> For the complete documentation index, see [llms.txt](https://0xb0b.gitbook.io/writeups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://0xb0b.gitbook.io/writeups/tryhackme/2026/checkmate.md). # Checkmate {% embed url="" %} The following post by 0xb0b is licensed under [CC BY 4.0

](http://creativecommons.org/licenses/by/4.0/?ref=chooser-v1) *** Our objective is to conduct a password security assessment to identify weaknesses in Marco's authentication practices/ password requirements. We are task to start by accessing the main application at \*\*; From there, we will be guided through each stage of the challenge, uncovering and exploiting weaknesses in Marco’s password usage. ## Level 1 We visit `http://checkmate.thm:5000/` and start with the first level at `http://firewall.thm:5001`. {% code overflow="wrap" expandable="true" %} ``` http://checkmate.thm:5000/ ``` {% endcode %}

We add the host to our /etc/hosts file and visit the page at `http://firewall.thm:5001`. We have a log in page infront of us. {% code overflow="wrap" expandable="true" %} ``` http://firewall.thm:5001/ ``` {% endcode %}

We catch an example request with Burp Suite to figure out the structure of the request. We see it is a simple http POST request with the parameters `username` and `password`. An invalid combination results into a page containing `Invalid credentials`.

Next, we run hydra to brute force the log in as the preset user `admin`. For the wordlist we chose `rockyou.txt`. After a short duration we have a hit. {% code overflow="wrap" expandable="true" %} ``` hydra -l admin -P /usr/share/wordlists/rockyou.txt checkmate.thm -s 5001 http-post-form "/login:username=^USER^&password=^PASS^:F=Invalid credentials" ``` {% endcode %}

We use the credentials found to log in to the firewall portal and are successful. Nothing interesting here so far. {% code overflow="wrap" expandable="true" %} ``` http://firewall.thm:5001/ ``` {% endcode %}

We head back to the main page and enter the password found. The password is correct and level 2 gets unlocked. {% code overflow="wrap" expandable="true" %} ``` http://checkmate.thm:5000/ ``` {% endcode %}

## Level 2 We reach out to level 2. The next target is a job portal. We also. get a clue that common company keywords are used as a password. {% code overflow="wrap" expandable="true" %} ``` http://checkmate.thm:5000/ ``` {% endcode %}

We add the following entry to our `/etc/hosts` file and visit the page. We visit the jobs page and have a lot of company buzzwords infront of us we can use to craft a wordlist. {% code overflow="wrap" expandable="true" %} ``` http://jobs.thm:5002/ ``` {% endcode %}

At `http://jobs.thm:5002/login` we have the employee login. The preset username is `marco`. {% code overflow="wrap" expandable="true" %} ``` http://jobs.thm:5002/login ``` {% endcode %}

Again, we catch the request via Burp Suite to grasp the structure of the request.

Our first attempt to gain access using `rockyou.txt` was unsuccessful. This time, we're going to try creating our own word list. We run cewl to crawl `http://jobs.thm:5002/` to a depth of 2, scraping words from the page content to build a custom wordlist saved as `cewl.txt`. {% embed url="" %} {% code overflow="wrap" expandable="true" %} ``` cewl --depth 2 --with-numbers --write cewl.txt http://jobs.thm:5002/ ``` {% endcode %}

Next, we run hydra to brute force the log in as the preset user `marco`. For the wordlist we chose `cewl.txt`. After a short duration we have a hit. {% code overflow="wrap" expandable="true" %} ``` hydra -l marco -P ./cewl.txt jobs.thm -s 5002 http-post-form "/login:username=^USER^&password=^PASS^:F=Invalid credentials" ``` {% endcode %}

We use the credentials found to log in to the portal and find some valuable information like personal details we can use later on to craft new wordlists. {% code overflow="wrap" expandable="true" %} ``` http://jobs.thm:5002/profile ``` {% endcode %}

We head back to the main page and enter the password found. The password is correct and level 3 gets unlocked {% code overflow="wrap" expandable="true" %} ``` http://checkmate.thm:5000/ ``` {% endcode %}

## Level 3 Now we are tasked to visit the social site and retrieve the password. This time the password is dervied from marcos personal information. Luckily we harvested such information earlier at `http://jobs.thm:5002/profile`. {% code overflow="wrap" expandable="true" %} ``` http://checkmate.thm:5000/ ``` {% endcode %}

We add the following entry to our `/etc/hosts` file and visit the page. We visit the social page. No username is preset this time, but we'll focus on the username `marco` for now. {% code overflow="wrap" expandable="true" %} ``` http://social.thm:5003/ ``` {% endcode %}

We recall the information gathered at `http://jobs.thm:5002/profile`. {% code overflow="wrap" expandable="true" %} ``` http://jobs.thm:5002/profile ``` {% endcode %}

To generate a wordlist with the gathered information we leverage CUPP - a Common User Passwords Profiler. We run cupp in interactive mode and provide all the information gathered like depicted below. {% embed url="" %} {% code overflow="wrap" expandable="true" %} ``` cupp -i ``` {% endcode %}

We catch a log in request via Burp Suite to grasp the structure for hydra.

Next, we run hydra to brute force the log in as `marco`. For the wordlist we chose our crafted one with cupp `marco.txt`. After a short duration we have a hit. {% code overflow="wrap" expandable="true" %} ``` hydra -l marco -P ./marco.txt social.thm -s 5003 http-post-form "/login:username=^USER^&password=^PASS^:F=Invalid credentials" ``` {% endcode %}

We use the credentials found to log in to the social page. Here we see some questionable recommendations for a strong password from `marco`. So A company keyword, which is capitaliued and a year appended finished by an excalmation mark. How creative... We make note of this information to generate a ruleset to craft a wordlist with the information provided. {% code overflow="wrap" expandable="true" %} ``` http://social.thm:5003/ ``` {% endcode %}

We head back to the main page and enter the password found. The password is correct and level 4 gets unlocked {% code overflow="wrap" expandable="true" %} ``` http://checkmate.thm:5000/ ``` {% endcode %}

## Level 4 Level 4 is a file-related sidetrack. Here, we are required to reconstruct the filenames from the generated SHA-256 hash of the name. {% code overflow="wrap" expandable="true" %} ``` http://checkmate.thm:5000/ ``` {% endcode %}

We retrieve the profile picture and make note of the filename. {% code overflow="wrap" expandable="true" %} ``` http://social.thm:5003/uploads/d34a569ab7aaa54dacd715ae64953455d86b768846cd0085ef4e9e7471489b7b.png ``` {% endcode %}

{% code overflow="wrap" expandable="true" %} ``` d34a569ab7aaa54dacd715ae64953455d86b768846cd0085ef4e9e7471489b7b ``` {% endcode %} We try to crack it using hashcat with mode 1400 and are successful. {% embed url="" %}

{% code overflow="wrap" expandable="true" %} ``` hashcat -a0 -m1400 'd34a569ab7aaa54dacd715ae64953455d86b768846cd0085ef4e9e7471489b7b' /usr/share/wordlists/rockyou.txt ``` {% endcode %}

We had back to the main page and provide the filename found and unlock level 5. {% code overflow="wrap" expandable="true" %} ``` http://checkmate.thm:5000/ ``` {% endcode %}

## Level 5 This time we are tasked to attack the SSH service using a predictale ruleset based on keywords and formatting. This sounds familiar to the information we found on the social media page. {% code overflow="wrap" expandable="true" %} ``` http://checkmate.thm:5000/ ``` {% endcode %}

We recall the information. {% code overflow="wrap" expandable="true" %} ``` http://social.thm:5003/ ``` {% endcode %}

We re-use our keywords list gathered via cewl from level 2. {% code overflow="wrap" expandable="true" %} ``` cewl --depth 2 --with-numbers --write cewl.txt http://jobs.thm:5002/ ``` {% endcode %}

And add a rule to john. The location for exegol is the following. {% code overflow="wrap" expandable="true" %} ``` /opt/tools/john/run/john.conf ``` {% endcode %} We add the following rule called checkmate. I takes each word from the wordlist, capitalizes the first letter `c`, appends the literal string 20 followed by a year-pattern digit range matching 2010–2029 `Az"20[1-2][0-9]"`, and appends an exclamation mark `$!.` {% code overflow="wrap" expandable="true" %} ``` [List.Rules:checkmate] c Az"20[1-2][0-9]" $! ``` {% endcode %}

Next, we run john to generate a new wordlist based on the `cewl.txt` wordlist we retrieved ealier using cewl. {% code overflow="wrap" expandable="true" %} ``` john --wordlist=cewl.txt --rules=checkmate --stdout > wordlist.txt ``` {% endcode %}

We run hydra targeting the ssh service. But our wordlist is to big it takes to long. {% code overflow="wrap" expandable="true" %} ``` hydra -l marco -P wordlist.txt checkmate.thm ssh ``` {% endcode %}

We're adjusting our rule to limit ourselves to the 2020s, thereby cutting our word list in half. {% code overflow="wrap" expandable="true" %} ``` /opt/tools/john/run/john.conf ``` {% endcode %}

{% code overflow="wrap" expandable="true" %} ``` [List.Rules:checkmate] c Az"202[0-9]" $! ``` {% endcode %}

We run hydra again with the new wordlist, after a short duration we have a hit. {% code overflow="wrap" expandable="true" %} ``` hydra -l marco -P wordlist.txt checkmate.thm ssh ``` {% endcode %}

We are able to log in as marco via SSH. {% code overflow="wrap" expandable="true" %} ``` ssh marco@checkmate.thm ``` {% endcode %}

We provide the password found to the main page and are finally done. {% code overflow="wrap" expandable="true" %} ``` http://checkmate.thm:5000/ ``` {% endcode %}