Write-up: Net Sec Challenge — Network Security (TryHackMe)

Hello Jekyll

This write-up documents my solution for the Net Sec Challenge — Network Security room on TryHackMe.
Author: biusa_mrdarkroot

The goal of this challenge is to practice skills from the Network Security module using tools such as nmap, telnet, and hydra.

---

Objectives

• Scan ports across a broad range (1–9999) to find services not in top-1000
• Perform banner grabbing using curl / telnet
• Use brute-force against FTP with hydra when valid usernames are known

---

---

Environment & Tools

• Platform: TryHackMe — Net Sec Challenge
• Tools used: nmap, telnet, curl, hydra

---

Questions & Answers

Q1 — What is the highest open port under 10,000?
Goal: Scan ports 1–9999 to identify the highest open port.

Answer: 8080

Q2 — What is the highest open port (under 10,000)?
Answer: 10021

Q3 — How many TCP ports are open?
Answer: 6

---

Hidden flags in service headers

Q4 — Hidden flag in the HTTP Server header?
Goal: Inspect HTTP response headers using curl, telnet, or Burp Suite.

Answer: THM{web_server_25352}

Q5 — Hidden flag in the SSH server banner?
Goal: Since direct SSH might be blocked, use telnet to check the SSH banner.

Answer: THM{946219583339}

---

FTP & credentials

Q6 — An FTP server is listening on a non-standard port. What is the FTP server version?
Goal: Scan port 10021 (found earlier) to identify the service on that port.

Answer: vsftpd 3.0.5

Q7 — We discovered two usernames via social engineering: Eddie and Quinn. Which flag is hidden in one of those account files accessible via FTP?
Goal: Find passwords and use brute-force or valid credentials to retrieve files via FTP.

Answer: THM{321452667098}

---

Web challenge on port 8080

**Q8 — Visiting http://:8080 reveals a small challenge. After solving it you receive a flag. What is that flag?** **Goal:** Scan the server in a way that avoids simple IDS detection (hint: use a NULL scan when appropriate), then solve the web challenge.

Answer: THM{f7443f99}

---

Results

• Obtained the Moderator flag via stored XSS + session hijacking.
• Enumerated hidden files to find admin credentials → logged in as admin → obtained the Admin flag.

---

Quick commands reference

• Full port scan (example):

  nmap -p1-9999 -sV <TARGET_IP>
  

• Banner grab via telnet (example):

  telnet <TARGET_IP> <PORT>
  

• Simple HTTP header check:

  curl -I http://<TARGET_IP>:8080
  

• FTP brute-force with hydra (example):

  hydra -l Eddie -P /path/to/wordlist ftp://<TARGET_IP> -s 10021
  

---