Bounty Hacker CTF | TryHackMe | Hydra & NMAP

hey everybody my name is Ron and welcome to my walkthrough video for the room Bounty hacker now this is a Cowboy Bebop themed room I did this one a while ago and I just wanted to do it again for the sake of completion in this video we'll be using tools such as Hydra nmap and grabbing those flags now if you found my content helpful please give me a thumbs up and subscribe and without further Ado let's get into it okay let's go ahead and get started with the Bounty hacker room from try hack me so first thing let's go ahead and check out the website so we have an image here we have some messages down below and let's look at the page store see if anything is actually in here it doesn't look like anything out of the norm so let's go ahead and do our nmap scan and map Dash a for aggressive Dash sc4 Scripps dot dash SB for versions section and dash oh and so that it saves what we found to a file called notes and let's put in that IP address next let's do go Buster for directory enumeration so go Buster directory and here's the IP address let's do wordless user share or list star buster yeah let's see let's do small text here [Music] so again using go Buster and the mode that we're doing here is for directory brute forcing the URL and here's the word list that we're using so so far we've found images so let's check that out and it seems like it's just a picture of the crew okay let's see if our nmap has finished all right our end map is done now so we have Port 21 open it is an FTP Service it does allow Anonymous FTP login we have SSH open on Port 22 and we have Port 80 open so now let's go ahead and see if we can log in Via FTP clean this up let's go FTP the IP address let's log in with anonymous and let's see what's in here now this may take a moment for it to load because we entered this extended passive mode while that's loading let's see if gobuster finds any more directories we can get into so far nothing other than images okay now that this is loaded let's go ahead and grab locks and task.txt so what we're going to do is um get multiple get and let's just put in an asterisk there so it will grab both files for us here we go all right now let's check out those files that we grab so let's check out locks [Music] so this looks like a word list and let's check out task so number one protect vicious number two plan for red eye pickup on the moon Lin hey let's look at the questions first question who wrote the task list Lynn next question what service can you brute force with the text file found so looking at our end map scan we notice that we have FTP and SSH that we can get into the only other option for us to use a username and a password is SSH so now let's go ahead and try to log in using Hydra with Lin as a username and with the word list locks so let's go ahead and use Hydra to log in Hydra Dash L let's use Lin as username Dash p and the word list they wanted us to use was locks and let's go ahead and put SSH at the end of that and the IP address was and the IP address was 10 10 31 173 now we see that a password or Lin was red dragon Syndicate let's go ahead and copy that let's log in now via SSH SSH Lynn at 10.10 31 173 let's go ahead and say yes and the password was red dragon syndicate and now we have a shell where am I Lynn we are at desktop let's see if the files that we need are here and let's go ahead and Cat that user a txt file we use Hydra to find out lid's password was red dragon Syndicate I after using lens credentials to log in we found the user text file and saw the flag was THM crime syndicate now the last thing we're going to do is find the root text file and get root access so we're gonna find out what permissions Lin has and we see here that the user Lin may run the following commands on Bounty hacker as root we can use tar so next thing we need to do is go to gtfl bins type in tar pseudo here's the command that we need to get boot access so let's go ahead and write that in there and we have the hashtag so now who am I I am root so let's go to root and let's cat that root file and here is our last flag THM Bounty hacker so this was a quick run through of the room Bounty hacker and if you found this video useful click that Thumbs Up And subscribe for more cyber security content thank you guys for watching and see you on the next one

Channel: RonR1337

Views: 99

Keywords:

Id: w0mDXvABUYY

Length: 6min 28sec (388 seconds)

Published: Wed Sep 27 2023