TryHackMe — Advent of Cyber 2023 Day 3

Hydra is Coming to Town

Counting the PIN Codes

PIN codes are used to authenticate users. Take an ATM, a customer is withdrawing money from their checking account, and they have to enter a four-digit PIN to complete the transaction. How many different PIN codes can there be? Since there’s ten numerical options and four necessary values, 10x10x10x10 = 10,000 different combinations.

Let’s Break Our Way In

The keypad shows 16 characters, 0 to 9 and A to F. We will use Crunch to generate a list of all possible password combinations.

$ crunch 3 3 0123456789ABCDEF -o 3digits.txt

• 3 the first number is the minimum length of the generated password
• 3 the second number is the maximum length of the generated password
• 0123456789ABCDEF is the character set to use to generate the passwords
• -o 3digits.txt saves the output to the 3digits.txt file

The main login page http://10.10.3.183:8000/pin.php receives the input from the user and sends it to /login.php using the name pin.

Use hydra to brute force the password.

$ hydra -l ‘’ -P 3digits.txt -f -v 10.10.3.183 http-post-form “/login.php:pin=^PASS^:Access denied” -s 8000

• -l '' indicates that the login name is blank as the security lock only requires a password
• -P 3digits.txt specifies the password file to use
• -f stops Hydra after finding a working password
• -v provides verbose output and is helpful for catching errors
• 10.10.3.183 is the IP address of the target
• http-post-form specifies the HTTP method to use
• "/login.php:pin=^PASS^:Access denied" has three parts separated by :
• /login.php is the page where the PIN code is submitted
• pin=^PASS^ will replace ^PASS^ with values from the password list
• Access denied indicates that invalid passwords will lead to a page that contains the text “Access denied”
• -s 8000 indicates the port number on the target

Enter the correct PIN and unlock the server room door.