Basic Pentesting

Info

• Platform: Tryhackme
• Machine Name: Basic Pentesting
• Target IP/Host: 10.10.144.28
• OS / Version: Linux
• Difficulty / Category: Easy

Overview

Hello, This is my second CTF writeup. Last time I did a machine on HTB, but today I will share my experience with a TryHackMe challenge.

Basic Pentesting is an easy Linux machine and we can learn about brute forcing, hash cracking and service enumeration.

Let’s start.

Recon & Enumeration

First, I started with nmap basic scan on the machine to see what ports are open. And the scan showed me 6 open ports 22, 80, 139, 445, 8009, 8080.

┌──(kali㉿kali)-[~]
└─$ nmap 10.10.144.28 -Pn -n --open -oN tcpfull.nmap
Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-01-31 10:58 EST
Nmap scan report for 10.10.144.28
Host is up (0.41s latency).
Not shown: 994 closed tcp ports (reset)
PORT     STATE SERVICE
22/tcp   open  ssh
80/tcp   open  http
139/tcp  open  netbios-ssn
445/tcp  open  microsoft-ds
8009/tcp open  ajp13
8080/tcp open  http-proxy

Nmap done: 1 IP address (1 host up) scanned in 8.13 seconds

I ran a detailed nmap scan on these 6 ports to get more information about what services were running.

PORT     STATE SERVICE     VERSION
22/tcp   open  ssh         OpenSSH 7.2p2 Ubuntu 4ubuntu2.4 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
|   2048 db:45:cb:be:4a:8b:71:f8:e9:31:42:ae:ff:f8:45:e4 (RSA)
|   256 09:b9:b9:1c:e0:bf:0e:1c:6f:7f:fe:8e:5f:20:1b:ce (ECDSA)
|_  256 a5:68:2b:22:5f:98:4a:62:21:3d:a2:e2:c5:a9:f7:c2 (ED25519)
80/tcp   open  http        Apache httpd 2.4.18 ((Ubuntu))
|_http-server-header: Apache/2.4.18 (Ubuntu)
|_http-title: Site doesn't have a title (text/html).
139/tcp  open  netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
445/tcp  open  netbios-ssn Samba smbd 4.3.11-Ubuntu (workgroup: WORKGROUP)
8009/tcp open  ajp13       Apache Jserv (Protocol v1.3)
| ajp-methods:
|_  Supported methods: GET HEAD POST OPTIONS
8080/tcp open  http        Apache Tomcat 9.0.7
|_http-favicon: Apache Tomcat
|_http-title: Apache Tomcat/9.0.7
Service Info: Host: BASIC2; OS: Linux; CPE: cpe:/o:linux:linux_kernel

Host script results:
|_nbstat: NetBIOS name: BASIC2, NetBIOS user: <unknown>, NetBIOS MAC: <unknown> (unknown)
|_clock-skew: mean: 1h39m53s, deviation: 2h53m13s, median: -7s
| smb-security-mode:
|   account_used: guest
|   authentication_level: user
|   challenge_response: supported
|_  message_signing: disabled (dangerous, but default)
| smb2-time:
|   date: 2025-01-31T16:01:21
|_  start_date: N/A
| smb2-security-mode:
|   3:1:1:
|_    Message signing enabled but not required
| smb-os-discovery:
|   OS: Windows 6.1 (Samba 4.3.11-Ubuntu)
|   Computer name: basic2
|   NetBIOS computer name: BASIC2\x00
|   Domain name: \x00
|   FQDN: basic2
|_  System time: 2025-01-31T11:01:21-05:00

The detailed scan showed me that the machine was running OpenSSH 7.2p2, Apache httpd 2.4.18, and SMB with guest access enable.

I checked both services and found OpenSSH 7.2p2 has a username enumeration vulnerability but Apache httpd 2.4.18 didn’t have any useful vulnerabilities.

Next, I visited port 80 and found a page that said the web site was under maintenance.

When I checked the page’s source code(with view source), I found an interesting comment.

After finding that comment, I decided to look for hidden directories using brute force. And I found a directory called ‘development’.

Inside the directory, I found two text files: dev.txt and j.txt. The dev.txt was about development procedures and j.txt was about a message for someone named J.

I thought that I found all hints on port 80, and I moved on to investigate The SMB port that I found earlier.

I started checking the SMB server and found a share called ‘Anonymous’. Since it allowed guest access, I was able to log in and got file called ‘staff.txt’.

Inside staff.txt, I found out about two people: Jan, who looked like a new employee on the system, and Kay, who seemed to be a senior staff.

Since this system was using SMB, I decided to scan it with enum4linux to get more information.

enum4linux -a 10.10.144.28

The scan showed me the same two usernames I found before: kay, jan.

Initial Access

Now I had the usernames and knew SSH was running, I decided to try breaking into SSH using Hydra for password brute forcing.

I decided to try user jan first since he was new to the system and might have a weaker password.

hydra -l jan -P /usr/share/wordlist/rockyou.txt ssh://10.10.144.28 -V

After running Hydra, it worked! I successfully found jan’s password.

Using Jan’s username and password, I logged into the system through SSH.

ssh jan@10.10.144.28

There was nothing interesting in jan’s home directory, so I decided to check kay’s home directory instead.

In kay’s home directory, I found .ssh directory and noticed something interesting: kay’s private SSH key had read permission for all users.

Privilege Escalation

I copied kay’s private key to my local system and tried to use it to log in.

However, it failed because of permission issue. After changing the key’s permissions to 600, I tried to log in again.

When I tried again, I discovered that the private key was protected with a passphrase.

To crack the passphrase, I first converted the private key to a hash format using ssh2john, then using John the ripper to crack it.

The password cracking worked successfully, and I was able to log in as Kay using the cracking passphrase.

In Kay’s home directory, I found a file that appeared to be Kay’s password backup.

With that password, I checked Kay’s sudo permissions and discovered Kay could run all commands with sudo.

Using ‘sudo su’, I was able to escalate to root privileges and found the final flag.

Conclusion

This machine was more challenging than my first HTB machine, but it taught me many different ways to approach security challenge. I also learned something interesting: SSH keys can be protected with passphrase, but these can be cracked using John the ripper. This was new knowledge for me.