TryHackMe Hydra Walkthrough

TryHackMe Hydra Walkthrough is a learning module on TryHackMe that teaches users how to utilise the Hydra tool for brute-forcing online passwords.

Task 1

What is Hydra?

Hydra is a tool used for online brute-force attacks, allowing quick attempts at system login password “hacking.”

Hydra can run through a password list to brute force various authentication services. Imagine manually guessing someone’s password on a particular service, such as SSH, a web application form, FTP, or SNMP. Instead, Hydra can automate this process, significantly speeding it up by cycling through a list of potential passwords until the correct one is found.

According to its official repository, Hydra supports brute-forcing the following protocols: “Asterisk, AFP, Cisco AAA, Cisco auth, Cisco enable, CVS, Firebird, FTP, HTTP-FORM-GET, HTTP-FORM-POST, HTTP-GET, HTTP-HEAD, HTTP-POST, HTTP-PROXY, HTTPS-FORM-GET, HTTPS-FORM-POST, HTTPS-GET, HTTPS-HEAD, HTTPS-POST, HTTP-Proxy, ICQ, IMAP, IRC, LDAP, MEMCACHED, MONGODB, MS-SQL, MYSQL, NCP, NNTP, Oracle Listener, Oracle SID, Oracle, PC-Anywhere, PCNFS, POP3, POSTGRES, Radmin, RDP, Rexec, Rlogin, Rsh, RTSP, SAP/R3, SIP, SMB, SMTP, SMTP Enum, SNMP v1+v2+v3, SOCKS5, SSH (v1 and v2), SSHKEY, Subversion, TeamSpeak (TS2), Telnet, VMware-Auth, VNC, and XMPP.”

For more information on the specific options available for each protocol in Hydra, you can visit the Hydra tool page on Kali Linux.

This underscores the importance of using strong passwords. If your password is common, lacks special characters, or is shorter than eight characters, it is more vulnerable to being guessed. A list of 100 million passwords contains many common ones, so when out-of-the-box applications use default, weak passwords, it is essential to change them. Devices like CCTV cameras and web frameworks frequently use ‘admin’ as the default login credentials, which is far from secure.

Installing Hydra

Hydra is already installed on the AttackBox. You can access it by clicking the ‘Start AttackBox’ button.

If you prefer using the in-browser Kali machine, Hydra is also pre-installed on all Kali distributions. To access it, select ‘Use Kali Linux’ and click the ‘Start Kali Linux’ button.

For those using a different Linux distribution, you can refer to Hydra’s official repositories. For example, to install Hydra on an Ubuntu or Fedora system, you can run apt install hydra or dnf install hydra, respectively. You can also download it from the official THC-Hydra repository.

Answer the questions below

Read the above and ensure Hydra is ready for use.

Task 2

Deploy the machine attached to this task, then navigate to http://MACHINE_IP (this machine can take up to 3 minutes to boot)

Hydra Commands

The options we pass into Hydra depend on which service (protocol) we’re attacking. For example, if we wanted to brute force FTP with the username being user and a password list being passlist.txt, we’d use the following command:

hydra -l user -P passlist.txt ftp://MACHINE_IP

For this deployed machine, here are the commands to use Hydra on SSH and a web form (POST method).

SSH

hydra -l <username> -P <full path to pass> MACHINE_IP -t 4 ssh

For example, hydra -l root -P passwords.txt MACHINE_IP -t 4 ssh will run with the following arguments:

• Hydra will use root as the username for ssh
• It will try the passwords in the passwords.txt file
• There will be four threads running in parallel as indicated by -t 4

Post Web Form

We can use Hydra to brute force web forms too. You must know which type of request it is making; GET or POST methods are commonly used. You can use your browser’s network tab (in developer tools) to see the request types or view the source code.

sudo hydra <username> <wordlist> MACHINE_IP http-post-form "<path>:<login_credentials>:<invalid_response>"

Below is a more concrete example Hydra command to brute force a POST login form:

hydra -l <username> -P <wordlist> MACHINE_IP http-post-form "/:username=^USER^&password=^PASS^:F=incorrect" -V

• The login page is only /, i.e., the main IP address.
• The username is the form field where the username is entered
• The specified username(s) will replace ^USER^
• The password is the form field where the password is entered
• The provided passwords will be replacing ^PASS^
• Finally, F=incorrect is a string that appears in the server reply when the login fails

You should now have enough information to put this to practice and brute force your credentials to the deployed machine!

Answer the questions below

Q1. Use Hydra to bruteforce molly’s web password. What is flag 1?

We turned on Our Machine and our IP was 10.10.43.85, we posted it on the browser and we met a login form. We had to bruteforce it with hydra using the rockyou.txt wordlist and some commands.

hydra -l molly -P /usr/share/wordlists/rockyou.txt 10.10.43.85 http-post-form “/login:username=^USER^&password=^PASS^:F=incorrect” -f as show in the image below and as you can see in the image we got molly’s password.

After that we logged in to the webpage with username molly and password sunshine and we got the flag.

Answer: THM{2673a7dd116de68e85c48ec0b1f2612e}

Q2. Use Hydra to bruteforce molly’s SSH password. What is flag 2?

To get the ssh password we assumed the login username was molly so we did this

hydra -l molly -P /usr/share/wordlists/rockyou.txt 10.10.43.85 -t 4 ssh

And we got the ssh password which is butterfly, then we tried to login with ssh on kali machine but it was unable to accept the key due to DNS issues unresolved. I had to open the TryHackMe attackbox and logged the ssh in and it worked. Kindly see below image and see how we logged in.

ssh molly@Attackbox-IP (ssh molly@10.10.235.122), then it prompted us for confirmation to connect, we typed yes, then we enter the password. Boom!!!!

We’re In. Lets find the flag 2

We did the list command (ls) and we found it. Lets see the contents using the concatonate command (cat)

Answer: Flag 2 THM{c8eeb0468febbadea859baeb33b2541b}

Thank you for reading.