> For the complete documentation index, see [llms.txt](https://davin-hong3.gitbook.io/d/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://davin-hong3.gitbook.io/d/walkthroughs/machines-and-practice/tryhackme/thm-vulnersity.md). # THM - Vulnersity These are notes taken while doing the vulnersity course in THM ## General Theory ### NMAP * first run two scans : First for low hanging fruit (default 1000 ports) * Next run the full 65535 using -p- run in background **-T\**: * first 2 for IDS evasion (0, 1) * Polite mode 2 slows down scan to use less bandwidth and target machine resources * Normal mode is default 3 * Aggressive mode speeds scan up by assuming a fast network * Insane mode sacrifices accuracy for speed ### Enumeration [dirbuster](https://tools.kali.org/web-applications/dirbuster) - commonly used in a lot of hacking challenge videos/write-ups though it’s popularity seems to be fading in favor of Gobuster. Can run multi-threaded and has a (not great) GUI interface. [dirb](https://tools.kali.org/web-applications/dirb) - operates similarly to dirbuster but is CLI only. Some people [think it’s slower than dirbuster](https://www.reddit.com/r/oscp/comments/8x59hy/dirb_or_dirbuster/) while others say dirb gives them more consistent results. Your mileage may vary. [gobuster](https://tools.kali.org/web-applications/gobuster) - the new hotness. Written in golang and meant to address the failings of both dirbuster and dirb. [dirsearch](https://github.com/maurosoria/dirsearch) - I came across this one while reading [another write-up](https://n0w4n.nl/vulnversity/) for this challenge. It seems to perform well enough so it’s included here and you can make your own decision whether you like it or not. #### Example use : * Wordlists are usually in /usr/share/wordlists/dirb **gobuster dir -e -u -w /usr/share/wordlists/dirb/common.txt**\ \ **dir**: uses directory/file brute forcing mode\ \ **-e**: expanded mode, print full URLs\ \ **-u**: the target URL or domain\ \ **-w**: path to word list ### Fuzzing and Compromise : #### Using Burp Suite When it’s active it functions as a web proxy so you need to [configure your browser to use it](https://support.portswigger.net/customer/portal/articles/1783055-Installing_Configuring%20your%20Browser.html). It also helps to [install Burp’s CA certificate](https://support.portswigger.net/customer/portal/articles/1783075-Installing_Installing%20CA%20Certificate.html) in your browser’s trust store. If you are a Firefox user then a good quality of life companion to use with Burp is [FoxyProxy.](https://addons.mozilla.org/en-US/firefox/addon/foxyproxy-standard/) It’s an add-on that once configured will allow you to easily switch between web proxies with a single click. The last component to set up are [SecLists](https://tools.kali.org/password-attacks/seclists) (you’ll see why in a minute). These are also super easy to install, just use APT to pull it from the repos. --> example : */usr/share/seclists/Fuzzing/extensions-most-common.fuzz.txt* * use burp intruder to fuzz the target and find file extension the server will accept * specify payloads, type of attack * Now check for length column that stands out from the rest ### Reverse Shell : Kali comes preloaded with a bunch of useful web shells located in **/usr/share/webshells**. * upload file via the fuzzed /internal/ subdomain page * using phtml extension as fuzzed * now callback the URL to activate : *`http://IP ADDRS/internal/uploads/nameofshell.phtml`* ### Privilege Escalation Now that we have a remote shell on our target the next step is to try to escalate our privileges to root. A common technique for privesc when doing CTFs or online challenges like this is to look for files that have the SUID bit set. Here is a [great article](https://www.linuxnix.com/suid-set-suid-linuxunix/) that explains in-depth what the SUID bit is and includes several examples to break it down further.