Ashraful Alim's Blog
TryHackMe: CC Pentesting | Walkthrough

TryHackMe: CC Pentesting | Walkthrough

Ashraful Alim's photo
Ashraful Alim
·

4 min read

Table of contents

Welcome.

CC Pentesting room from TryHackMe is a kind of crash course because it covers various topics related to pentesting. Though it is a very long room, I have included all the solutions here.

There are 7 sections for this room.

  1. Section 1: Network enumeration
  2. Section 2: Web enumeration
  3. Section 3: System Hacking
  4. Section 4: Hash cracking
  5. Section 5: Web Hacking (SQLi)
  6. Section 6: more Network enumeration
  7. Section 7: Final Challenge

Below I am going to describe each section separately.

Section 1

Network Enumeration tools:

  • For Network Enumeration, nmap is a very effective tool
  • To answer the question in this Task, nmap cheat sheet is enough: Link

Task 2 Solution

  • Netcat is called — Swiss army knife. Because it can do so many things for network enumeration and hacking
  • To answer questions about netcat, this cheat sheet is handy.

Task 3 Solution

Section 2

Web Enumeration:

  • For web enumeration, especially brute force, gobuster is a useful tool
  • To answer a basic question about gobuster cheat sheet is useful: Link
  • Command: *gobuster dir -u* [*http://[IP]*](http://[IP]) *-w [wordlist] -t 64 -x xxa*
  • Wordlist for this challange: /usr/share/wordlists/dirb/common.txt

Task 4 Solution

  • Nikto is a web scanner tool with various functionality
  • Basic usage of this tools can be found in this wiki
  • Another useful cheat sheet: Link
  • Command to list plugin: nikto --list-plugins

Nikto plugin for Apache

Task 5 Solution

Section 3

System Hacking:

  • Metasploit is a multipurpose tool for hacking
  • Sans cheat sheet describes well the options for metasploit: Link

“advanced” options shows more info in Metasploit

Task 7 Solution

  • To select any module, we can use either the serial number (here 0) or the full pathname of that module
  • Using basic commands from the cheat sheet, we can select and use any module. Picture below:

Using EternalBlue

Task 8 Solution

Task 9 Solution

  • Final Walk through of this section (picture below)

Metasploit target options setting

exploiting the target and searching information

Section 4

hash cracking online

Task 13 Solution

  • John the ripper is another great tool for cracking. Here is the cheat sheet.
  • To crack, save the hash in a file first
  • Command:john --show --format=[type] [hash file]

Task 14 Solution

Section 5

  • sqlmap is an automated SQL injection detection and exploitation tool
  • Useful cheatsheet: Link here

Task 16 Solution

  • sqlmap will auto detect and exploit the challenge site.
  • Command: sqlmap -u [http://[IP]](http://[IP]) --forms --dumps
  • Simply Answering Yes/No will auto exploit and show database

SQL database dumped auto

Task 18 Solution

Section 6

  • smbmap is a great tool for smb enumeration.
  • Official documentation is enough to answer basic question. Link here

Task 20 Solution

  • Help menu for smbmap and smbclient shows enough basic info to run the tools
  • Command: smbclient -h

Task 21 Solution

Section 7

This is a CTF challange. Below I am describing the process to solve it.

Enumeration:

Target IP shows Default Apache website. As there is web, so web enumeration (directory brute force) is needed.

Command: gobuster dir -u [http://[IP]](http://[IP]) -w [wordlist] -t 64

  • I have used medium size directory list. It took some time to finish
  • Scan only showed /secret directory. But the page is blank
  • I need to scan this /secret directory again because there is no other directory/ info available.
  • Brute forcing again shows /secret/secret.txt And it reveals a hash

Final challange hash

Exploitation:

  • Online hash cracker shows the hash value is: nyan
  • SSH attempt is succeful with this username and password. So I have initial access

SSH connection

  • Simple listing shows the user flag

user.txt

  • If I list the sudo access (sudo -l) it says that — nyan can run /bin/su without any password
  • With this sudo access, I can list root directory and read the root flag

root flag

If you find the write up useful, please share — Sharing is Caring ❤

SecurityTutorial