# Meow (Tier 0)

## <mark style="color:blue;">Description</mark>

* **Tier&#x20;**<mark style="color:green;">**->**</mark> 0
* **Difficult** <mark style="color:green;">**->**</mark> Very Easy
* **OS** <mark style="color:green;">**->**</mark> Linux
* **Tags&#x20;**<mark style="color:green;">**->**</mark> Telnet / Protocols / Reconnaissance / Weak Credentials / Misconfiguration

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FHhzKFfGmKxkiMdyXro1p%2Fimage.png?alt=media&#x26;token=d75141e7-ed12-481f-a0b7-58f942386bfa" alt=""><figcaption><p><a href="https://app.hackthebox.com/starting-point?tier=0">https://app.hackthebox.com/starting-point?tier=0</a></p></figcaption></figure>

## <mark style="color:blue;">Write-up</mark>

* With a little research, I started answering the first questions&#x20;

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FjrLPF35U6N3L0ImECsG3%2Fimage.png?alt=media&#x26;token=723fb9e9-6be0-429e-b25a-62046b261277" alt=""><figcaption></figcaption></figure>

> Answer: _**Virtual Machine**_

***

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FJkwlhjqVnDAM2axVIwdI%2Fimage.png?alt=media&#x26;token=b2b23890-c2ec-4e24-b9f4-ce52ccfeb753" alt=""><figcaption></figcaption></figure>

> Answer: _**Terminal**_

***

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FIrf3bUjmMfnkoVsu7k9p%2Fimage.png?alt=media&#x26;token=5a30bd80-308a-442e-8051-f5a57c02156b" alt=""><figcaption></figcaption></figure>

> Answer: _**openvpn**_

***

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2F3A9CzsTsYNDQJAIwhDbE%2Fimage.png?alt=media&#x26;token=39489356-51a7-4185-a767-55b0abfaed9d" alt=""><figcaption></figcaption></figure>

> Answer: _**ping**_

***

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FaCuIujYLMcjsOpTO5Ozk%2Fimage.png?alt=media&#x26;token=d65a146d-cb0e-4733-88bb-d82e54ec8cf1" alt=""><figcaption></figcaption></figure>

> Answer: _**nmap**_

***

* Then I continued doing an initial port scan of the machine using [_Nmap_](../../../networks/tools-and-utilities#nmap)

<pre class="language-bash" data-line-numbers><code class="lang-bash"><strong>nmap 10.129.54.192 -p- -Pn --min-rate 2000
</strong></code></pre>

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2Fmsg45pulst7VQdlbVJBS%2Fimage.png?alt=media&#x26;token=6597fff1-9b82-41f3-87ff-7e9aadf495ac" alt=""><figcaption></figcaption></figure>

***

* With this, I answered the next question

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FMSAzu2XcnxYF836Y6Lur%2Fimage.png?alt=media&#x26;token=d1ae9f65-8088-4081-9e54-123d30294aa3" alt=""><figcaption></figcaption></figure>

> Answer: _**telnet**_

***

* Then I did an exhaustive scan to get information on the services running on the found ports

<pre class="language-bash" data-line-numbers><code class="lang-bash"><strong>nmap 10.129.54.192 -p23 -sVC
</strong></code></pre>

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FpilJVs2RWAfAAJA5OO40%2Fimage.png?alt=media&#x26;token=bc8e1176-62f3-45cd-9570-a53ba0e89a12" alt=""><figcaption></figcaption></figure>

***

* I found a port running the Telnet protocol, so I tried to connect through this protocol using common credentials. When using _root_ as username to log in, I fortunately gained access without being asked for a password

{% code lineNumbers="true" %}
```bash
telnet 10.129.54.192
```
{% endcode %}

<div align="center" data-full-width="false"><figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2Fqpb6S1A8ST3kncdGLqCX%2Fimage.png?alt=media&#x26;token=f002b24e-4086-4b10-9490-e63c00dc25c5" alt=""><figcaption></figcaption></figure></div>

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FExAK6PzqL0cZVnLoOGA1%2Fimage.png?alt=media&#x26;token=9e12c293-eda2-420f-b5bb-606009d9b71d" alt=""><figcaption></figcaption></figure>

{% hint style="success" %}
To learn more about the Telnet protocol, you can go [here](../../networks/protocols/telnet)
{% endhint %}

***

* With this, I answered the next question

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FGqT14nN73bznn9tZonea%2Fimage.png?alt=media&#x26;token=0edfd8be-4ac1-4ddc-ba1b-a68cc28a3ee4" alt=""><figcaption></figcaption></figure>

> Answer: _**root**_

***

* Once inside, I checked the files in the folder I was in and found a _flag.txt_ file, and reading its content, I retrieved the root flag

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FOZn8DEf0e714PAHfqZF9%2Fimage.png?alt=media&#x26;token=4eecd151-2670-438d-a3aa-833573cb3063" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FE2AmHhYqhEzwcvVwX3Ga%2Fimage.png?alt=media&#x26;token=cc112582-0caf-4a1d-8ebd-e73518942c05" alt=""><figcaption></figcaption></figure>

***

* With this, I got the root flag and pwned the machine

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FAJNJA9zQa10PurMdoG1I%2Fimage.png?alt=media&#x26;token=4807d32b-9f75-4295-9941-054c33325e9e" alt=""><figcaption></figcaption></figure>

> Answer: _**b40abdfe23665f766f9c61ecba8a4c19**_
