THM - On-Premises IaC

A writeup for the room challenge On-Premises IaC on TryHackMe

TryHackMe | Cyber Security Training

Footprinting

We can begin by performing an Nmap scan, which reveals two open ports: 22 and 80.

The webserver on port 80 returns an error and nothing more.

If we try to log in via SSH using the provided credentials (entry:entry), we can find a folder called iac that has a classic structure typical of a Vagrant deployment, as observed in other parts of the room.

Inside the Vagrantfile, we can see that there are two services: the first, called dbserver, is running MySQL on the IP address 172.20.128.3, and the second, called webserver, is located on the IP address 172.20.128.2

These addresses are private, meaning they are not directly accessible from your machine but only from the remote server. To access them, you can forward your connection using SSH tunneling or other similar…