TryHackMe|Brooklyn Nine Nine WriteUp\Walkthrough (English)

Brooklyn99 CTF

Start by connecting to tryhackme network. Then the first step is to scan the target machine. First lets ping it and see if it replies. No it doesn’t so this means that we need to use the -Pn option when scanning with nmap. We will do an aggressive scan on the 1000 common ports sudo nmap -Pn 10.10.212.129 -A.

The result showed that we have 3 ports open 21,22,80. We will examine each port step by step. Port 80 doesn’t have anything interesting, even though it has a comment that might appear interesting in the source code, but after trying we don’t need it. Port 21 is an ftp server, and as in the results, it showed that we have a file note_to_jake.txt.

Now let’s try to get access to the ftp server anonymously by ftp 10.10.212.129 the username will be anonymous and the password is just clicking enter when prompted. we got access so this means that it is possible, now we will download the file to our machine to view it by get note_to_jake.txt.

From the text file we knew that jake has a weak password. And also, we know that we have an ssh server on the same machine. So we will try to crack the password for the ssh using hydra hydra -l jake -P /usr/share/metasploit-framework/data/wordlists/unix_passwords.txt IP ssh . this will give us the password for jake and now we can connect to it using ssh jake@IP then give the password ********* that we obtained using hydra.

Now that we are in the target machine we can move between directories and search for the first flag which is “user flag”. If we go to /home we will notice that we have a user called holt. By viewing its home directory we will find the first flag✨.

Now we want the “root flag”. First we want to see if jake can run any command as root so we can benefit from it sudo -l. indeed jake can run less with root privileges without providing a password. So lets view any file with sudo less like sudo less /etc/profile. The trick here is to use less to spawn a shell. Simply just use ! symbol. This symbol let us execute any command inside less. By executing !/bin/bash we will get a bash shell with root privileges instantly.