Basic pentesting
This is a machine that allows you to practise web app hacking and privilege escalation
Very basic CTF room from tryHackMe. I have enjoyed the privilege escalation part. Brute forcing is the key point of exploitation here. Hope this write-up will help you to explore.
My target IP changed later, because I had to restart the machine.
Enumeration
1) First, a masscan all port scan: masscan -e eth0 -p 1-65535 -v --rate=10000 10.10.1.239
2) Now doing specific port scan to know more. Using nmap scan: nmap -sV -sC -p 22,139,8009,8080,80,445 -v 10.10.1.239
3) enum4linux is a very good tool and I'm using to enumerate further. And it showed me some more info: enum4linux -a -v 10.10.1.239
Here this server is vulnerable: exploit-db
4) Enumerating webpage at port 80
5) As there is a web service, I initiate a Nikto scan: nikto -h http://10.10.254.163
6) The interesting directory, /development gives two .txt file.
dev.txt says, maybe there is REST running and google says, it has vulnerability: exploit-db
j.txt says, weak password. Maybe I can brute force the password.
Exploitation
7) I was clueless which service to attack. As there are 2 different service vulnerable. I have tried to explore the ssh and used - Hydra to attack ssh: hydra -l jan -P rockyou.txt ssh://10.10.254.163
Found the password: armando
8) Accessing the machine using ssh: ssh jan@10.10.254.163
Privilege Escalation
9) Enumeration says, only /etc/passwd has read permission. So this is not vulnerable.
10) Simple directory navigation show .ssh and private key for kay
11) Copied the id_rsa, saved it using nano and then tried to use the private key. But can not log in just by the private key
12) So I need to find the hash, so using ssh2john: ssh2john.py id_rsa > rsa_hash
13) Need to crack the password again:john --wordlist=rockyou.txt rsa_hash
Password: beeswax
14) Doing ssh again with the password: ssh -i id_rsa kay@10.10.254.163
15) Now I have found a backup with a password hash. I can simply get the root access with the password.
Finally, the root shell !!
Answers
Last updated
Was this helpful?