search

user-secretBasic PenTesting

#rooms #THM #machines

hashtag
Connecting

First download the vpn connection file from herearrow-up-right to connect to the THM network

sudo openvpn <path to the vpnfile>

hashtag
Scanning

Performing a basic and simple nmap scan

$ nmap -sT 10.10.4.175
Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-03-04 08:17 +03
Nmap scan report for 10.10.4.175
Host is up (0.086s latency).
Not shown: 994 closed tcp ports (conn-refused)
PORT     STATE SERVICE
22/tcp   open  ssh
80/tcp   open  http
139/tcp  open  netbios-ssn
445/tcp  open  microsoft-ds
8009/tcp open  ajp13
8080/tcp open  http-proxy

Nmap done: 1 IP address (1 host up) scanned in 4.44 seconds

we have some open services one of them is http lets check it

the source code has nothing useful but a simple note

lets search for hidden directories using ffuf

we found a directory named development lets check it

we see two files here so we have to check them

from this one we got a version that we might need 2.5.12

we see in this note that a member named J received a msg that tells him to change his password because it was cracked very easily we have to note this

hashtag
scan the SMB server

now we use enum4linux to enumerate the SMB server

we found two users jan and kay

hashtag
Gaining Access

going back to this note looks like the J is jan and K is kay, so jan might have a weak password that we can crack

we have obtained the password of jan so we can now ssh to the machine and get Initial Foothold, then we can start an http server to transfer a script named linpeas to enumerate the system.

after running linpeas we found a private ssh key for kay, located at /home/kay/.ssh which can be used to login as kay, using the same way we transferred linpeas we can transfer id_rsa back to our machine then ssh to kay using it, when we try to ssh as kay it asks for passphrase of the key private key so we need to brute-force it using a tool named john the ripper we do this as follows

now we can ssh to kay and get the final password

and that's it

Happy hacking :D

PreviousTHMNextPickle Rick

Last updated