2026-09-08

TryHackMe — Basic Pentesting

lab/thmwalkthroughEnumerationnmapauthentication

Discovered open port 445/tcp on 10.10.1.205 Discovered open port 22/tcp on 10.10.1.205 Discovered open port 139/tcp on 10.10.1.205 Discovered open port 80/tcp on 10.10.1.205 Discovered open port 8080/tcp on 10.10.1.205 Discovered open port 8009/tcp on 10.10.1.205

Feroxbuster

/development is available

/development has two text files

>j.txt

code

   For J:

I've been auditing the contents of /etc/shadow to make sure we don't have any weak credentials,
and I was able to crack your hash really easily. You know our password policy, so please follow
it? Change that password ASAP.
-K

>dev.txt

code


2018-04-23: I've been messing with that struts stuff, and it's pretty cool! I think it might be neat
to host that on this server too. Haven't made any real web apps yet, but I have tried that example
you get to show off how it works (and it's the REST version of the example!). Oh, and right now I'm
using version 2.5.12, because other versions were giving me trouble. -K

2018-04-22: SMB has been configured. -K

2018-04-21: I got Apache set up. Will put in our content later. -J

running command smbclient -L $IP it returned

code

        Sharename       Type      Comment
        ---------       ----      -------
        Anonymous       Disk
        IPC$            IPC       IPC Service (Samba Server 4.3.11-Ubuntu)

smbclient //$IP/Anonymous this command was used to access the share as anonymous and using more on staff.txt we got the names Kay and Jan

code

Announcement to staff:

PLEASE do not upload non-work-related items to this share. I know it's all in fun, but
this is how mistakes happen. (This means you too, Jan!)

-Kay

As user Jan i could look at the private key of user Kay. I copied Kay's key into my attacker machine and pasted it in id_rsa and tried to ssh using the key like ssh -i .ssh/id_rsa kay@$IP but it was encrypted so i had to use john the ripper

John

I used ssh2john id_rsa > id_rsa.hash to change the id_rsa to a file john could understand and then used john id_rsa.hash -wordlist=/usr/share/dict/rockyou.txt to crack the password for Kay

After gaining access to Kay user, there was a pass.bak file that had the password for root.

Basic Pentesting recall3 blanks

The anonymous SMB share leaks naming Kay and Jan. Jan can read Kay's private key, which is cracked with ssh2john and against rockyou.txt, and a file called holds the root password.

try it before revealing

Feroxbuster

John

Read next