“Brute It” Write-up

Hi, today’s write-up will cover an easy room on Tryhackme called “Brute It”, without further ado, let’s jump in:

“Brute It” room

Task1: Reconnaissance

Q1: How many ports are open?

sudo nmap -sS -A -p- -Pn -oN BruteIt MACHINE_IP

Nmap scan for the “Brute It” room

→ We have 2 open ports: ssh (22) and http (80).

Q2: What version of SSH is running?

→ The flag -A used in the nmap command makes nmap do OS and services detection, so the version of ssh is : OpenSSH 7.6p1.

Q3: What version of Apache is running?

→ The version of Apache is : 2.4.29.

Q4: Which Linux distribution is running?

→ The Linux distribution that is running is Ubuntu.

Q5: What is the hidden directory?

Gobuster scan

→ The hidden directory is : http://MACHINE_IP/admin

Task2: Getting a shell

Q6: What is the user:password of the admin panel?

Source code

→ When we read the source code of the page http://MACHINE_IP/admin, there is a username called “admin”.

→ There is no useful information about how we can retrieve or use a particular password, neither in nmap nor in source code, so the only solution that remains is to brute force using a tool like hydra.

→ Since it is a web form, we need to know how we can construct the http request and we need to know which http method is used, so let’s use Burp to have an idea:

Http request intercepted using Burp

→ It looks like we need to make a POST request that requires only a password and a username:

hydra -l admin -P PATH_TO_THE_WORDLIST MACHINE_IP http-post-form "/admin/index.php:username=^USER^&password=^PASS^:F=Username or password invalid" -V

Hydra result for the “admin” user

→ F=Username or password invalid:It specifies the response message when the username or password is invalid.

→ The answer is : admin:Password_found

Q7: What is John’s RSA Private Key passphrase?

→ Using the credentials found in the previous question, let’s connect to the admin account in this website:

admin panel

→ First, we can see that there is a user called “john”, maybe this is a hint to use John the ripper to get the passphrase :)

→ We click on the RSA private key to display the SSH private key:

private key

→ We can see the Web flag.

→ Before continuing, let’s explain the difference between SSH private key and the passphrase:

• Private Key: A private key is a cryptographic key used in SSH for authentication. It is a file that is securely stored on the client-side (your computer or device). The private key is kept secret and should never be shared with anyone else.
• Passphrase: A passphrase is an additional layer of protection for the private key. It is a string of characters, similar to a password, that is used to encrypt the private key. When the private key is encrypted with a passphrase, it becomes more secure because even if someone gains unauthorized access to the key file, they cannot use it without knowing the passphrase.

→ I copied the private key and stored it in a file named “PrivateKeyBruteIt” so I can use the “ssh2john” tool, this tool will retrieve a special information from the RSA private key (this special information is the passphrase but it’s not in clear text, it is just a hash that we still need to crack using jTr).

ssh2john PrivateKey > passphrase.txt

john --wordlist=PATH_TO_THE_WORDLIST passphrase.txt

→ There is no need to specify any format for john command since the passphrase.txt is already in a format that john can understand.

the passphrase in plaintext

Q8: user.txt

→ We have ssh port open, the username “john”, his SSH private key and the passphrase, let’s login to this account:

ssh -i PATH_TO_THE_PRIVATE_KEY john@MACHINE_IP
> passphrase

user.txt

Q9: Web flag

→ Already displayed when we log to the admin panel.

Task3: Privilege Escalation

Q10: What is the root’s password?

→ We run the “sudo -l” command to know if john have some elevated rights.

John’s privileges on the machine

→ The user “john” have a particular privilege, he can use the command “cat” as root without the need to provide any password.

→ We know that passwords in Linux host are stored in /etc/shadow. Since john can read this file, let’s go and grab the root password.

root password hashed

→ the $6$ means that the password is hashed using sha512 algorithm.

→ There is a special tool in the tools Suite used for John The Ripper called “unshadow”, to use this tool, we need 2 important information; the root entry in the “/etc/passwd” file and the root entry in the “/etc/shadow” file.

root entry in the /etc/passwd file

→ I stored this line in a file named “passwdfile.txt”

root entry in the /etc/shadow

→ I stored this line in another file named “shadowfile.txt” and run the following command:

unshadow passwdfile.txt shadowfile.txt > forJohn.txt

→ The previous command will retrieve the hashed password of the “root” user (and redirected in a file named “forJohn.txt”) in a format that John The Ripper will understand and crack:

john --wordlist=PATH_TO_THE_WORDLIST forJohn.txt

Passworrd cracked for the “root” user

→ There is another alternative if you don’t feel comfortable doing all these steps with John The Ripper. You can crack the password directly using Hashcat:

hashcat -m 1800 hash.txt PATH_TO_THE_WORDLIST

→ The “hash.txt” contains only the hashed password of the “root” user and not the entire line, i.e:

$6$zdk0.jUm$Vya24cGzM1duJkwM5b17Q205xDJ47LOAg/OpZvJ1gKbLF8PJBdKJA4a6M.JYPUTAaWu4infDjI88U9yUXEVgL.

Password cracked of the “root” user using Hashcat

Q11: root.txt

→ Although we have now the root’s password, I didn’t login to his account via SSH, john already can run the command “cat” with the user “root” privileges, so I just cat the root.txt file in the “/root” directory:

root.txt

→ I didn’t login to the “root” account because I had already an idea about where the root.txt can be found (typical directory used in CTFs) but in case we have no idea about the location of the root.txt in the filesystem, then we have to login to the root user account :)

This is the end of this write-up, thank you and happy learning :) :)