---
description: In this post we see how to solve the Tryhackme's Lookup Machine
---

# Tryhackme's Lookup Writeup

## NMAP&#x20;

We Start Off with a Usual Nmap Scan&#x20;

```
nmap -Pn -sVC -T5 -oN lookupscan.txt 10.10.220.220
```

<figure><img src="https://653470127-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoutSwFwl1Hc40pkhm1lA%2Fuploads%2FoQWpRfAHMIZagSOxqLIU%2FScreenshot%20From%202025-07-03%2020-26-07.png?alt=media&#x26;token=88cfcdb3-c48a-4692-8770-0b08791a9ed8" alt=""><figcaption><p>nmap scan </p></figcaption></figure>

We find **Port 22 and 80 Open ,** we decide to dig more with nmap scanning&#x20;

```
nmap -sV -sC -vvv 10.10.220.220 -p 22,80
```

<figure><img src="https://653470127-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoutSwFwl1Hc40pkhm1lA%2Fuploads%2FUAqXV9E0eCC9A9INORZH%2FScreenshot%20From%202025-07-03%2020-30-30.png?alt=media&#x26;token=dc396aeb-98a2-4699-b1fd-6054f4f5db1c" alt=""><figcaption><p>service and service version nmap scan </p></figcaption></figure>

We find that **Port 22 is Running SSH (Version OpenSSH 8.2p1 Ubuntu 4ubuntu0.9 (Ubuntu Linux; protocol 2.0)**&#x20;

and **Port 80 Running http (Apache httpd 2.4.41)**



**we setup hosts file using**&#x20;

```
nano /etc/hosts

10.10.220.220 lookup.thm 
```

Upon Visiting **http://lookup.thm** on our browser we see a login page&#x20;

<figure><img src="https://653470127-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoutSwFwl1Hc40pkhm1lA%2Fuploads%2F9usIuAiq85FF05mTXjME%2FScreenshot%20From%202025-07-03%2020-36-07.png?alt=media&#x26;token=7a770443-c226-4cc1-b4c9-3ba443f9a78a" alt=""><figcaption></figcaption></figure>

Looking back at our Nmap Scan and Inspecting the Page Source we know one thing is that this page is using POST method or http-post-form .

<figure><img src="https://653470127-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoutSwFwl1Hc40pkhm1lA%2Fuploads%2F4Nsm0ByXzv5b39HCR97C%2FScreenshot%20From%202025-07-04%2018-49-01.png?alt=media&#x26;token=cd95e53d-b977-4415-ae2d-4dc400c15779" alt="" width="437"><figcaption></figcaption></figure>

<figure><img src="https://653470127-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoutSwFwl1Hc40pkhm1lA%2Fuploads%2Fig7KcUBVlgSPhaBdPIBZ%2FScreenshot%20From%202025-07-04%2018-45-19.png?alt=media&#x26;token=8d3ed681-cfe3-4148-992c-003b1d7fb35c" alt="" width="341"><figcaption></figcaption></figure>

{% hint style="danger" %}
At this Point i accidentally terminated the machine , and so i was assigned a new IP ,&#x20;

Tip - Be Sure to change the same in your  <mark style="color:red;">**/etc/hosts**</mark> <mark style="color:red;"></mark> file using the following commands&#x20;

The New IP is  10.10.151.82

```
nano /etc/hosts 

10.10.151.82 lookup.thm 
```
{% endhint %}



Then We decide to Brute Force our way in using Hydra&#x20;

first we snip our password wordlist into a small chunk as most easy machines on tryhackme have the password in the first head number 15000 , we do so using the following command&#x20;

<figure><img src="https://653470127-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoutSwFwl1Hc40pkhm1lA%2Fuploads%2FNSgKvytPckjShqOsAmZS%2FScreenshot%20From%202025-07-04%2018-10-29.png?alt=media&#x26;token=f23cc9fd-d120-4831-818d-b5511133d496" alt=""><figcaption></figcaption></figure>

<mark style="color:blue;">**Link to Download the usernames\_15000\_rockyou.txt Below :-**</mark>&#x20;

{% embed url="https://limewire.com/d/vOBVj#g1pPlBfGLr" %}

<figure><img src="https://653470127-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoutSwFwl1Hc40pkhm1lA%2Fuploads%2Fi5InYNoqd8RQYr51DlVA%2FScreenshot%20From%202025-07-04%2018-06-57.png?alt=media&#x26;token=a3f2fe9d-91fd-4802-a9f5-06241114aa98" alt=""><figcaption></figcaption></figure>

<figure><img src="https://653470127-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoutSwFwl1Hc40pkhm1lA%2Fuploads%2F4XwchvBN0iI49bXUYdAc%2FScreenshot%20From%202025-07-04%2018-08-10.png?alt=media&#x26;token=71cc4af0-7890-409d-a375-9ffa706d6988" alt="" width="188"><figcaption></figcaption></figure>

{% hint style="success" %}
We get the First set of Credentials with the <mark style="color:red;">**correct Password**</mark> :-

login - admin&#x20;

password - <mark style="color:red;">**password123**</mark>
{% endhint %}

<figure><img src="https://653470127-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoutSwFwl1Hc40pkhm1lA%2Fuploads%2FJIlsqIY8SOQgGDLxJ7Pc%2FScreenshot%20From%202025-07-04%2018-13-01.png?alt=media&#x26;token=19144be8-65cb-4a66-a90f-6c7ec7be61dc" alt=""><figcaption></figcaption></figure>

<figure><img src="https://653470127-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoutSwFwl1Hc40pkhm1lA%2Fuploads%2FU8mtpxWFqw4mtZn8T4zz%2FScreenshot%20From%202025-07-04%2018-16-21.png?alt=media&#x26;token=6e6184af-1a71-4ae5-a73a-3918300385e5" alt="" width="375"><figcaption></figcaption></figure>

{% hint style="success" %}
We get the Second set of Valid Credentials with the <mark style="color:red;">**Correct Username and Password**</mark>:-&#x20;

login - <mark style="color:red;">**jose**</mark>&#x20;

password - <mark style="color:red;">**password123**</mark>
{% endhint %}
