Basic Pentesting

6

Open Ports

2

Users Found

4

Findings

10

Attack Steps

6

Tools Used

9

MITRE Techs

01

// Overview

EXECUTIVE SUMMARY

This report documents the complete attack path taken against the TryHackMe Basic Pentesting machine — a Linux target demonstrating how a chain of misconfigurations and information disclosures leads to full system compromise.

"The engagement began with a simple Nmap scan and ended with reading a plaintext password file — every step enabled by the previous misconfiguration."

// Attack Summary

SMB enumeration via enum4linux exposed anonymous share access, from which staff.txt was retrieved containing username jan. SSH brute-force granted initial access. Post-exploitation revealed user kay with a world-readable SSH private key. John the Ripper cracked the passphrase (beeswax), lateral movement as kay followed, and the final password was read from pass.bak.

This engagement demonstrates a classic chain: information disclosure → credential access → lateral movement — entirely enabled by misconfigured services and poor secrets management.

02

// Kill Chain

ATTACK PATH

Step 01

Reconnaissance

Nmap scan revealed 6 open ports: SSH, HTTP, SMB (×2), AJP13, Tomcat.

Step 02

SMB Enumeration

enum4linux confirmed anonymous sessions, workgroup info, and share listing.

Step 03

Anonymous Share Access

smbclient connected to the Anonymous share without any credentials.

Step 04

User Discovery

Downloaded staff.txt revealed a valid system username: jan.

Step 05

SSH Access as Jan

Brute-forced SSH credentials for jan; authenticated to the system.

Step 06

Local Enumeration

System commands discovered a second user: kay.

Step 07

Private Key Discovery

Kay's home directory contained a readable SSH private key.

Step 08

Passphrase Cracking

ssh2john + JtR with RockYou cracked the passphrase: beeswax.

Step 09

Access as Kay

SSH login using the cracked key and passphrase.

Step 10

Final Password Retrieval

cat pass.bak — final password in cleartext.

Visual Attack Flow

// ATTACK CHAIN DIAGRAM

🔍 Nmap Scan

↓

⚙️ SMB Enumeration — enum4linux

↓

📂 Anonymous Share Access

↓

📄 staff.txt Downloaded

↓

👤 Username Discovered → jan

↓

🔐 SSH Brute-Force → SSH Access

↓

🏠 Home Directory Enumeration

↓

🗝️ Private Key Exfiltrated (kay_id_rsa)

↓

⚡ John the Ripper → beeswax

↓

🔑 SSH as kay (key auth)

↓

🏆 cat pass.bak → Final Password

03

// Phase 1

RECONNAISSANCE

Every engagement begins with reconnaissance. We use Nmap's aggressive scan to enumerate open ports, services, versions, and run default scripts in one pass.

// Command

bash

nmap -A TARGET_IP

# -A : aggressive — OS detection + version + scripts + traceroute

// Discovered Ports

Port	Service	Purpose	Impact	Notes
22/tcp	SSH	Encrypted remote shell	Medium	Brute-force target; key auth possible
80/tcp	HTTP	Web server (Apache)	Medium	Directory busting; hidden paths
139/tcp	NetBIOS-SSN	SMB over NetBIOS	High	Anonymous session testing
445/tcp	SMB	File sharing over TCP	High	Primary SMB attack vector
8009/tcp	AJP13	Apache JServ Protocol	High	Potential Ghostcat CVE-2020-1938
8080/tcp	HTTP-Alt	Apache Tomcat	Medium	Check default creds; manager interface

Service Explanations ▾

SSH (Port 22)

Secure Shell provides encrypted remote access. Despite strong encryption, weak passwords or exposed private keys make SSH a prime attack vector. Every discovered username warrants a brute-force or key-auth attempt.

SMB (Ports 139 & 445)

Server Message Block handles file and printer sharing. Historically responsible for EternalBlue/WannaCry. Misconfigured anonymous access leaks users, shares, and sensitive files without any credentials.

AJP13 (Port 8009)

Apache JServ Protocol connects a front-end web server to Tomcat. Associated with the Ghostcat vulnerability (CVE-2020-1938) — unauthenticated file read and potentially RCE. Seeing this port is a high-value signal.

Apache Tomcat (Port 8080)

Java application server. The /manager/html interface is targeted for default credentials. Successful access typically leads to WAR file upload and remote code execution.

04

// Phase 2

SMB ENUMERATION

With SMB ports identified, we run enum4linux — a comprehensive Linux tool for extracting data from Windows and Samba hosts via SMB null sessions.

// Command

bash

enum4linux TARGET_IP

Critical Misconfiguration — Anonymous Sessions

The server accepts null session authentication. No username or password required to enumerate shares, users, and workgroup data. This is a severe misconfiguration that exposes the entire SMB attack surface.

// Listing Shares

bash

# List available shares — no credentials required
smbclient -L //TARGET_IP -N

# -L  list shares on the server
# -N  no password (null auth)

// Connecting to the Share

bash

# Connect to Anonymous share with no credentials
smbclient //TARGET_IP/Anonymous -N

05

// Phase 3

SHARE ENUMERATION

Inside the Anonymous share, we list contents and retrieve any files for offline analysis.

smb

smb: \> ls
  staff.txt    N    102

smb: \> get staff.txt
getting file \staff.txt of size 102 as staff.txt

Common Information Leaks in SMB Shares ▾

User lists / HR documents — staff names, usernames, email formats
Configuration files — database credentials, API keys, internal IPs
Scripts and automation — hardcoded passwords in batch/shell files
Backup files — .bak, .old, .sql files with credential dumps
SSH keys — private keys left in shared folders

06

// Phase 4

USER DISCOVERY

bash

cat staff.txt

Username Discovered

jan

Why Usernames Matter

Attack Type	Description	Why Username Is Critical
Password Brute-Force	Testing many passwords against an account	Without a valid username, both fields must be guessed
Credential Stuffing	Using leaked passwords from other breaches	Username anchors to known credential pairs
SSH Access Attempts	Authenticating via SSH with discovered user	SSH silently rejects invalid usernames
Internal Recon	Finding additional accounts or roles	Username patterns reveal org structure

07

// Phase 5

SSH ACCESS

With a confirmed username, we brute-force SSH credentials using Hydra against the RockYou wordlist, then log in.

bash

# Brute-force SSH with discovered username
hydra -l jan -P /usr/share/wordlists/rockyou.txt ssh://TARGET_IP

# Login with recovered credentials
ssh jan@TARGET_IP

SSH Protocol Overview ▾

SSH (RFC 4251) provides encrypted remote login via public-key cryptography. Two main auth methods: password auth (vulnerable to brute-force) and key-based auth (asymmetric keypair; private key must remain secret). SSH is ubiquitous on Linux servers — misconfigured or weakly protected instances are among the most common attack vectors.

08

// Phase 6

LOCAL ENUMERATION

Shell obtained as jan. Immediate post-exploitation enumeration establishes our position and reveals escalation paths.

bash

whoami        # current user
id            # UID, GID, group memberships
hostname      # machine name
pwd           # current directory
ls -la /home  # all user home directories

Second User Discovered

Listing /home reveals a second user account on the machine:

kay

09

// Phase 7

HOME DIRECTORY

bash

ls -la /home/kay
drwx------  2 kay  kay   4096  .ssh/
-rw-r--r--  1 kay  kay     64  pass.bak

File / Dir	Purpose	Security Relevance	Exploitation Value
.ssh/	SSH keys directory	May hold private keys + authorized_keys	Critical — key enables direct SSH login
pass.bak	Password backup file	Cleartext credential stored on disk	Critical — contains final password
.bash_history	Command history	May reveal past credentials or paths	High — historical leaks common

10

// Phase 7

PRIVATE KEY DISCOVERY

Critical Finding — Exposed SSH Private Key

Kay's SSH private key is readable by our current user (jan). We can exfiltrate this key and use it to authenticate as kay — with or without knowing her password.

An SSH private key is the secret half of an asymmetric keypair. Possession of it proves identity to any SSH server that trusts the corresponding public key. Private keys should only ever be readable by their owner (chmod 600). A world-readable or group-readable private key is an immediate account compromise.

// Exfiltrate & Fix Permissions

bash

# Read key contents on target, copy to local machine
cat /home/kay/.ssh/id_rsa

# On attack box — save as kay_id_rsa, then fix permissions
chmod 600 kay_id_rsa

# SSH enforces strict perms — 600 = owner read/write only
# Group or other read access causes "unprotected private key" error

11

// Phase 8

PASSPHRASE CRACKING

The key is passphrase-protected. We extract the hash with ssh2john and attack it offline with John the Ripper and the RockYou wordlist.

// Step 1 — Extract Hash

bash

ssh2john kay_id_rsa > hash.txt

# Parses the PEM/OpenSSH key format
# Extracts passphrase verification data into JtR-compatible hash

// Step 2 — Dictionary Attack

bash

john hash.txt --wordlist=/usr/share/wordlists/rockyou.txt

# John the Ripper tests ~14M real-world passwords from RockYou
# Dictionary attack — massively effective against human-chosen passphrases

John the Ripper — Deep Dive ▾

John the Ripper is an open-source password auditing tool supporting hundreds of hash types: MD5, SHA, bcrypt, NTLM, encrypted SSH keys, and more. A dictionary attack tests a list of probable passwords against the hash. The RockYou wordlist — 14 million real passwords from a 2009 breach — is the gold standard for CTF and pentest dictionary attacks because human users choose predictable passwords.

Passphrase Recovered

John the Ripper cracked the SSH key passphrase:

beeswax

12

// Phase 9

ACCESS AS KAY

bash

ssh -i kay_id_rsa kay@TARGET_IP
# Passphrase: beeswax

# SSH decrypts the key using the passphrase,
# performs challenge-response with the server,
# grants access if kay's public key is in authorized_keys

Why This Attack Succeeded

Anonymous SMB permitted — exposed internal files
Staff list stored in unauthenticated share — revealed username
SSH password auth enabled with a weak password
Home directory permissions allowed cross-user reads
Private key readable by other system users
Passphrase was in the RockYou wordlist

13

// Phase 10 — Objective Complete

FINAL PASSWORD

bash

cat pass.bak

Final Password — Objective Complete

Contents of pass.bak:

heresareallystrongpasswordthatfollowsthepasswordpolicy$$

Security Note

Despite apparent complexity (length + special characters), the password was stored in a cleartext backup file. Password policy compliance is worthless when credentials are stored insecurely. The policy protected against guessing — not filesystem exposure.

14

// Report

LESSONS LEARNED

// Finding 01

ANONYMOUS SMB ACCESS

The SMB service accepted null session authentication, allowing any network user to enumerate shares and retrieve files without credentials. This exposed the Anonymous share containing user data.

Info Disclosure Disable Anon Access

// Finding 02

SENSITIVE FILES IN SHARES

Staff usernames stored in an unauthenticated SMB share. Staff lists should never be placed in publicly accessible locations. Access controls and need-to-know principles were not enforced.

Credential Leakage Access Controls

// Finding 03

SSH PRIVATE KEY EXPOSED

Kay's SSH private key was readable by other authenticated users due to misconfigured file permissions. Private keys must be chmod 600 and never accessible to unprivileged accounts.

Account Compromise chmod 600

// Finding 04

WEAK KEY PASSPHRASE

The passphrase "beeswax" protecting Kay's SSH key appeared in the RockYou wordlist and was cracked in seconds. Key passphrases must resist offline dictionary attacks — use 16+ random characters.

Offline Cracking Strong Passphrase

15

// Framework

MITRE ATT&CK

Phase	Action	Technique	ID	Tactic
Reconnaissance	Nmap scan	Network Service Discovery	T1046	Discovery
SMB Enumeration	enum4linux / smbclient	SMB/Windows Admin Shares	T1021.002	Lateral Movement
Share Access	Anonymous share read	File & Directory Discovery	T1083	Discovery
SSH Login as jan	Password credential use	Valid Accounts	T1078	Initial Access
Local Enumeration	whoami / id / ls /home	System Owner/User Discovery	T1033	Discovery
Key Exfiltration	Read kay's private key	Unsecured Credentials — Private Keys	T1552.004	Credential Access
Passphrase Cracking	John the Ripper	Brute Force — Password Cracking	T1110.002	Credential Access
SSH Login as kay	Key-based authentication	Remote Services — SSH	T1021.004	Lateral Movement
Password Retrieval	cat pass.bak	Credentials in Files	T1552.001	Credential Access

16

// Arsenal

TOOLS USED

01. Nmap

Network Mapper — industry standard for port scanning, service version detection, OS fingerprinting and NSE script execution. The starting point of every engagement.

nmap -A TARGET_IP

02. Enum4Linux

Extracts users, shares, workgroup info, OS details and password policies from SMB hosts via null or authenticated sessions. Wrapper around smbclient, rpcclient, and nmblookup.

enum4linux TARGET_IP

03. SMBClient

Command-line SMB/CIFS client bundled with Samba. Functions like an FTP client for SMB shares — browse, list, upload, download. Used here for anonymous share access and file retrieval.

smbclient //IP/share -N

04. SSH / Hydra

OpenSSH client for encrypted remote login. Hydra provides parallel credential brute-force. Combined with a known username and the RockYou wordlist for targeted password attacks.

ssh -i key user@TARGET_IP

05. SSH2John

Part of the John the Ripper suite. Parses SSH private key files and extracts their passphrase verification data into a hash format John can attack. The essential bridge between key exfiltration and cracking.

ssh2john key.rsa > hash.txt

06. John the Ripper

Open-source password auditing tool supporting hundreds of hash types. Used with the RockYou wordlist (14M real passwords from the 2009 breach) in a dictionary attack against the SSH key passphrase hash.

john hash.txt --wordlist=rockyou.txt

17

// Final Notes

CONCLUSION

"A single misconfiguration is rarely catastrophic. A chain of them — each enabled by the last — leads to full compromise."

// Core Lesson

The TryHackMe Basic Pentesting machine is a near-perfect illustration of cascading misconfiguration. The attack began with anonymous SMB access — a convenience setting — and ended with reading a cleartext password file. Every step was made possible by the step before it.

Anonymous SMB → staff list → valid username → SSH brute-force → local recon → exposed private key → weak passphrase → lateral movement → cleartext backup. Nine failures, each individually fixable, collectively devastating.

The remediation is equally instructive: disable anonymous SMB, restrict shared file access, enforce chmod 600 on private keys, require strong unique passphrases, and never store credentials in plaintext files. None of these are exotic controls — they are baseline hygiene that any hardened system enforces.

Security is only as strong as its weakest link. This room demonstrates why enumeration, information disclosure, and credential management deserve the same rigor as firewalls and patch management.

ROOM: basicpentestingjt · PLATFORM: TryHackMe · DIFFICULTY: Easy · METHODOLOGY: MITRE ATT&CK v14