In this video, we are going to solve the simple challenge from Tryhackme.
The challenge is very good to learn practical pen testing for beginners.
So on try hack me open simple city of Rome and start your machine.
Once you get the IP address, copy it.
And move to your Kali machine.
Looping your machine.
And we do have the connectivity.
Now let's just scan the target with Nmap.
This s is for stealth scan.
S is for version enumeration and dash o is for OS enumeration.
So we have three ports open on the target for 2180 and port data to.
So try hack me.
The first question is how many services are running under port?
1000, Which are two.
The second question is the service running on higher port, which is ssh.
Now we need to find the vulnerability on the target.
Let's repeat the Nmap scan with the script.
Just use the parameters.
Dash Dash script.
Well.
Repeat the scan.
Now open your web browser and browse to the website.
And we can see that there is default Apache page.
Let's try to visit the reports file.
There is nothing important here.
Now let's try to brute force the directories and files with puff.
Let's use the command as shown on the screen.
We are using cycles to boot for the directories.
So F has found one additional page called Simple.
Let's just visit it.
So it is made on CMS made simple.
And if you check the version, which is 2.2.8.
Let's just search for the vulnerabilities in CMS made simple its exploit.
So there are a number of vulnerabilities.
But we are particularly interested in SQL injection vulnerability that is applicable on versions or
less than 2.2. ten.
Sir.
Nmap scan is also back and there are a number of exploits and vulnerabilities in the target.
Let's just leave these vulnerabilities for another day.
Now let's just download the SQL injection exploit with such exploit.
So our exploit has been downloaded.
Now let's just open it.
Well, you can see the number as well.
To copy the number and paste it into Hackney.
Now we need to exploit this vulnerability.
He tried to run it.
And we have some libraries missing.
And the script is also written in Python two.
On GitHub.
I found Python three script for the same vulnerability.
Just copy the code from there.
Open a new file and paste the code.
No.
Make it executable.
Is on the script.
So the exploit requires a URL and the word list as parameter.
Just provide the.
And use the John list as a word list.
And press enter.
Now it will try to brute force the password.
So the exploit has found a username which is Mitch and password as well, which is secret.
Now let's log in with SSH.
And we get a shell.
So let's answer the question on Tryhackme.
What's the password?
We have already found the password, which is secret.
So where can you log in with details obtained?
We use SSH to log in.
No, let's just get out the user flag on the target machine.
The cat command.
And paste the flag on.
Try hack me.
Now let's check other users that are available on the machine.
We move to the home directory?
And we see that there is another user with the name of Sunbath on the Machine.
Just answer the question on Tryhackme.
Now let's try to escalate our privileges.
Please use the command sudo dash l to list or sudo privileges and you can see that we can run vim as
sudo.
So we can use them to escalate our privileges.
So let's just check the GTFO bins.
How we can escalate privileges with vim.
Search for vim.
So it provides different methods to escalate our privileges.
Let's copy the first line.
And it on a target machine.
And you are automatically escalated to root.
Now, let's just.
Go to the root directory and get out the root flag.
You copy the flag and paste it on Tryhackme.
And we have successfully completed the simple from Tryhackme.