10.112.145.61 and nmap -sS -p- 10.112.145.61) did not return a service version value, nor did they display a VERSION column alongside the PORT, STATE, and SERVICE headers.
To obtain service version information, I executed an additional Nmap command: nmap -sV 10.112.145.61. The -sV flag is used to scan and detect version information for services running on open ports.
Executing this command generated the VERSION column, providing information about service versions, including the service version value on port 80, which is the answer to question 4.
Answer: THM{MySpecialServer007}
Question 5
What is the flag hidden in the SSH server header?
The flag hidden in the SSH server header can also be found using the previous Nmap scan, nmap -sV 10.112.145.61. Reviewing the output text revealed the hidden flag.
Answer: THM{946219583339}
Question 6
We have an FTP server listening on a nonstandard port. What is the version of the FTP server?
Get Oluwakamiye Adeyemo’s stories in your inbox
Join Medium for free to get updates from this writer.
This time, I executed the nmap -sV 10.112.145.61 command with the -p- option to scan all ports, including nonstandard ones.
The nmap -sV -p- 10.112.145.61 scan returned a comprehensive list of all open ports, service names, and version values. Instead of the default port 21, I discovered the FTP server and its version details running on port 10121.
Running FTP on port 10121 instead of port 21 is a common real-world scenario. Network administrators often move common services like FTP to non-standard ports (like 10121) to avoid automated brute-force attacks.
Answer: vsftpd 3.0.5
Question 7
We learned two usernames using social engineering: eddie and quinn. What is the flag hidden in one of these two account files and accessible via FTP?
To access these accounts via FTP, I first needed to obtain the passwords. To achieve this, I made use of a login cracker tool called Hydra.
Hydra is a very fast, popular open-source network login cracker used to perform automated brute-force and dictionary attacks against live remote services. It tests a list of possible usernames and passwords to find valid credentials.
My process for using Hydra to get the passwords to eddie's and quinn's accounts:
- I created a
.txtfile containing the usernameseddieandquinn, and placed it in the same directory as the password file.
2. I ran Hydra against the target using the -L option to reference the path to the username.txt file, and using the -P option to reference the path to the rockyou.txt file, which contains a list of passwords to test alongside the usernames. I also specified the FTP port using -s 10121 because FTP wasn’t running on its default port 21.
Password found!
Hydra successfully matched the password softball to eddie’s account and cookie to quinn's account.
I logged into the FTP server using eddie's credentials.
eddie’s account did not contain any file.
I logged into the FTP server using quinn's credentials.
quinn’s account contained the sensitive file.
Using the ls command, I discovered the file that contained the hidden flag: ftp_flag.txt.
I then executed the command get ftp_flag.txt to download the text file (ftp_flag.txt) from the remote server to my local machine.
Finally, I located the file on my local machine and displayed its content using cat ftp_flag.txt.
Answer: THM{QUINN_IS_BACK007}
Question 8
Browsing to http://10.112.145.61:8081 displays a small challenge that will give you a flag once you solve it. What is the flag?
This question required using Nmap to scan a website that displays a flag when the scan has a 0% chance of being detected by an Intrusion Detection System (IDS).
By executing a Null Scan using nmap -sN 10.114.186.29, I successfully evaded the Intrusion Detection System (IDS), causing the target website to display the flag.
The Null Scan (-sN) worked because it does not set any flag; all six flag bits are set to zero. A TCP packet with no flags set will not trigger any response when it reaches an open port.
In addition, many standard firewalls and IDS rules are heavily configured to look for common, aggressive patterns like a flood of SYN packets (which indicate a standard port scan or connection attempt). Because a Null packet has no flags, it does not match standard traffic rules, allowing it to slip past basic signature-based detection entirely unnoticed.
Answer: THM{NMAP_CHAMPION001}
Conclusion
Curating this write-up further strengthened my understanding of how to analyze network protocols, execute various Nmap scans, and use Hydra to brute-force accounts.
The practical exercises for this write-up were completed in the TryHackMe Network Security Challenge room.
