Tryhackme - Brute It Room WriteUp

28.12.2020 — Tryhackme — 1 min read

Category - Easy
Creator - ReddyyZ
Room Link - Brute It

Reconnaissance

Let's start with nmap.

nmap -sC -sV -v -oA nmap/initial IP

1PORT   STATE SERVICE VERSION
222/tcp open  ssh     OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
3| ssh-hostkey:
4|   2048 4b:0e:bf:14:fa:54:b3:5c:44:15:ed:b2:5d:a0:ac:8f (RSA)
5|   256 d0:3a:81:55:13:5e:87:0c:e8:52:1e:cf:44:e0:3a:54 (ECDSA)
6|_  256 da:ce:79:e0:45:eb:17:25:ef:62:ac:98:f0:cf:bb:04 (ED25519)
780/tcp open  http    Apache httpd 2.4.29 ((Ubuntu))
8| http-methods:
9|_  Supported Methods: GET POST OPTIONS HEAD
10|_http-server-header: Apache/2.4.29 (Ubuntu)
11|_http-title: Apache2 Ubuntu Default Page: It works
12Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

We have 2 ports open. Now , we can run gobuster for recon but before that I always maually try out some common ones like robots.txt , login , admin etc. And turns out , we have /admin .

We have a login form . Let's check the source code . We have a comment .

Getting a shell

So , we know that the username is admin . Now , we can brute the password using hydra with rockyou.txt.

After a few secs , we got our password . Logging in with this password takes us to /admin/panel.

Here , we have our web flag and John's RSA private key. To SSH as john using this private key , we need to have the passphrase for this key as it is encrypted. For this , we use ssh2john .

ssh2john.py id_rsa > hash

Now just throw this hash to john using rockyou.txt . After a few secs , we have the passphrase.

Now SSH as john in the machine using this passphrase . And We are in . Get our user flag right away.

Privilege Escalation

Let's try some low hanging fruits first .

sudo -l

tells us that we can run /bin/cat as root user .This is awesome as now , we have READ access to everything. Let's actually try to read the root flag (most of the time it is at /root/root.txt). And Dude , we got it.

But we also have to find the root password. For that , we will read the shadow file.

So, we have the root hash which is basically a SHA-512 unix hash. Let's hashcat this.

hashcat -m 1800 -a 0 root_hash /usr/share/wordlists/rockyou.txt

After a few secs , we got it.

Boom ! We are done . This was an easy one but it was a lot of fun.

Hope you learned something new and thanks for reading .

CHAO !