Binex TryHackme Writeup

Room link: https://tryhackme.com/room/binex
Note: This room is for Premium Members Only. who purchased THM premium membership.

Topics

• Network Enumeration
• Linux Enumeration
• SMB Enumeration
• Brute Forcing (SSH)
• Abusing SUID/GUID
• Buffer Overflow
• Exploiting PATH Variable

Enumeration

The hint showed that the longest username in RID range 1000–1003 has an insecure password. We then run enum4linux to enumerate the users.

enum4linux -a 10.10.156.34

So now we have users

kel, des, tryhackme, noentry

Now let’s get access to the system via this user by brute-forcing the SSH service Using hydra tool.

hydra -l tryhackme -P rockyou.txt ssh://10.10.156.34