h4cked | Tryhackme Walkthrough

Task 1: Oh no! We've been hacked!

It seems like our machine got hacked by an anonymous threat actor. However, we are lucky to have a .pcap file from the attack. Can you determine what happened?

Download the .pcap file and use Wireshark to view it.

The attacker is trying to log into a specific service. What service is this?

Ans: ftp

To analyze the PCAP in detail, I used Statistics → Protocol Hierarchy.
FTP has a higher number of packets, indicating more traffic

Lets filter only ftp traffic:

There is a very popular tool by Van Hauser which can be used to brute force a series of services. What is the name of this tool?

Ans: Hydra

The attacker is trying to log on with a specific username. What is the username?

Ans: jenny

What is the user's password?

Ans: password123

By filtering FTP traffic and identifying successful login responses, then following the corresponding TCP stream, we can see the password that gave access to jenny account

Right click on the packet - Follow - TCP stream

After logging in, the attacker checked the current working directory. which is /var/www/html
This confirms that the FTP server is mapped to the web root, meaning files uploaded here are accessible via the web server. so can easily access reverse shell.

Then attacker uploaded shelll.php, given full permissions to the file

What is the current FTP working directory after the attacker logged in?

Ans: /var/www/html

The attacker uploaded a backdoor. What is the backdoor's filename?

Ans: shell.php

The backdoor can be downloaded from a specific URL, as it is located inside the uploaded file. What is the full URL?

Ans: http://pentestmonkey.net/tools/php-reverse-shell

To view the contents of shell.php, inspect FTP-DATA packets.
Under Line-based text data, the actual PHP payload is visible, which includes:

The remote URL used to download additional malicious code
The attacker’s IP address and listening port for the reverse shell

attacker executed the file on website:

Which command did the attacker manually execute after getting a reverse shell?

Ans: whoami

Since HTTP traffic is unencrypted, filtering HTTP packets and following the TCP stream reveals cleartext commands executed by the attacker after gaining the reverse shell.

What is the computer's hostname?

Ans: winr3

Which command did the attacker execute to spawn a new TTY shell?

Ans: python3 -c 'import pty; pty.spawn("/bin/bash")'

This command is commonly used to upgrade a basic reverse shell into a fully interactive TTY shell.

Which command was executed to gain a root shell?

Ans: sudo su

The attacker downloaded something from GitHub. What is the name of the GitHub project?

Ans: Reptile

The project can be used to install a stealthy backdoor on the system. It can be very hard to detect. What is this type of backdoor called?

Ans: Rootkit

Reptile installs a kernel-level rootkit, hard to detect because it operates at a low level and hides processes, files, and network activity.

Task 2: Hack your way back into the machine

The attacker has changed the user's password! Can you replicate the attacker's steps and read the flag.txt? The flag is located in the /root/Reptile directory. Remember, you can always look back at the .pcap file if necessary.

Good luck!

Run Hydra (or any similar tool) on the FTP service. The attacker might not have chosen a complex password. You might get lucky if you use a common word list.

Change the necessary values inside the web shell and upload it to the webserver

Updated attacker IP and listening port in the payload

Uploaded php-reverse-shell.php via FTP to /var/www/html

Create a listener on the designated port on your attacker machine.

nc -lvnp <port>

Execute the web shell by visiting the .php file on the targeted web server.

Accessed the PHP file via the web browser

Obtained a reverse shell

“I followed the same steps as the attacker by upgrading the shell, switching to the user jenny, checking sudo permissions using sudo -l, and finally escalating privileges to root using sudo su.”