CC: Pen Testing - THM Walkthrough

 

Welcome back one and all! I hope you have had a great weekend full of malware, ducky scripts and reverse shells. Today we are going to be looking at the CC: Pen Testing box from TryHackMe. This room is huge, and covers a whole range of Pentesting tools including:

• Nmap
• Netcat
• Gobuster
• Nikto
• Metasploit
• Meterpreter
• Hashcat
• John The Ripper
• Sqlmap
• Smbmap
• Smbclient
• Impacket

There are several questions relating to every tool listed, and the answers to almost all of these questions can be found using the tools 'man' or '--help' pages, so I won't go into all the answers for these. I am instead going to concentrate on the "Final Exam", which is a CTF at the end of the room, combining all your freshly absorbed hacking knowledge. So without further ado, get yourself comfy and caffeinated and lets go!

As always, we start with an nmap scan. We need to know what we are dealing with here. No firewalls or pesky admins checking logs to deal with, so we can go full aggressive and also scan all ports with a full TCP connect, be as loud as you want since nobody is looking!

SSH running on the standard port 22, and an Apache webserver running on port 80. No usernames to try and brute SSH so we can start with the webserver. Set gobuster running and let it do it's thing whilst we have a gander at the webpage.

Webpage is just a boring Apache2 Default page with nothing interesting hidden in the source code. Nothing more to do or say about that. Looking at the Gobuster results though, we do seem to have a hidden directory:

When will people learn that just calling something "secret" doesn't actually make it secret...

Browsing to the secret directory we are hit with what looks like a dead end. Nothing, nill, nada. Not even an opening html tag in the source code, this is literally a blank page.

This directory wouldn't be here for no reason. Let's dig a little deeper by running another gobuster scan against the hidden directory, and also look for some standard file types (php, txt, html).

Bingo. /secret/secret.txt looks more like it. Lets have a little look shall we?

That's a username and a hashed password right there. Due to the lack of... well... anything, on the webserver side of things, my guess is that this is for SSH. We need to find out how the password has been hashed and then we can pass all the info to John The Ripper to give us the details we need. There are many ways to identify a hash, personally I like to use hashes.com for fast results.

Passing the hash and format to john cracks the password almost instantly. Not even time for a brew break unfortunately!

Ok, so we have a username, and we have a password. What are you waiting for? Get yourself logged in and grab that user flag!

You know what's coming next. We want the power. We want root! I like to start with enumerating sudo, this is often the quickest and easiest way to privilege escalation.

We can run su with sudo. We might as well be root already. No need for GTFOBins for an explanation, you know what to do. Grab that root flag, and close your box. Log off your computer and go hide, the CIA are now onto you as one of the greatest hackers that has ever lived!

Massive thanks to Paradox for this room. Not just for the bit we have covered, but the rest of the room was a wealth of information that is indispensable for anybody aspiring to become a penetration tester. And as always, a huge shout out to TryHackMe for what is probably the best learning platform on the WWW. 

Take care everyone, and happy hacking!