search

Tryhackme - Internal - The Easy Way Walkthrough

<YOU CAN USE THE HARD WAY IF YOU WANT TO>

hashtag
Goal: Boot to Root

hashtag
1. Enumerations:

I started the room with a few nmap to make sure that I didn't miss any ports:

┌──(kali㉿kali)-[~]
└─$ nmap -Pn -sN 10.10.158.154
Starting Nmap 7.95 ( https://nmap.org ) at 2025-06-02 22:16 +07
Nmap scan report for 10.10.158.154 (10.10.158.154)
Host is up (0.23s latency).
Not shown: 998 closed tcp ports (reset)
PORT   STATE         SERVICE
22/tcp open|filtered ssh
80/tcp open|filtered http

Nmap done: 1 IP address (1 host up) scanned in 18.88 seconds
                                                                                
┌──(kali㉿kali)-[~]
└─$ nmap -Pn -sN -p- -A --min-rate 8000 -T4 10.10.158.154
Starting Nmap 7.95 ( https://nmap.org ) at 2025-06-02 22:18 +07

                                                                            
┌──(kali㉿kali)-[~]
└─$ nmap -Pn -sN -p- --min-rate 8000 -T4 10.10.158.154 
Starting Nmap 7.95 ( https://nmap.org ) at 2025-06-02 22:18 +07
Nmap scan report for 10.10.158.154 (10.10.158.154)
Host is up (0.23s latency).
Not shown: 65533 closed tcp ports (reset)
PORT   STATE         SERVICE
22/tcp open|filtered ssh
80/tcp open|filtered http

Nmap done: 1 IP address (1 host up) scanned in 10.42 seconds
                                                                              
┌──(kali㉿kali)-[~]
└─$ nmap -Pn -sS -p- --min-rate 8000 -T4 10.10.158.154
Starting Nmap 7.95 ( https://nmap.org ) at 2025-06-02 22:19 +07
Nmap scan report for 10.10.158.154 (10.10.158.154)
Host is up (0.25s latency).
Not shown: 65533 closed tcp ports (reset)
PORT   STATE SERVICE
22/tcp open  ssh
80/tcp open  http

Nmap done: 1 IP address (1 host up) scanned in 9.97 seconds
                                                                                
┌──(kali㉿kali)-[~]
└─$ nmap -Pn -sS -p- --min-rate 8000 -T4 10.10.158.154
Starting Nmap 7.95 ( https://nmap.org ) at 2025-06-02 22:20 +07
Nmap scan report for 10.10.158.154 (10.10.158.154)
Host is up (0.25s latency).
Not shown: 65533 closed tcp ports (reset)
PORT   STATE SERVICE
22/tcp open  ssh
80/tcp open  http

Nmap done: 1 IP address (1 host up) scanned in 12.08 seconds

┌──(kali㉿kali)-[~]
└─$ nmap -Pn -sV -A -p 22,80 10.10.158.154
Starting Nmap 7.95 ( https://nmap.org ) at 2025-06-02 22:40 +07
Nmap scan report for internal.thm (10.10.158.154)
Host is up (0.23s latency).

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 6e:fa:ef:be:f6:5f:98:b9:59:7b:f7:8e:b9:c5:62:1e (RSA)
|   256 ed:64:ed:33:e5:c9:30:58:ba:23:04:0d:14:eb:30:e9 (ECDSA)
|_  256 b0:7f:7f:7b:52:62:62:2a:60:d4:3d:36:fa:89:ee:ff (ED25519)
80/tcp open  http    Apache httpd 2.4.29 ((Ubuntu))
|_http-server-header: Apache/2.4.29 (Ubuntu)
|_http-title: Apache2 Ubuntu Default Page: It works
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running: Linux 4.X
OS CPE: cpe:/o:linux:linux_kernel:4.15
OS details: Linux 4.15
Network Distance: 5 hops
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

TRACEROUTE (using port 80/tcp)
HOP RTT       ADDRESS
1   96.71 ms  10.17.0.1 (10.17.0.1)
2   ... 4
5   231.19 ms internal.thm (10.10.158.154)

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 21.37 seconds

I also did some ffuf:

See that /blog, /wordpress I immediately visit it, quickly glancing through the source code and also looking into entry points:

From Wappalyzer extension, we could see that the site is using WordPress v5.4.2. I look for funny entries point for this site as well as running a wpscan and a ssh enumeration (I did sqlmap but, figured it wasn't the way):

Nmap and netcat ssh enumeration:

  • Explanation:

  • nc -vn 10.10.158.154 22: Banner Grabbing

  • nmap -p22 10.10.158.154 --script ssh2-enum-algos: Retrieve supported algorythms

  • nmap -p22 10.10.158.154 --script ssh-hostkey --script-args ssh_hostkey=full: Retrieve weak keys

  • nmap -p22 10.10.158.154 --script ssh-auth-methods --script-args="ssh.user=root": Check authentication methods

After that wpscan:

wpscan --url http://internal.thm/blog/ --enumerate u,ap,at:

This enumerates:

  • u → usernames

  • ap → all plugins

  • at → all themes

Now I have the admin as username, now I need entry point(s):

Founded.

Now I have tried sql, even sqlmap with not much of a success, I decided not to use Metasploit and go old school with hydra, I captured a request and studied a little:

And the error for inputting wrong password:

With that I build the command based on hydra command structure:

With that, I'm in, I did some poke around, I tried upload php shell with spoof jpg header:

Extension uploading, plugins editing but all of them are not writable and they can't be edited. Like Tryhackme - Daily Bugle I tried editing the Themes and Theme Editor:

Setup or netcat and visit http://internal.thm/blog, we got our reverse shell:

hashtag
2. Privilege Escalation:

pkexec? again? Like 3 rooms already.

Anyway, let's upload the PwnKit to finish get to root privilege of this machine:

PreviousTryhackme Daily BungleNextTryhackme - Internal - THE HARD WAY

Last updated