Feeling basic? Do the Basic Pentesting CTF on Try Hack Me!
Tags: tutorial, cybersecurity, ctf, thm
Published: 2022-06-04 07:20:26

Sometimes it's good to go back to the basics to reground ourselves in our root knowledge. That is why the [Basic Pentesting CTF](https://tryhackme.com/room/basicpentestingjt) is perfect for any beginner who wants to practice their new-found pentesting skills, especially in terms of brute forcing, hash cracking, service enumeration and Linux Enumeration.

Grab your most comfy butt pillow, a drink, and let's get hacking! 😎

---

## Task 1: Web App Testing and Privilege Escalation 
**<u>Deploy the machine and connect to the network </u>**
Get your machine up and running. You can access this via [OPENVPN](https://tryhackme.com/room/openvpn) (which I will be using) or via the built-in Attackbox.
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/0xzg1azfmepxs1d9aggf.png)

**<u>Find the services exposed by the machine</u>**
This is basic bare-miimum reconnaissance. To find the services exposed by the machine, we need to run a simple nmap scan using the following command: `nmap <your machine's IP Address>`. We can see that they are running the following services: ssh, netbios, and microsoft-ds.
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/52tn9cnjcjqu1zdvfgz9.png)
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/92c580qi25mxigg5xokw.png)
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/yrfd25he0ek017qszbhk.png)

**<u>What is the name of the hidden directory on the web server(enter name without /)?</u>** 
To find directories, or hidden directories of our web application we can use a tool called [gobuster](https://www.kali.org/tools/gobuster/). Open up your terminal and run the following command: `gobuster dir -w /usr/share/dirb/wordlists/common.txt -u http://<your machine IP> -o output.txt`. We use the common.txt file because it contains the names of common URL directories/paths.
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/icdp3i76b267u0mgiqnp.png)

We can see there is one hidden directory: `/development`. When we open it in our browser we can see it contains the uploaded files of our server. We will get into the file content later.
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/vk3332ruwunpnqiz6f8v.png)
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/n1rqc8ddq5sh1z8yrgnt.png)
  
**<u>User brute-forcing to find the username & password</u>** 
Okay, now the fun part begins. Before we open up any tools, let's first have a look at those text files in our /development directory.

Our `dev.txt` file contains a message thread where a used -K mentions that they are using Apache Struts version 2.5.12, and that they have configured SMB. This is useful because we could find exploits for the Apache Struts application, as well as log into SMB via smbclient.
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/mo9dvkekmvpmk4nr47gt.png)

Our `j.txt` file contains a message from user K to user J warning them of using weak credentials. This means if we find user J's fullname, we can brute force their "weak" password! 😁
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/i7du0aofcfqokl6meuby.png)

---

If you were interested in following this route, you could download the exploit for Apache Struts and manipulate the services that way. I just wanted to show you that there are exploits for this.
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ir1mw6zsdet38q1j57dd.png)

---

Okay, if we have a quick [Google](https://bestestredteam.com/2019/03/15/using-smbclient-to-enumerate-shares/), we can see that we can log into smbclient using an anonymous connection. Let's try this by opening our terminal and running the following command: `smbclient //<your machines IP>/anonymous`. When prompted to enter a password, just press enter.
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/yt7ag2ns4bsu4kend5s2.png)

Once logged in, let's list the files saved on our smbclient. There is an interesting file named `staff.txt`.
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/77g792rkbqqbcbzqg8w9.png)

When we read the content of this file, we can identify two users: Jan and Kay. We know that Jan (J) had weak credentials, so we will be using her username to brute force a password.
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/jwckswjysxkpll9508vl.png)

Let's brute force Jan's password by making use of the hydra tool. Enter the command `hydra -t 4 -l jan -P /usr/share/wordlists/rockyou.txt ssh://<your machine IP>` so that we can bruteforce the password needed to log into Jan's ssh system.
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/bg3ytbqx3zvszn7f7u26.png)

This will take a while, but at the end you will be given Jan's password! We can now use this to answer the next three questions.
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/pfo63amcla9tq1d18hol.png)
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/wn4onxefjicvrhxtl9an.png)

   
**<u>What is the username?</u>**  
Check above for the steps we took to find this solution.
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ym31xgn8w7ioihvcj3xb.png)

**<u>What is the password? </u>**
Check above for the steps we took to find this solution.
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ggruvgc9m5u3q16knqx6.png)

**<u> What service do you use to access the server(answer in abbreviation in all caps)? </u>**
Check above for the steps we took to find this solution.
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/3nahxpb6asascxs5zrt2.png)

**<u>Enumerate the machine to find any vectors for privilege escalation.</u>**
Let's start by using ssh to log into Jan's system. Open up your terminal and run the command `ssh jan@<your machine IP>`, remember to use the password `armando`.
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/b1623h551kst9rmfvmyx.png)

If we cd into /home and we list the directories, we can see that there are two directories: jan and kay. We can access most of jan's content, but for kay's content we need root access.
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/k7xa6ovx1pxdu9aarhmx.png)

Kay does have a file that is of interest to us: `pass.bak`, but we need root access to view it.
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/tpqtzuvi6azro5mwsfqn.png)
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/zueoasqsz9klzjus9m8m.png)
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/29f1989bsasgu7pr0r89.png)
 
Let's see if we can find Kay's ssh credentials. There is a directory named `.ssh`, so let's cd into it and view the contents. It contains a `id_rsa` file, which we can use to get a temporary passkey.
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/yur9knx2g7yi6f2l53q8.png)

Create a file on your Desktop called pass.txt (or anything you want. Copy the entire RSA Private Key into this file and save it.
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/px4rr14ex64z4zmo1onl.png)

Now, make sure you are in the directory where you saved this file because we are going to use python's  ssh2john.py tool to transform our RSA private key to john format for later cracking using John The Ripper. Enter the command `python /usr/share/john/ssh2john.py pass.txt > password.txt`.
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/w5ytiafn8dqteq6r97zi.png)

We can now use John The Ripper to crack our passcode. Enter the command `john --wordlist=/usr/share/wordlists/rockyou.txt password.txt` and wait for the magic to happen. We will get a returned passcode: `beeswax`.
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/xgo28woi1w380lvqe8f2.png)

Okay, we can finally use this passcode to log into Kay's ssh account. Go to the terminal where you are logged in as Jan. Make sure you are logged in as Jan or else this will not work. Enter the command s`sh -i /home/kay/ .ssh/id)rsa kay@<your machine IP>` and enter the passphrase `beeswax`.
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/sbqj8pgkwy8u9ebz8fkd.png)

Hoorah! We are now logged in as Kay. Now we can go ahead and cd into /home/kay, and we can read the content of the file named `pass.bak`.
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/mfm0dhz071ndsdlmce05.png)
 
We have successfully enumerated the machine to escalate our privilege! We can now answer the remaining questions. 😁

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/eewyywdqu1su6jqli31u.png)

**<u>What is the name of the other user you found(all lower case)? </u>**
Check above for the steps we took to find this solution.
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/6oavw0oa6bmx2be1qz8w.png)

**<u>If you have found another user, what can you do with this information?</u>**
We can use this data to access their account or escalate our privilege using their passcode. Check above for the steps we took to find this solution.

**<u>What is the final password you obtain?</u>**
Check above for the steps we took to find this solution.
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/nz28k9aw1r3m7m935ytt.png)
 
---

## Conclusion 
 
Congratulations! You have successfully completed the Basic Pentesting CTF. I hope this was easy enough to follow, and that you had fun along the way. See you next time. Happy hacking! 😊

Visit my [GitHub](https://github.com/christinec-dev/TryHackMe_Writeups) for more.