Try Hack Me -Brute it-Walkthrough

This is the walkthrough of the easy box ‘Brute it’ from tryhackme.

NMAP

Scan First we use nmap scan to detect services and potential entry points. I used the command: “nmap -Pn -sV -sC (ip)”

After the completion of the scan we get the above results.

ENUMERATION

To perform directory search we use ‘dirsearch’ to discover hidden directories and files. I used the command: ‘dirsearch -u (ip)’

After the completion of the directory search we uncovered a hidden directory named /admin . When navigating to

**http://10.10.21.108/admin **we get a login page

Looking at the page source we got a comment line which is for user John that the username is admin.

We can use the famous password crack tool ‘Hydra’ to get the password with username admin. Command Used:

hydra -l admin -P /usr/share/wordlists/rockyou.txt.10.10.21.108 http-post-form”/admin/index.php:user=^USER^&pass=^PASS^:Username or password invalid”

We successfully cracked the login password. We got the username=admin and password=xavier

Now ,login using the username and password we got.

After successfully logging in,we obtain the web flag and RSA private flag.

Using command: wget http://10.10.21.108/admin/panel/id_rsa we can get the RSA key in our local system.

ssh2john.py is used to convert the RSA key into text format. The command used is: python3 /usr/share/john/ssh2john.py id_rsa> rsa_hash.txt

Using the tool john the ripper we can perform brute force to crack the RSA key using the wordlist rockyou.txt

Command used: john –wordlist=/usr/share/wordlists/rockyou.txt rsa_hash.txt this will give the RSA private key passphrase.

We cracked the password! With the password for the id_rsa file, we can now log in via SSH as the user John.

‘Before that we have to give permissions to the file id_rsa’

Now we can use the command to login

Command used: ssh john@10.10.21.108 -i id_rsa

After login cat user.txt to get the user flag.

Privilege Escalation

Using sudo -l we can check user privileges. We found that user john can run command /bin/cat as root.

Now we can use sudo cat to get /etc/shadow, Because the cat command in Linux is used to display the contents of a file. With sudo rights, we can use cat with root privileges to access the /etc/shadow file

Once we obtain the password hash of the root user, we can store it in a text file and crack it using “John The Ripper.”

Create a file using “nano” command and save the file.

Crack the password using “John”.

After cracking the file using John, we get the password for root user.

Now we can use the password to become the root user by using the ‘su root’ command.

Cat the root.txt to get the root Flag.

Successfully completed the Room.

Thank You…………..