TryHackMe Bulletproof Penguin - Full Walkthrough
Can you harden this Linux server?
🚩🚩 Room link: https://tryhackme.com/room/bppenguin
You have been hired by the XYZ company as a consultant to harden the Bulletproof Penguin, an old server that's never been hacked (as far as we know). As you arrive, the company's IT crew hands you a vulnerability scan report that was recently made against the server, and asks you to implement solutions to each finding. To help you, they've added notes on their discussions for each of the vulnerabilities. Armed with only your laptop, you are given SSH access to the server with the following credentials:
😸Room Tasks:😸
🐧 Task 1: Introduction
🐧 Task 2: Redis Server No Password
What is the redis_nopass flag?
🐧 Task 3: Report Default Community Names of the SNMP Agent
What is the snmp_public flag?
🐧 Task 4: Nginx running as root
What is the nginx_asroot flag?
🐧 Task 5: Cleartext Protocols
What other cleartext service is running on port 69/udp?
What is the cleartext_services flag?
🐧 Task 6: Weak SSH Crypto
What is the ssh_weak_macs flag?
What is the ssh_weak_kex flag?
What is the ssh_weak_ciphers flag?
🐧 Task 7: Anonymous FTP Login Reporting
What is the anon_ftp flag?
🐧 Task 8: Weak Passwords
What is the change_pass flag?
What is the unused_accounts flag?
🐧 Task 9: Review Sudo Permissions
What is the sudoers_munra flag?
What is the sudoers_mary flag?
🐧 Task 10: Exposed Database Ports
What is the mysql_port_public flag?
What is the redis_port_public flag?
🐧 Task 11: The End
⚠️ Educational Purpose Only
This content is for educational and authorized penetration testing purposes only. Always ensure you have permission before testing on any systems.
#tryhackme #linux