Lian_Yu
Task 1: Find the Flags
Deploy the VM and Start the Enumeration.
No answer needed
What is the Web Directory you found?
We can scan the target machine using
nmap.
There are four open ports:
21
ftp
22
ssh
80
http
111
rcpbind
Let's use
gobusterto brute force the web pages.
Let's go to the
/islandwebpage.
We can view the page source using
CTRL+U.
So the username is
vigilante.For now, let's conduct a
gobusterscan on/island/using another list.
Answer
what is the file name you found?
Let's visit the
/island/2100page and check it's source.
Now that we know the file extension is
.ticket, we can perform anothergobusterscan.
Answer
what is the FTP password?
Let's visit the
/island/2100/green_arrow.ticketpage.
Let's decode the string using Cyberchef.
So the FTP password is
!#th3h00d.
Answer
what is the file name with SSH password?
We can now use
vigilanteas the username and!#th3h00das the password to login through FTP.
Let's look around for important files.
We can download these files to our machine using the
getcommand.
Let's check out the images.
We can see that the
Leave_me_alone.pngfile is not working properly.Let's check its hash dump.
So the first 8 characters are wrong. In a PNG file the first 8 characters should be
89 50 4E 47 0D 0A 1A 0Aas shown in this image:
Let's use
hexeditto fix the bytes.
The password for something is
password.Let's now extract the file in
aa.jpgusing this password.
We can now
unzipthe ZIP file.
Let's read the
shadofile.
Answer
user.txt
We also downloaded the
.other_userfile from the FTP server. Let's read that.
So it seems like
M3tahumanis the password for the userslade.Let's try it out.
Let's get the flag inside
user.txt.
Answer
root.txt
Let's check what commands
sladecan execute withsudo.
We can go to GTFOBins to find an exploit.
We can now get the root flag.
Answer
Last updated
Was this helpful?