•HTB Academy, Penetration Testing, Password Attacks, Brute Force, FTP, SSH, John The Ripper, Hydra, Sudo Enumeration, Initial Access, Root Access

HTB Academy Password Attacks Part 1 - Easy

Walkthrough of the HTB Academy Password Attacks Part 1 - Easy

Easy

Enumeration

starting off with a nmap scan using default scripts and version enum

image.png

Brute forcing

Running hydra against FTP first since from one of the earlier modules I learned that SSH takes longer to brute force generally

image.png

[21][ftp] host: 10.129.202.219   login: mike   password: 7777777

FTP Enumeration

ftp into the system with the creds found

find some ssh keys and download

image.png

attempting to ssh into the target as mike using the id_rsa file failed

attempting to ssh into the target as root using id_rsa file prompted for password

SSH key bruteforcing

attempt to crack the ssh key:

convert the ssh key to a hash using ssh2john script

ssh2john id_rsa > id_rsa.hash

image.png

7777777

sshing as root fails, so that is not the password for root

attempt to ssh as mike passing in the key we found

Initial Access

had to change permissions on the id_rsa file for it to work

image.png

running sudo -l mike had no permissions, performing some manual enumeration I look through mikes bash_history file and there I find a script being run as root and a password being passed in

image.png

analysis.py -u root -p dgb6fzm0ynk@AME9pqu

switching users to root with that works

mike@skills-easy:~$ su root
Password: 
root@skills-easy:/home/mike# whoami
root