Challenge Description:
Marco Bianchi, a systems administrator, recently deployed several internal services, including a firewall console, employee portal, social platform, and SSH access to critical infrastructure. Due to tight deadlines and operational pressure, Marco reused weak, predictable, and pattern-based passwords across multiple systems.

Your objective is to conduct a password security assessment to identify weaknesses in Marco’s authentication practices.

Access Room: https://tryhackme.com/room/checkmate

TASK 1

First Question:

What is the password for Level 1?

This is the page where we need to submit the password to gain access to the next level. As you can see, it clearly mentions a firewall running at port 5001 on the same target machine.

After entering the default password 12345, we are redirected to this page

Answer : 12345

Question 2:

What is the password for Level 2?

The Internal Employee Portal is running on port 5002.

We need to prepare a wordlist using words extracted from this website, and then use that wordlist to brute-force the login panel. We will be using tools like CeWL, curl, or wget to accomplish this.

Username is Marco.

I used wget to extract words from the website and build a wordlist, since the challenge mentions that the password is derived from words found on the website.

Command:
wget -q -O — http://10.48.149.185:5002 | grep -oP ‘\w{4,}’ | sort -u > wordlist.txt

We will use Hydra to brute-force the login page.

Command:
hydra -l marco -P wordlist.txt 10.48.149.185 http-post-form “/login:username=^USER^&password=^PASS^:Invalid” -s 5002 -V

Answer : excellence

Question 3:

What is the password for Level 3?

Here we need to build a wordlist using Marco’s personal details with CUPP (a tool designed to generate custom, targeted wordlists based on personal information).

After generating the personalized wordlist, we will use it to brute-force the login page of the social platform using Hydra.

Command:

hydra -l marco -P marco.txt 10.48.149.185 http-post-form “/login:username=^USER^&password=^PASS^:Invalid” -s 5003 -V

Answer: Bianchi2495

Question 4:

What is the password for Level 4?

Save the hash in a file and then use Hashcat to crack it.

Command:

hashcat -m 1400 -a 0 hash.txt /usr/share/wordlists/rockyou.txt

Answer : family

Question 5:

What is the password for Level 5?

We will use the Crunch tool to generate a wordlist based on the given password format.

crunch 13 13 -t Security20%% ! -o security_wordlist.txt

After generating the wordlist, we will use Hydra to brute-force the SSH service.

hydra -l marco -P security_wordlist.txt 10.48.149.185 ssh -V -t 4

Answer: Security2024!

That’s a wrap! Thanks for sticking around till the end. This was my first writeup, so I really appreciate your time and patience. If you enjoyed it or found it useful, do give it a clap 👏 — it motivates me to write more. See you in the next one! 🔐