Skip to content

Latest commit

 

History

History
169 lines (89 loc) · 4.25 KB

write-up.md

File metadata and controls

169 lines (89 loc) · 4.25 KB

TryHackme - Probe - Write-up

probe

Probe

Use your baseline scanning skills to enumerate a secure network.

I'm gonna explain you how i did to complete this room, step by step, it's very easy.

Note that you have different ways to solve this room

Tools you need for this room :

  • Nmap
  • Gobuster
  • Nikto
  • Wpscan

So let's go !

So first start the Machine and the Attack Box and get your IP

  1. What is the version of the Apache server ?

So for this answer you need to use : Nmap

nmap -A -p- yourmachineIP -T5

result

Answer : 2.4.41

  1. What is the port number of the FTP service?

Again for this question we will refer to our previous nmap scan

reponse2

Answer : 1338

  1. What is the FQDN for the website hosted using a self-signed certificate and contains critical server information as the homepage?

Still with the Nmap scan we have the answer for this question

result3

Answer : dev.probe.thm

  1. What is the email address associated with the SSL certificate used to sign the website mentioned in Q3?

So for this question, we need to connect to the port 1443, but read carefully the nmap scan, it's written there is a ssl certificate, so in your nav bar do not forget to type HTTPS

https://yourmachineIP:1443

You will see this page :

cap1 cap2 cap3 cap4

Answer : [email protected]

  1. What is the value of the PHP Extension Build on the server?

You have the answer in the previous screenshot

cap5

Answer : API20190902,NTS

  1. What is the banner for the FTP service?

So for this question, we can use Nmap again, remember the ftp server is running on the port 1338 (look the scan in question 1&2)

I'm gonna use the script engine of nmap

nmap --script=banner -p1338 yourmachineIP

result

Answer : THM{WELCOME_101113}

  1. What software is used for managing the database on the server?

So far, we only used nmap, now we will use another tool : Gobuster

gobuster dir -u http://yourmachineIP:8000 -w /usr/share/wordlists/dirb/big.txt

result7

We can see a phpmyadmin page, and if we enter this url in the browser we get this page :

phpmyadmin

Answer : phpmyadmin

  1. What is the Content Management System (CMS) hosted on the server?

We can use Nmap for this question

nmap -A -p 9007 yourmachineIP

wordpress

Answer : Wordpress

  1. What is the version number of the CMS hosted on the server?

You have the answer in the previous screenshot

Answer : 6.2.2

  1. What is the username for the admin panel of the CMS?

Now we will use another tool called : WPSCAN

wpscan --url https://yourmachineIP:9007 --disable-tls-checks -e u

wpscan joomla

Answer : Joomla

  1. During vulnerability scanning, OSVDB-3092 detects a file that may be used to identify the blogging site software. What is the name of the file?

Now we will use NIKTO

nikto -h yourmachineIP:9007 -ssl

nikto

Answer : license.txt

  1. What is the name of the software being used on the standard HTTP port?

You have the answer in the first scan with nmap

lighttpd

Answer : Lighttpd

  1. What is the flag value associated with the web page hosted on port 8000?

When we connect to the port 8000, we get an empty page

empty

So may be we have to use gobuster again to find a hidden directory.

gobuster dir -u http://yourmachineIP:8000 -w /usr/share/wordlists/dirb/big.txt

gobuster

let's look the result, we have some hidden directories, some have the 403 status, it means not available, and some have the 301 status. Let's connect to the page Contactus

flag

Answer : THM{CONTACT_US_1100}

And that's it, we have finished this room, CONGRATULATIONS 😎 🥳

CONCLUSION

It was an easy room, hope you learned something new and enjoyed it, please give me star on my Github.