Nebula 06 is a retro challenge. The description of the problem says “The flag06 account credentials came from a legacy unix system.” This instantly made me think to check out the password file, /etc/passwd. Back in “the old days”, unix systems stored their passwords in /etc/passwd. But due to having the passwords where everyone could see them, they ended up moving towards password shadowing, where they stored the actual passwords in /etc/shadow, but kept the same user data in /etc/passwd.
In the /etc/passwd file I found a snippet for the flag06 user, with the old-fashioned password encrypted:
To crack this, I went to my trusty BackTrack virtual machine, and ran John The Ripper against it.
root@bt:/pentest/passwords/john# echo 'flag06:ueqwOCnSGdsuM:993:993::/home/flag06:/bin/sh' > /root/flag06 root@bt:/pentest/passwords/john# ./john /root/flag06 Loaded 1 password hash (Traditional DES [128/128 BS SSE2]) hello (flag06) guesses: 1 time: 0:00:00:00 100.00% (2) (ETA: Fri Dec 2 09:51:10 2011) c/s: 7530 trying: 12345 - biteme
Thanks go john, I now know the flag06 password is “hello”. So I ssh locally, and run “getflag” to complete the challenge.
level06@nebula:/home/flag06$ ssh flag06@localhost _ __ __ __ / | / /__ / /_ __ __/ /___ _ / |/ / _ \/ __ \/ / / / / __ `/ / /| / __/ /_/ / /_/ / / /_/ / /_/ |_/\___/_.___/\__,_/_/\__,_/ exploit-exercises.com/nebula For level descriptions, please see the above URL. To log in, use the username of "levelXX" and password "levelXX", where XX is the level number. Currently there are 20 levels (00 - 19). flag06@localhost's password: Welcome to Ubuntu 11.10 (GNU/Linux 3.0.0-12-generic i686) * Documentation: https://help.ubuntu.com/ Last login: Fri Dec 2 06:51:34 2011 from localhost flag06@nebula:~$ getflag You have successfully executed getflag on a target account
There you have it. Level 06 complete, with a warm and fuzzy look back in history.