TryHackMe Brooklyn Nine Nine Writeup

This is a writeup for TryHackMe Brooklyn Nine Nine room.

Brooklyn Nine Nine

My target IP is 10.10.178.103

NMAP

sudo nmap -sS -sV -A 10.10.178.103

nmap results

Three ports are open.

GOBUSTER

gobuster results

Nothing useful in Gobuster.

WEBSITE INSPECTION

main page

page source

Well then lets download image and check it.

time stegseek brooklyn99.jpg rockyou.txt

stegssek

brooklyn99 output

We have holt’s password.

FTP

We are allowed to login as anonymous as we can see in the Nmap results. Therefore, we don’t need to enter a password.

ftp

We found a file and this indicates we may try Hydra.

note_to_jake

HYDRA

hydra -l jake -P rockyou.txt 10.10.178.103 ssh

hydra results

SSH AND USER FLAG

First I will try SSH as jake.

jake ssh

Nothing useful in our directory.

user flag

After a little search, I found user flag.

ROOT FLAG

I will ssh as holt now.

holt sudo -l

We can just read the root flag since holt can run the nano command as sudo.

sudo /bin/nano /root/root.txt

root flag