TryHackMe - Bolt

Bolt is one fo easiest room for beginers on TryHackMe.com After running basic nmap scan:

nmap -sC -sV Target_IP

We can see open ports, most intresting is port 8000 with running BOLT CMS.
After looking around the web page, we find login username and password in post on the page. We can search for vunlrabilities via web search and we can find following for Authenticated Remote Code Execution. How will you tackle this one? I used metasploit and use following module exploit/unix/webapp/bolt_authenticated_r. Throught the metasploit console set up needed variables LHOST, RHOST, USERNAME, PASSWORD and run the exploit. We need to run:

find / -type f -name flag.txt 2>/dev/null

and we get the flag in a seconds. I hope this short and easy tutorial helped anyone getting stucked in solving this room. audittrsi

TryHackMe - Linux PrivEsc - Task 6 - Privilege Escalation : Sudo

This is probably one of the easiest type of PrivEsc tasks.
With command :

sudo -l

We check what services we can run as root. adn with this info we can answer Q1
From output of the command we see 3 services/programs that we can run as root. Now that we have this information we can head over to the GTFObins To check for each service/program that we can gain root access to system.

• Find

sudo find . -exec /bin/sh \; -quit

• Less

sudo less /etc/profile
!/bin/sh

• nano

sudo nano
^R^X
reset; sh 1>&0 2>&0

Note about getting root via nano one command at the time ^R - is CTRL + R and ^X CTRL + X
To answer Q2 we run:

find / -type f -name flag2.txt 2>/dev/null

that we find path to the flag2.txt file
To answer Q3 we neet to check GTFObins to get command.
To answer Q4 we open /etc/shadow to find answer. I hope this post is helpfull for anyone stuck at solving this task.

TryHackMe - Bounty Hacker -walkthrough

Bounty Hacker is one of easy rooms on TryHackMe.com
I was able to finish it up in couple of minutes with some reference from other similar rooms like this one.

1. First step

In this step you deploy the target VM and start Attackbox if you dont have it up already. It takes a minute or two to start up.


2. Second step

We use nmap to scan target VM.

nmap -A -T4 _IP_target_VM


Command takes some time to scan and display us back what ports are open. You can see 3 ports open 21 with FTP, 22 ssh and 80 apache server.


3. Third step

As FTP is open and it allows you to connect with anonymous user we try to connect to FTP server on target machine with command:

FTP IP_target_VM


When prompted for username you enter anonymous. We check what files we can find on server there are 2 files. One cointains note from one user this is also answer to the Q3 and other is list of what it looks like passwords. You can download files by command:


get file_name



4. Forth step

We will use hydra brute forcing tool to check if any passwords from list we could obtain from FTP server. I used following command:

hydra target_VM_IP ssh -l lin -P path_to_the_password_list -s 22 -vV


SSH user i used the one i found in file on FTP server.


5. Fifth step

After Hydra finish its work and you get correct pass you can ssh to the target VM.


6. Sixth step

When we are logged in server I tried to find user flag and write location of the file into user-flag file:

find / -type f -name user.txt 2>/dev/nul > user-flag 



7. Seventh step

In this step we check what command can current user run as sudo. We use:

sudo -l


As we see now only one command we can run. We had over to the GTFObins and check what command to run. Copy paste command to the command line and voila we have root access.
8. Eighth step

Last step is to find the root.txt file we write its location to root-flag file:

find / -type f -name root.txt 2>/dev/null > /tmp/root-flag 

I hope this helps to the people who might get stucked during solving this room.

TryHackMe - Exploit Vulnerabilities module - Task 5 - Practical: Manual Exploitation

This is my first writeup/walkthrough post for the TryHackMe website.
TryHackMe is online platform for learning cyber security, using hands-on exercises and labs.
This post refers to the Task 5 - Practical: Manual Explotaition which is part of the module of Exploit Vulnerabilities on THM JR penetration tester course.
Task 5 is final task in this submodule and is to show practical example of things you learned through the previous tasks.

First step is to start VM that you will try to exploit as description says it requires few minutes to boot up. If you will use Attackbox on their site don't forget to start it also.

Second step To answer the Q1 you need to just open website that is hosted on VM you started in first step. Scroll down to the bottom of the page and voila you will find name version of the website.

Third step Now that you know website version you will need to find the way to exploit and gain access to it. You could also online tools but this Task 5 one aims towards use of the searchsploit tool that is installed and ready to use in Attackbox machine. we use following command:

searchsploit online book store

We get 4 different results, but we choose last from the list wich offers remote code execution.


Forth step - To start exploit you will use following command:

python name_of_script.py VM_IP

Since I was not in the same directory as exploit script I got error that exploit script was not found, so I used:

locate 47887.py

With that I found correct location of the exploit script and then i could ran exploit script correctly without errors:

python path_to_the_exploit_/47887.py VM_ip_Address

You are then only prompted to continue with exploit and in matter of seconds you get access to the shell of the VM.

Fifth step - finding flag.txt file and answer to the Q3 of this task.
This did not require much of the search since file is located in current folder and I used

cat flag.txt

To display flag.txt file content. I hope that this post is helpful for anyone trying to solve this challenge. audittrsi