# TryHackMe Network Services 2 Room: Comprehensive Learning Guide & Deep Dive ## Introduction I recently completed the **Network Services 2** room on TryHackMe as part of my ongoing cybersecurity learning journey. While foundational network security focuses on standard web traffic and firewalls, infrastructure targets often rely on core network protocols to function across internal subnets. This room builds on network enumeration fundamentals by diving deep into common misconfigurations present in NFS, SMTP, and MySQL services. Exploring these services from both an offensive and defensive posture illustrates how slight administrative oversight—such as weak root-squashing configurations or unauthenticated enumeration parameters—can lead directly to initial access or local privilege escalation. In this room, I learned about: * Network File System (NFS) architecture, enumeration, and root-squashing misconfigurations * Simple Mail Transfer Protocol (SMTP) operations, user enumeration via VRFY/EXPN, and credential attacks * MySQL relational database architecture, manual SQL service interaction, and local file access * Root privilege escalation vectors originating from misconfigured network shares * Defensive hardening controls and SOC monitoring artifacts for internal service protocol abuse > **Note:** This blog post is an educational learning summary. In compliance with TryHackMe policies and ethical guidelines, it contains no direct flag answers, raw passwords, or walkthrough exploit solutions. ## Room Information

Category

Details

Platform

TryHackMe

Room

Network Services 2

Difficulty

Easy / Medium

Learning Type

Infrastructure Security & Network Protocol Exploitation

Focus Area

Network File System (NFS), SMTP Mail Server, MySQL Database Security

Estimated Time

60 minutes

Status

Completed (100%)

Blog Type

Deep-Dive Educational Notes

## Overview of Protocol Technologies ### 1\. Network File System (NFS) NFS allows a system to share directories and files with others over a network. Client machines mount remote file systems locally and interact with them as if they resided on local storage. NFS typically operates on **Port 2049**, alongside **Port 111 (RPCBind)** to translate RPC program numbers into universal addresses. ### 2\. Simple Mail Transfer Protocol (SMTP) SMTP handles email delivery across IP networks, operating by default on **Port 25** (unencrypted) or **Port 465/587** (encrypted). Beyond transferring messages, legacy or misconfigured SMTP servers allow attackers to enumerate valid local system users using built-in command verbs. ### 3\. MySQL Database MySQL is a widely used relational database management system operating on **Port 3306**. When exposed externally with weak administrative credentials or misconfigured file privileges, it provides an entry point for data exfiltration or host takeover. ## Task Breakdown & Learning Highlights ### Task 1: Get Connected Establishing the lab environment connection using OpenVPN/AttackBox and validating target connectivity. * **What This Task Teaches:** Ensuring clean routing to the target IP address before initializing network scans. * **Key Learning:** Environment verification reduces anomalous scan failures during multi-service enumeration. * **Key Takeaway:** Always verify client-to-target connectivity before beginning active testing. ### Tasks 2, 3 & 4: Understanding, Enumerating, and Exploiting NFS Examining NFS share configurations and leveraging root-squashing misconfigurations for local root escalation. * **What This Task Teaches:** * Using `showmount -e ` or Nmap RPC scripts (`nmap -p 2049 --script nfs-showmount`) to identify exported directories. * Understanding **Root Squashing** (`root_squash` vs. `no_root_squash`). By default, NFS maps `root` access on client mounts to the unprivileged `nobody` account. When `no_root_squash` is set on a writable export, files created as `root` on the client retain root privileges on the server. * **Key Learning:** Mount a vulnerable NFS share, generate an executable binary (or copy `/bin/bash`), assign SUID permissions (`chmod +s`), and execute it on the target host to escalate to root. * **Key Takeaway:** `no_root_squash` on writable shares creates a direct path to total root compromise. ### Tasks 5, 6 & 7: Understanding, Enumerating, and Exploiting SMTP Interacting with mail transport agents to gather system context and gain unauthorized access. * **What This Task Teaches:** * Enumerating active system users via SMTP commands (`VRFY`, `EXPN`, or `RCPT TO`) manually or via automated tools like `smtp-user-enum`. * Using valid enumerated usernames to conduct targeted password attacks against available remote access protocols (such as SSH). * **Key Learning:** Mail servers that respond to verification queries provide attackers with high-accuracy user lists without triggering lockouts. * **Key Takeaway:** Disable account verification commands on production mail servers to prevent internal user mapping. ### Tasks 8, 9 & 10: Understanding, Enumerating, and Exploiting MySQL Interacting directly with MySQL databases to extract records and evaluate host interaction capabilities. * **What This Task Teaches:** * Scanning Port 3306 with Nmap scripts (`nmap -p 3306 --script mysql-info,mysql-enum`). * Logging into MySQL via command-line clients (`mysql -u -p -h `) using discovered credentials. * Querying database tables, dumping hashes, and understanding file system read/write directives (`SELECT ... INTO OUTFILE` or `LOAD_FILE()`). * **Key Learning:** Exposed databases with weak credentials leak sensitive application data and can grant remote code execution if the database daemon runs under elevated system privileges. * **Key Takeaway:** Databases must never be directly exposed to the public internet; they should strictly listen on localhost or internal network segments. ### Task 11: Further Learning Summarizing protocol-level security and recommending continued practice across internal infrastructure security. ## Defensive & SOC Analyst Perspective From a Blue Team perspective, monitoring internal infrastructure protocols requires continuous logging and strict configuration auditing: 1. **NFS Hardening:** * **Control:** Enforce `root_squash` on all exported directories in `/etc/exports`. * **Log Artifacts:** Audit mount requests in system logs (`/var/log/syslog` or systemd journal) and monitor for unauthorized SUID binary creations on shared drives. 2. **SMTP Defense:** * **Control:** Disable `VRFY` and `EXPN` in mail server configurations (e.g., `disable_vrfy_command = yes` in Postfix). * **Log Artifacts:** Monitor mail logs for high-volume verification commands originating from a single IP address within short timeframes. 3. **MySQL Hardening:** * **Control:** Bind MySQL strictly to `127.0.0.1` unless remote database access is explicitly required, and restrict file system permissions using `secure_file_priv`. * **Log Artifacts:** Review MySQL authentication logs (`/var/log/mysql/error.log`) for repeated failed login attempts (Event ID/Error 1045). ## What I Learned * **Root Squashing Vulnerabilities:** How `no_root_squash` settings on NFS mounts allow local root escalation via SUID binary manipulation. * **Protocol-Based Reconnaissance:** Leveraging SMTP verbs (`VRFY`/`EXPN`) to harvest valid system accounts. * **Database Threat Vectors:** The security implications of exposing database management systems directly to public/untrusted networks. * **Defense-in-Depth:** The importance of binding services to local interfaces and auditing network file share permissions. ## Conclusion Completing the **Network Services 2** room highlighted how essential default service configurations are to overall system security. By understanding how attackers manipulate NFS shares, SMTP user verification, and database connections, security professionals can better audit internal networks, enforce hardening standards, and protect core assets. As I continue my cybersecurity journey, I will keep sharing detailed learning write-ups and notes to document my progress and support the community. ## Resources * 🌐 **TryHackMe Room:** [Network Services 2](https://tryhackme.com/room/networkservices2) * 👨‍💻 **TryHackMe Profile:** [sunnysharma11200](https://tryhackme.com/p/sunnysharma11200) * 💻 **GitHub Repository:** [tryhackme-writeups](https://github.com/SunnySharma04/tryhackme-writeups) * ✍️ **Hashnode Blog:** [cybersecurity-learning.hashnode.dev](http://cybersecurity-learning.hashnode.dev) * 📘 **NIST Guide to General Server Security:** [NIST SP 800-123](https://www.google.com/search?q=https://csrc.nist.gov/publications/detail/sp/800-123/final) ## Connect with Me If you are exploring network infrastructure security or working through TryHackMe paths, let's connect! * **TryHackMe:** [sunnysharma11200](https://tryhackme.com/p/sunnysharma11200) * **GitHub:** [SunnySharma04](https://github.com/SunnySharma04/tryhackme-writeups) * **Hashnode:** [cybersecurity-learning](https://cybersecurity-learning.hashnode.dev/) * **LinkedIn:** [Sunny Sharma](https://www.linkedin.com/in/sunny-sharma-2487312a7/) *Happy Learning!*