> For the complete documentation index, see [llms.txt](https://calvin-lai.gitbook.io/calvin-lai-security/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://calvin-lai.gitbook.io/calvin-lai-security/hack-the-box-writeup/linux-machine/spectra-10.10.10.229.md).

# Spectra 10.10.10.229

![](https://1020855008-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MHdTwldplFku-IlYazS%2F-Mb1lOxgnHKuyozzpBqg%2F-Mb1pTsdLFuhHrU5jLP1%2Fimage.png?alt=media\&token=dc66a83f-b842-41f8-966e-e3f1031a8fb0)

## **Background**

**Spectra** is a Linux base machine from [HackTheBox](https://app.hackthebox.eu/machines/344) that focuses on the enumeration technique for training your ethical hacking skills and penetration testing skills.

<130n@calvinlai.com>

**Target Machine**: 10.10.10.239&#x20;

**Attacker Machine**: 10.10.14.3

## **Hacking Process Part 0 – Service Scanning**

### **Quick Pre-searching**

1. nmap -p- -T5 --min-rate=1000 10.10.10.229 -oG fkclai.nmap
2. nmap -p $(grep -Eo '\[0-9]{1,5}/open' fkclai.nmap | cut -d '/' -f 1 | tr -s '\n' ',') -sC -sV 10.10.10.229 -o nmap-result.txt

```
nmap -p $(grep -Eo '[0-9]{1,5}/open' fkclai.nmap | cut -d '/' -f 1 | tr -s '\n' ',') -sC -sV 10.10.10.229 -o nmap-result.txt
Starting Nmap 7.80 ( https://nmap.org ) at 2021-05-31 22:27 HKT
Nmap scan report for 10.10.10.229
Host is up (0.23s latency).

PORT     STATE SERVICE VERSION
22/tcp   open  ssh     OpenSSH 8.1 (protocol 2.0)
| ssh-hostkey: 
|_  4096 52:47:de:5c:37:4f:29:0e:8e:1d:88:6e:f9:23:4d:5a (RSA)
80/tcp   open  http    nginx 1.17.4
|_http-server-header: nginx/1.17.4
|_http-title: Site doesn't have a title (text/html).
3306/tcp open  mysql   MySQL (unauthorized)

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 17.96 seconds
```

**Enumeration strategies**\
According to the Nmap result, the target machine is a&#x20;

## **Hacking Process Part 1 – Enumeration**

### **Web Enumeration**

![](https://1020855008-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MHdTwldplFku-IlYazS%2F-Mb1rXwwmUgxRgEyAJ6_%2F-Mb1tJin2P5yr81LxG7Z%2Fimage.png?alt=media\&token=e06121df-5f12-48dd-99df-05173a04b313)

![](https://1020855008-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MHdTwldplFku-IlYazS%2F-Mb1qAIG0o8UuX__dg_o%2F-Mb1qZLKxdzIFxddh0gT%2Fimage.png?alt=media\&token=af1560e1-0c14-4af6-aad8-0bb6f7017ba0)

![](https://1020855008-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MHdTwldplFku-IlYazS%2F-Mb1qepeoVvuxSylDqGG%2F-Mb1rHeEJSGJBQNhAy6Y%2Fimage.png?alt=media\&token=a648096b-1a16-4dbc-99fc-9fbf5e9b784f)

![](https://1020855008-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MHdTwldplFku-IlYazS%2F-Mb1rItg4p1_hhqdENrY%2F-Mb1rXMXVZpUHcPNczPo%2Fimage.png?alt=media\&token=8fbf4550-16b3-46b5-9ff9-bc1a162dd557)

```

// ** MySQL settings - You can get this info from your web host ** //
/** The name of the database for WordPress */
define( 'DB_NAME', 'dev' );

/** MySQL database username */
define( 'DB_USER', 'devtest' );

/** MySQL database password */
define( 'DB_PASSWORD', 'devteam01' );

/** MySQL hostname */
define( 'DB_HOST', 'localhost' );

/** Database Charset to use in creating database tables. */
define( 'DB_CHARSET', 'utf8' );

/** The Database Collate type. Don't change this if in doubt. */
define( 'DB_COLLATE', '' );

```

![](https://1020855008-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MHdTwldplFku-IlYazS%2F-Mb1rXwwmUgxRgEyAJ6_%2F-Mb1vVJo03ZgfiDP_WRT%2Fimage.png?alt=media\&token=359b306e-bd69-495b-81bc-7ec76e307833)

![](https://1020855008-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MHdTwldplFku-IlYazS%2F-Mb1vXAqvqWiWtNhfr8X%2F-Mb1wTXquaonQOitKs4-%2Fimage.png?alt=media\&token=43733645-d33f-449d-bb08-a25dd7b44809)

![](https://1020855008-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MHdTwldplFku-IlYazS%2F-Mb1wVOmS095kO3iCntp%2F-Mb1xlPK27V3PttxmFEj%2Fimage.png?alt=media\&token=3b6b3550-a471-40e5-bd34-071a3b39767f)

```

cat /etc/autologin/passwd
SummerHereWeCome!!

```

```
```