🕵️‍♀️Basic Pentesting

This is a machine that allows you to practice web app hacking and privilege escalation

1. Reconnaissance

1.1 Nmap

Using nmap to scan for open ports and services

  • We find open tcp ports 22, 80, 139, 445, 8009, and 8080

2. Scanning

2.1 Gobuster

Using gobuster to brute-force directories.

We find a /development directory

2.2 Web Server

  • Visiting the IP address in the browser, we are greeted with a webpage

  • Going over to /development , we find 2 txt files

  • dev.txt

Here we find a conversation between two users referred to as k and j about the use of an outdated apache struts version.

  • j.txt

From this conversation, we can conclude that user j is using a weak password which can be easily cracked.

2.3 Enum4linux

  • We can use Enum4linux for further enumeration via SMB (port 445)

  • From the output, we can conclude that k and j referred earlier are users kay and jen respectively.

3. Gaining Access

3.1 Hydra

  • Using Hydra to brute-force jan's ssh password.

We get the credentials jan : armando

  • Login-in via ssh

4. Privilege Escalation

  • We need to be user kay to view the pass.bak file located in their home directory.

4.1 LinPeas

Linpeas is a script that searches for possible privilege escalation vectors

  • Downloading the script in the attacker machine and copying it to the target via scp to the /tmp directory

  • Executing the script on the target machine

  • From the output we can find that kay has his ssh private key in /home/kay/.ssh/id_rsa .

  • Since it is readable by anyone, we can use the key to login as kay

  • Copying the key to our attacker machine as kay_id_rsa and changing its permission to only read-write by owner

  • SSHing as kay

  • We find that the key is password protected

4.2 ssh2john

ssh2john is a part of JohnTheRipper and is used to crack ssh passphrases.

  • Using ssh2john and kay_id_rsa as input to generate an output readable by john by saving it to forjohn.txt

  • Using john to bruteforce forjohn.txt to obtain the ssh passphrase

We get beeswax as the passphrase

ssh as kay with kay_id_rsa and beeswax to view pass.bak

PreviousTryHackMeNextBlue

Last updated