> For the complete documentation index, see [llms.txt](https://adanikamal.gitbook.io/adanikamal/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://adanikamal.gitbook.io/adanikamal/walkthrough/tryhackme/nerdherd.md). # NerdHerd ## Penetration Testing Methodology **Reconnaissance** * nmap **Scanning** * gobster **Exploitation** * gcc **Capturing the flag** * root.txt *** ## Walkthrough ``` nmap -sC -sV -p- -vv 10.10.133.57 ``` Port open --> 21, 22, 139, 445, 1337 ## Web Enumeration Browse the IP. there is a link. The link: ``` gobuster dir -u http://10.10.133.57:1337 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt ``` Output: /admin Browse it. And look at the page source. There is Y2liYXJ0b3dza2k= : aGVoZWdvdTwdasddHlvdQ== So we decode using Cyber Chef. Y2liYXJ0b3dza2k= is cibartowski Another one is invalid. ``` ftp 10.10.133.57 ``` Login as anonymous. And we get youfoundme.png. Analyse it. ``` exiftool youfoundme.png ``` Something fishy about "Owner name: fijbxslz" Another file is hellon3rd.txt ``` cat hellon3rd.txt ``` Output: all you need is in the leet Cipher identifier: Output: Vigenere Cipher. After try a lot, I found that the key is **birdistheword** from the youtube link. Decode the vigenere key get easypass. I use this as a SMB password. ## SMB Enumeration ``` smbclient -L 10.10.137.57 ``` Sharename: nerdherd\_classified ``` enum4linux 10.10.133.57 ``` username: chuck ``` smbclient -U chuck \\\\10.10.133.57\\nerdherd_classified ``` pw: easypass Will get secr3t.txt. Which contain /this1sn0tadirect0ry Which will auto to page --> \* Where contains Credential for SSH. ## SSH ``` ssh *****@10.10.133.57 ``` User cannot run sudo (sudo -l) So, we check `uname -a` - To check kernel vulnerability Kernel exploits are written in C, which are compiled using gcc. First let's check if the victim machine have gcc I copy the exploit code into the victim system. ``` nano 45010.c ``` Now compile it using gcc and give permission to run using chmod Okay now we can run the exploit. Poof!! root. ``` locate root.txt ``` **CONGRATULATIONS!!** This was a fun machine. Thank you for reading. :) *By AdaniKamal*