In this video, we are going to solve boot room from Tryhackme, which is focused on brute forcing with
John.
So open, bloated Rome and try hack me and join the room.
Now start your machine.
Go back on your machine.
Connect with openvpn of tryhackme with sudo openvpn command.
And you can check your connectivity with ifconfig and we get a new interface.
Name of Tunnel zero.
Where's your machine?
Distorted.
Copy the IP address of the target machine.
And bring it.
Now let's just scan the target with Nmap.
Use the command as shown on the screen.
S is for stealth scan.
SV is for version enumeration and O is for OS enumeration.
And we get only one port.
I think we need to slow down the scan.
Repeat the scan but slow it down by replacing T5 with T3.
Then we get another port on the machine, which is port 80.
Don't try me.
The first question is how many ports are open?
Which are two?
The next question is the version of SSH that is running.
You can copy the version from Kali Machine and paste it on Tryhackme.
The next question is for Apache version.
Just copy it from the scan.
And the third question is which Linux distribution is running, which is Ubuntu?
Now we need to find the hidden directory on web server.
So open a new tab.
And fire up as shown on the screen.
And we are using circles to brute force the directories.
While it is running this browse to the website.
Now the home page.
There is only.
Apache2 default page.
So F has found additional directory called admin.
Just browse the admin page.
And first of all.
Respect your source code.
But we do find a username which is admin.
Let's just try some simple SQL injection.
And we did not get anything.
So the hidden directory is admin and answer the question on try hack me.
So we have got the admin panel.
Now we need to brute force the password.
First of all, right, click on the page and open the inspect tab.
Now go to the networks tab.
Then initiate a login request.
Now click on the request method.
And you will get the request parameters.
We need these parameters to use in Hydra.
Now open the hydra and use the command as shown on the screen.
The V is for verbosity.
Dash I is to ignore any errors.
And dash four is for four threads.
And in a few minutes, the hydra will brute force our password.
Which is Xavier.
The login on the admin panel with the username and password and you get an RSA private key and a flag.
No.
Answer the questions on Tryhackme.
You know the admin username and password.
We also have the flag from web.
Who paste it in the question about the web flag.
The open the downloaded key, and you will see that it's encrypted.
Now we can crack the key with John.
This.
Copy this key in a new file.
Now, you would say to John to convert the key in John acceptable format.
So we have got the hash dot txt file.
Now, let's just use John to crack it.
Use the command as shown on the screen.
And use the default word list of John.
I think it has failed.
Use the show flag to view the crack passwords.
Like we do not have any crack password.
Let's just change the word list now.
Use Rockyou dot text to crack it.
And we do get the password, which is rock and roll.
Just base it on.
Try hack me.
Now let's just connect to our target machine with SSH.
First copy the key file in another file.
And make it executable.
Now you would ask to connect to machine.
I think the username is admin.
Just provide the key file and the username and try connecting.
Read our passphrase is wrong.
We need to guess the username.
So the username may be John, which is indicated on the web panel.
To change the username and try connecting again.
And we get the terminal.
The scared out the user flag.
And paste it on Tryhackme.
Just escalate our privileges.
Use the command sudo l.
And we can see that we can run command sudo.
Let's just check gtfo beans how we can escalate our privileges.
So it says if we can read data from file, it may be used to do privileges, reads or disclose files
outside a restricted file system.
So what we can do, we can read the password and the shadow file and try cracking it.
Get out the password file.
Copy the content in a new file.
And save it.
Look at out the shadow file.
Open a new file and save its contents.
To use the command and shadow password and shadow file and save the hash in a new file.
I'm using John to crack it.
And it has successfully cracked the password, which is football.
No switch to root with command.
And get out the flag from root directory.
So we have successfully completed routed roam from tryhackme.