This is an example writeup with fictional data. Use it as a template for your own machines.
Reconnaissance
Start with a scan of every TCP port, then run a version scan against the open ones:
nmap -p- --min-rate 5000 -oN ports.txt 10.10.11.100
nmap -p22,80 -sCV -oN services.txt 10.10.11.100| Port | Service | Version |
|---|---|---|
| 22 | SSH | OpenSSH 8.9p1 |
| 80 | HTTP | nginx 1.18.0 |
Web enumeration
The web server redirects to example.htb, so add it to /etc/hosts. Directory fuzzing reveals an admin panel:
ffuf -u http://example.htb/FUZZ -w /usr/share/wordlists/dirb/common.txtInitial access
Describe the vulnerability that gave you access: what you found, why it works, and how you exploited it. Include only the commands needed to reproduce it.
Privilege escalation
Check the user’s sudo permissions:
sudo -lIf the user can run a binary as root without a password, check GTFOBins to see whether it can spawn a shell.
Lessons learned
- Enumerate every port before focusing on one.
- Always check
sudopermissions and SUID binaries.
