This is a vulnerable VM from PwnTillDawn. Box: Medium, Flags to acquire = 4 Enumeration Let's start with a quick Nmap scan. We can see 2 ports open. SSH and an Uknown port. Let's enumerate a bit more.

https://tryhackme.com/room/thatstheticket IP: 10.10.28.159 Nmap nmap -p- -v 10.10.28.159 PORT STATE SERVICE 22/tcp open ssh 80/tcp open http Nikto nikto -h 10.10.28.159 - Nikto v2.1.6 --------------------------------------------------------------------------- + Target IP: 10.10.28.159 + Target Hostname: 10.10.28.159 + Target Port: 80 +…

Room Link Enumeration Nmap nmap -p- -v 10.10.68.59 PORT STATE SERVICE 22/tcp open ssh 80/tcp open http 8765/tcp open ultraseek-http Gobuster gobuster dir -u http://10.10.68.59 -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-big.txt -x txt,html,gz,php,js,zip,img,bak -t 45 http://10.10.68.59/ /gallery.html (Status: 200) [Size: 1950] /index.html…

Room link: https://tryhackme.com/room/jpgchat Enumeration Let’s start with all good hacks with a quick Nmap scan to see what I’m working with.

Drifting Blues (Vulnhub) Room link: https://www.vulnhub.com/entry/driftingblues-1,625/ Find the IP address arp-scan --localnet --interface=eth1 Change for your network interface ‌ Nmap Starting Nmap 7.91 ( https://nmap.org ) at 2021-03-09 20:20 GMT PORT STATE SERVICE 22/tcp open ssh 80/tcp open http ‌ Port 80‌ On port 80 we find drifting blues tech website home page. …

Room Link Enumeration Let’s start with some enum! Nmap nmap -p- -v 192.168.56.122 PORT STATE SERVICE 22/tcp open ssh 80/tcp open http Gobuster gobuster dir -u http://192.168.56.122/ -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-big.txt -x txt,html,gz,php,js,zip,img,bak -t 45 /index.html (Status: 200) [Size: 10701] /manual (Status: 301) [Size: 317] [--> http://192.168.56.122/manual/] /javascript (Status: 301) [Size: 321] [--> http://192.168.56.122/javascript/] …

Tip: Don’t decode the MD5 hash’s in the page source (I warned you!) ‌ Nmap PORT STATE SERVICE 21/tcp open ftp 22/tcp open ssh 80/tcp open http User FTP Trying FTP with an anonymous login shows only 1 file called chadinfo.

Room Link Created by: MrSeth6797 Enumeration Nmap nmap -p- 10.10.222.16 PORT STATE SERVICE 53/tcp open domain 80/tcp open http 88/tcp open kerberos-sec 135/tcp open msrpc 139/tcp open netbios-ssn 389/tcp open ldap 445/tcp…

Link: https://www.vulnhub.com/entry/coffee-addicts-1,699/ — Enum IP: 192.168.1.159 Note: Add coffeeaddicts.thm to /etc/hosts Nmap PORT STATE SERVICE 22/tcp open ssh 80/tcp open http Port 80

Link: https://www.vulnhub.com/entry/momentum-2,702/ — Nmap PORT STATE SERVICE 22/tcp open ssh 80/tcp open http Gobuster /index.html (Status: 200) [Size: 1428] /img (Status: 301) [Size: 312] [--> http://192.168.1.145/img/] /css…

Nmap PORT STATE SERVICE 53/tcp open domain 88/tcp open kerberos-sec 135/tcp open msrpc 139/tcp open netbios-ssn 389/tcp open ldap 445/tcp open microsoft-ds 464/tcp open kpasswd5 593/tcp open http-rpc-epmap 636/tcp…

Nmap PORT STATE SERVICE 80/tcp open http 2222/tcp open EtherNetIP-1 PORT STATE SERVICE VERSION 80/tcp open http Apache httpd 2.4.18 ((Ubuntu)) | http-methods: |_ Supported Methods: GET HEAD POST OPTIONS |_http-server-header: Apache/2.4.18 (Ubuntu) |_http-title: Site doesn't have a title (text/html). 2222/tcp open ssh…

Nmap PORT STATE SERVICE 22/tcp open ssh 80/tcp open http Port 80 Using gobuster i enumerated port 80 as only the default apache page loaded. /index.html (Status: 200) [Size: 10918] /music (Status: 301) [Size: 312] [--> http://10.10.10.171/music/] /artwork (Status: 301) [Size: 314] [--> http://10.10.10.171/artwork/] /sierra (Status: 301) [Size: 313] [--> http://10.10.10.171/sierra/]

Nmap PORT STATE SERVICE 22/tcp open ssh 80/tcp open http PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 7.9p1 Debian 10+deb10u1 (protocol 2.0) | ssh-hostkey: | 2048 aa:99:a8:16:68:cd:41:cc:f9:6c:84:01:c7:59:09:5c (RSA) | 256 93:dd:1a:23:ee:d7:1f:08:6b:58:47:09:73:a3:88:cc (ECDSA) |_ 256 9d:d6:62:1e:7a:fb:8f:56:92:e6:37:f1:10:db:9b:ce (ED25519) 80/tcp open http nostromo 1.9.6 |_http-server-header: nostromo 1.9.6 …

Nmap PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 7.4p1 Debian 10+deb9u6 (protocol 2.0) 80/tcp open http Apache httpd 2.4.25 ((Debian)) PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 7.4p1 Debian 10+deb9u6 (protocol 2.0) | ssh-hostkey: | 2048 dd:53:10:70:0b:d0:47:0a:e2:7e:4a:b6:42:98:23:c7 (RSA) | 256 37:2e:14:68:ae:b9:c2:34:2b:6e:d9:92:bc:bf:bd:28…

Room link: https://tryhackme.com/room/gitandcrumpets Nmap Let’s see what we are working with here. Nmap scan report for git.git-and-crumpets.thm (10.10.255.148) Host is up (0.022s latency). Not shown: 997 filtered ports PORT STATE SERVICE 22/tcp open ssh 80/tcp open http 9090/tcp closed zeus-admin I see git.git-and-crumpets.thm and git-and-crumpets.thm in the nmap output. Let's add…

Link: https://www.vulnhub.com/entry/tech_supp0rt-1,708/ Box: Easy Enumeration Nmap PORT STATE SERVICE 22/tcp open ssh 80/tcp open http 139/tcp open netbios-ssn 445/tcp open microsoft-ds PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 7.2p2 Ubuntu 4ubuntu2.10 (Ubuntu Linux; protocol 2.0) |…

Nmap PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH for_Windows_7.9 (protocol 2.0) | ssh-hostkey: | 2048 3a:56:ae:75:3c:78:0e:c8:56:4d:cb:1c:22:bf:45:8a (RSA) | 256 cc:2e:56:ab:19:97:d5:bb:03:fb:82:cd:63:da:68:01 (ECDSA) |_ 256 93:5f:5d:aa:ca:9f:53:e7:f2:82:e6:64:a8:a3:a0:18 (ED25519) 135/tcp…

Room link: https://tryhackme.com/room/coldvvars Target IP: 10.10.236.49 Nmap PORT STATE SERVICE 139/tcp open netbios-ssn 445/tcp open microsoft-ds 8080/tcp open http-proxy 8082/tcp open blackice-alerts Websites Port 8080 After a quick gobuster I found a new endpoint /dev, can use OPTIONS to bypass the 403,405 http://10.10.236.49:8080/dev/ http://10.10.236.49:8080/dev/note.txt curl 10.10.236.49:8080/dev/note.txt

Room link: https://tryhackme.com/room/metamorphosis Box name sudo nano /etc/hosts 10.10.10.10 incognito.thm Nmap PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0) 80/tcp open http Apache httpd 2.4.29 ((Ubuntu)) 139/tcp open netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP) 445/tcp open netbios-ssn Samba smbd 3.X - 4.X …