Returning to the roots
Tags: cybersecurity, learning, testing
Published: 2023-11-20 06:40:28

## Basic Pentesting
It has been a minute since my first CTF, [Mr Robot](https://github.com/dmnuggins/CTF-Writeups/tree/main/Mr-Robot), so I wanted to ease back into it with TryHackMe's [Basic Pentesting CTF](https://tryhackme.com/room/basicpentestingjt).

The goal of this VM is to remotely attack the VM and gain elevated privileges and we will track our progress by answering the questions from TryHackMe.

## Configuration

I'll be using a [Kali Linux VM](https://www.kali.org/) attack the VM in this CTF through the [OpenVPN](https://tryhackme.com/room/openvpn) connection configured to connect our Kali machine to TryHackMe.

Let's start hacking!

---

After configuring our connection and deploying our machine, well need to...

**Find the services exposed by the machine**: This is the initial reconnaissance to see what we can get started with. Using `nmap`, we'll check for any open ports or services. Let's run the following command: `nmap <MACHINE IP>`

![nmap](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/j18lzkh165vpguk4k6e1.png)

Looks like there are a number of services running, but the ones we should keep an eye out for are `ssh`, `http`, `netbios-ssn`, and `microsoft-ds`.

**What is the name of the hidden directory on the web server(enter name without /)?** There are a few tools we can use to find the hidden directory (gobuster, ffuf, dirb). In this box, I decided to use [ffuf](https://www.kali.org/tools/ffuf/) and run the following command: `ffuf -w /usr/share/wordlists/dirb/common.txt -u http://<MACHINE IP>/FUZZ -c`

There are a plethora of wordlists, but I am using `common.txt` because it contains names of common URL directories/paths and fits our needs at the moment. Note, that regardless of the tool, using the right wordlist is key to a quick enumeration.

![ffuf](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/b2y5dthjlg8wy0u3stjd.png)

We see there is a hidden directory: `/development`. When we open the directory in our browser, we see 2 files:

![wa-index](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/9un5kic0kv2d401uuhxz.png)

The `dev.txt` appear to be message logs between "K" and "J". It's noted that Apache is being used and SMB has been configured. A possible vector here, but let's evaluate the other file before we jump in.

![text-log](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/5s60h6lbg1y2sc8yxo3g.png)

The `j.txt` appears to be memo from "K", warning "J" that their hash was very easy to crack. With that in mind, if we find "J's" full username, we can probably crack their password without too much resistance.

![memo](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ym02wvday34lpboaw06p.png)

**User brute-forcing to find the username & password**. Remember earlier how we noted SMB was configured? We have just the tool that interacts with the SMB protocol, [enum4linux](https://www.kali.org/tools/enum4linux/). It will be used to enumerate any potential users on the target system. Let's run the following command: `enum4linux -a 10.10.169.3 | tee enum4linux.log`

![enum4linux-command](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/vmqzj2oqlpy6nxvafb1t.png)

**What is the username?** We can correlate the results of the enumeration to conlude that `jan` is the username.

![enum4linux-result](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/we8tcfqximp7hpgsicnz.png)

Referencing back to our previous clue that "J" has weak credentials, we'll use their username to brute force a password.

**What is the password?** We'll use `hydra` to brute force the password by running the following command:  `hydra -l jan -P Desktop/wordlists/rockyou.txt ssh://<MACHINE_IP> -I`

![hydra](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/1zth6ho3ykvx4j1d1g5x.png)

After the hydra completes it execution, we our credentials:
- username: `jan` 
- password: `armando`

**What service do you use to access the server?** We'll be using SSH to login with jan's credentials: `ssh jan@<MACHINE_IP>`

![ssh-jan](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/11527y7omv86xlzbeh3e.png)

After logging in, we kind of poke around a bit. We see that shadow folder referenced in the chat logs...

![directory](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ba7rxesihq759xf254th.png)

Testing if we can use sudo to run any commands with elevated privileges...

![sudo-test](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/7a269h1p65rj05w72fxi.png)

...doesn't look like it...

![more-directory](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/uffq1oklykd0ewzq6dtp.png)

Let’s check back to our other user `kay` to see if we can find anything in their `home` directory...

![even-more-directory](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/jee422k0avfynao5yzr9.png)

Oh? We see a `pass.bak` file that look s like a potential lead, but permissions only allow `kay` read and write access. Will need to get `kay` credentials and ssh as `kay` in order to access that file.

**Enumerate the machine to find any vectors for privilege escalation**:<a name="linpeas"></a> A way we can automate this process is by running [LinPEAS](https://github.com/carlospolop/PEASS-ng/tree/master/linPEAS) (Linux Privilege Escalation Awesome Script). LinPEAS will search for possible paths to escalate privileges on the host machine.

Next step is to install LinPEAS onto our local attack machine and then upload it to our target machine using SCP with the following command: `scp /path/to/linpeas/linpeas.sh jan@<MACHINE_IP>:/specific/path/on/machine`

![linpeas](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/nupbwpsm0777p12ffw0j.png)

Let's verify that the file has been transferred and ensure the executable bit is enabled.

![scp-check](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/rer8mlpcg58m39btob1a.png)

Now we run LinPEAS with this command: `./linpeas.sh | tee linlog.txt`

![run-linpeas](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/dy41sf6rw6ij2rsu91tk.png)

After LinPEAS is was done executing, and with a look through the potential vector ouput, we find that we have a private key file that appears to be in the kay user directory, which we could use to login as kay!

![yay-linpeas](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/73jw9lgt6luuesu7b6hf.png)

```bash
══╣ Possible private SSH keys were found!
/home/kay/.ssh/id_rsa
```
There appears to be a possible vector with a private SSH key found in the `/home/kay/.ssh` directory. Let's try navigating to the directory...

![navigate-kay-home](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/shvymyb60lcpkd7agta7.png)

Navigation successful, and from the listed permissions, we should be able to read the private key!

![kay-permissions](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/hic0qn8h5jfm2r6zcy4u.png)

`cat` and extract the `id_rsa` private key

![id-rsa-extract](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/gijrqr61o6j3xd8686ac.png)

We'll save it to our local attack machine using `nano` → `kay_id_rsa` and setting `chmod 600` *(read only setting)*.

**What is the name of the other user you found?** From our earlier enumeration, we can confirm that `kay` is the other username.

**If you have found another user, what can you do with this information?** See if there are any privilege escalation vectors that might be associated with this other user, `kay`, which we achieved with LinPEAS in the [last section](#linpeas).

Now, let’s try logging into `kay`:

![ssh-kay](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/gxjp6axd6ehy6v8niete.png)

Unfortunately, the private key is passphrase protected, but that shouldn't be too much trouble for our good friend, JtR (John the Ripper). JtR is a password cracking tool which we will use to crack the passphrase for our private key. First we'll need to extract the hash values from the private key with `ssh2john`:

![ssh2john-kay_id_rsa](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/e6vhgkbs32txnz4rw17p.png)

This will allow us to pass the hash to John The Ripper to crack it using the wordlist `rockyou.txt`.

![john-wordlist](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/r67t6gfft0y8jiosnait.png)

And boom, we have our private key passphrase: `beeswax`. Let's try logging in as `kay` one more time:

![ssh-again](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/pm2ss9l2xqije8uhzu7s.png)

Let's see that what's in kay's home directory.

![final-password](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/8twf1sdp5sg6fiqd0h0u.png)

**What is the final password you obtain?** And after a quick `cat`, we have our final password:`heresareallystrongpasswordthatfollowsthepasswordpolicy$$`

---

## Conclusion

Overall, the Basic Pentesting CTF was not too difficult, but complex enough to where it tests my baseline knowledge of what tools to use in the appropriate scenario. Another CTF under the belt and more tools for the utility belt to crack the next one. Happy hacking!👾