# TryHackme Basic Pentesting room Walkthrough

Hi! I'm Adbin Magar, the researcher behind **TheGreyLens**. If you’ve seen my previous blogs, you know I’m currently tackling a daily CTF challenge where I complete TryHackMe rooms and document the process. Today, I'll be walking you through the **Basic Pentesting** room.

#### 🛠 Tools Used

*   **Nmap**: Network scanning and service enumeration.
    
*   **FFuF**: Web directory brute-forcing.
    
*   **Enum4linux**: Samba and Windows enumeration.
    
*   **Hydra**: SSH credential brute-forcing.
    
*   **SSH2John**: Preparing SSH keys for cracking.
    
*   **John the Ripper**: Password/Passphrase cracking.
    

**Question 1:** Deploy the machine and connect to our network

**Answer: No answer needed**

**Question 2:** Find the services exposed by the machine

The first phase of ethical hacking is Information gathering, so to find exposed services my go-to tool is Nmap.

![](https://cdn.hashnode.com/uploads/covers/6914271866fe9f4d18f8b8c2/a5c7bd0f-9035-43ab-9383-b3df925ba9b8.png align="center")

**Answer: No answer needed**

**Question 3:** What is the name of the hidden directory on the web server(enter name without /)?

For brute forcing, I prefer FFUF over Gobuster. So, here I used `ffuf` tool with a simple worldlist common.txt to find the name of hidden directory of my current target.

![](https://cdn.hashnode.com/uploads/covers/6914271866fe9f4d18f8b8c2/7618bb1e-e427-4811-93d9-4b8ac87c3765.png align="center")

`development` is the hidden directory. When, I open it in the browser it show me two files such as `dev.txt` and `j.txt`.

![](https://cdn.hashnode.com/uploads/covers/6914271866fe9f4d18f8b8c2/665787bc-90f5-4760-b5ff-f39f04787880.png align="center")

**Answer: development**

**Question 4:** User brute-forcing to find the username & password

Before jumping into brute-forcing, I analyzed the two files. `j.txt` a first file contained a message stating that credentials were weak and easily crackable by "K." This hinted that "J" and "K" were likely usernames.

![](https://cdn.hashnode.com/uploads/covers/6914271866fe9f4d18f8b8c2/14f8a34d-2282-4e2b-aa1d-063b7413bc10.png align="center")

In second`dev.txt` file there was mentioned about SMB and again referenced K and J. Since I found hints of a Samba service, I used **enum4linux** to gather more information.

`enum4linux -a 10.49.154.30`

![](https://cdn.hashnode.com/uploads/covers/6914271866fe9f4d18f8b8c2/ec32c274-fde8-46ec-8bde-000c914b933d.png align="center")

**Answer: jan**

**Question 5:** What is the password?

After identifying `jan` as a user I used **Hydra** to brute-force the ssh service.

`hydra -l jan -P /usr/share/wordlists/rockyou.txt ssh://10.49.154.30 -t 4 -V`

![](https://cdn.hashnode.com/uploads/covers/6914271866fe9f4d18f8b8c2/2f2c81a8-c678-42fd-a101-e0010785479d.png align="center")

**Answer: armando**

**Question 6:** What service do you use to access the server(answer in abbreviation in all caps)?

**Answer: SSH**

**Question 7:** Enumerate the machine to find any vectors for privilege escalation

**Answer: No answer needed**

**Question 8:** What is the name of the other user you found(all lower case)?

**Answer: kay**

**Question 9:** If you have found another user, what can you do with this information?

**Answer: No answer needed**

**Question 10:** What is the final password you obtain?

Upon successfully logging in as `jan` through SSH, I began exploring the file system. In the `/home` directory, I identified a user folder named `kay`. After navigating into this directory, I discovered a file named `pass.bak`. Given the naming convention, I suspected this file might contain sensitive credentials or a flag.

![](https://cdn.hashnode.com/uploads/covers/6914271866fe9f4d18f8b8c2/6745d398-6659-4690-87a1-73232c88b1ab.png align="center")

So, inside the kay folder when i use `ls -la` command i get to see there was `.ssh` folder. When reading the file inside `.ssh` folder there was `id_rsa` wich was a Private key.

![](https://cdn.hashnode.com/uploads/covers/6914271866fe9f4d18f8b8c2/d73990c6-07c1-4de0-bcdc-f992f7078eaa.png align="center")

After discovering the private key, I copied it and saved it to my local machine as `id_rsa.txt`. To prepare the key for decryption, I used the `ssh2john` to convert it into a format compatible with **John the Ripper.** This allowed me to proceed with the brute-force cracking process.

![](https://cdn.hashnode.com/uploads/covers/6914271866fe9f4d18f8b8c2/9fccd45d-0515-4052-b652-a93d7426b209.png align="center")

After successfully running the cracking process, I was able to recover the passphrase for the private key which is a **beeswax** in plain text.

![](https://cdn.hashnode.com/uploads/covers/6914271866fe9f4d18f8b8c2/358e254c-02bb-4de2-8d55-440ccc790aa2.png align="center")

With the passphrase 'beeswax' in hand, I was ready to escalate my access. Using the private key and the discovered passphrase, I authenticated as the user `kay` via SSH:

`ssh -i /path/to/id_rsa kay@<IP_address>`

Boom! I was successfully logged in. So, I navigated to the `/home/kay` directory and read the `pass.bak` file. As expected, it contained the flag I needed to complete the final stage of the challenge.

![](https://cdn.hashnode.com/uploads/covers/6914271866fe9f4d18f8b8c2/b5a17655-ce1d-4fe0-980c-4e4790a5e99c.png align="center")

**Answer: heresareallystrongpasswordthatfollowsthepasswordpolicy$$**

### **🎯 Day 3 Mission Accomplished**

Flag captured! That concludes Basic Pentesting room of my CTF challenge. Today was a great learning experience. I hope you learned something too. See you on next blog.

Happy hacking! :)