Skip to main content

Over the Wire - Leviathan 0

leviathan 0

Objectives
ok so the website supplies us with the user pass for level 0
leviathan0 for both

Solution
let's ssh over to it and see what we see

ssh leviathan0@leviathan.labs.overthewire.org -p 2223


Let's see whats in the home directory

leviathan0@leviathan:~$ lsleviathan0@leviathan:~$ 


Nothing, nothing is in the home direcorty.... or is there let's try ls -a

leviathan0@leviathan:~$ ls -a.  ..  .backup  .bash_logout  .bashrc  .profile


OOOO there is a hidden directory named backup lets see whats in there

leviathan0@leviathan:~$ ls -a .backup.  ..  bookmarks.html


a file called bookmarks let's see what kind of file it is

leviathan0@leviathan:~$ file ./.backup/bookmarks.html./.backup/bookmarks.html: HTML document, ASCII text, with very long lines


here is some of cat output of the file

<DT><A HREF="http://www.goshen.edu/art/DeptPgs/Hazards.html" ADD_DATE="1117951366" LAST_CHARSET="ISO-8859-1" ID="90799910">Hazards Working with Ceramics</A><DT><A HREF="http://www.goshen.edu/art/DeptPgs/clean.html" ADD_DATE="1131845742" LAST_CHARSET="ISO-8859-1" ID="77067758"><span style="font-family: times new roman,times,serif;"><span style="text-decoration: underline;">Working and Cleaning with less dust</span></span></A><DT><A HREF="http://www.goshen.edu/art/ed/help.html" ADD_DATE="1140391108" LAST_CHARSET="ISO-8859-1" ID="40227805">Advocate Link Page</A><DT><A HREF="http://www.goshen.edu/art/ed/advocacyletter.html" ADD_DATE="1130547887" LAST_CHARSET="ISO-8859-1" ID="74590933">A letter to an administrator</A><DT><A HREF="http://www.goshen.edu/art/ed/honey.html" ADD_DATE="1117091302" LAST_CHARSET="ISO-8859-1" ID="22513777">Successful Third Grade</A>




as you might expect it has a bunch of bookmark info in it... let's search it for the user name for the next level to see if maybe password is in this file

leviathan0@leviathan:~/.backup$ grep leviathan1 bookmarks.html<DT><A HREF="http://leviathan.labs.overthewire.org/passwordus.html | This will be fixed later, the password for leviathan1 is rioGegei8m" ADD_DATE="1155384634" LAST_CHARSET="ISO-8859-1" ID="rdf:#$2wIU71">password to leviathan1</A>




There we go the password for level 1 is rioGegei8m
Labels:

Comments

Post a Comment

Popular posts from this blog

HacktheBox - Retired - Frolic

HacktheBox - Retired - Frolic Recon Let's start out with a threader3000 scan Some interesting results here Port 22 and 445 aren't uncommon… but 1880 and 9999 are.. Let's let nmap run through these ports  Option Selection: 1 nmap -p22,445,1880,9999 -sV -sC -T4 -Pn -oA 10.10.10.111 10.10.10.111 Host discovery disabled (-Pn). All addresses will be marked 'up' and scan times will be slower. Starting Nmap 7.91 ( https://nmap.org ) at 2021-05-05 16:17 EDT Nmap scan report for 10.10.10.111 Host is up (0.060s latency). PORT     STATE SERVICE     VERSION 22/tcp   open  ssh         OpenSSH 7.2p2 Ubuntu 4ubuntu2.4 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: |   2048 87:7b:91:2a:0f:11:b6:57:1e:cb:9f:77:cf:35:e2:21 (RSA) |   256 b7:9b:06:dd:c2:5e:28:44:78:41:1e:67:7d:1e:b7:62 (ECDSA) |_  256 21:cf:16:6d:82:a4:30:c3:c6:9c:d7:38:ba:b5:02:b0 (ED25519) 445/tcp  open  netbios-ssn Samba smbd 4.3.11-Ubuntu (workgroup: WORKGROUP) 1880/tcp open  http        Node.js (Express middlewar...
Post a Comment
Read more

Hack The Box - Retired - Laboratory

HackTheBox - Laboratory - Retired Starting off with a quick scan using threader6000 /opt/threader3000/threader6000.py 10.10.10.216 Ports 22,80,443 came back. Run nmap against these ports. nmap -p22,80,443 -sV -sC -T4 -Pn -oN 10.10.10.216 10.10.10.216 nmap -p22,80,443 -sV -sC -Pn -T4 -oN 10.10.10.216 10.10.10.216 Host discovery disabled (-Pn). All addresses will be marked 'up' and scan times will be slower. Starting Nmap 7.91 ( https://nmap.org ) at 2021-04-13 17:43 EDT Nmap scan report for laboratory.htb (10.10.10.216) Host is up (0.060s latency). PORT    STATE SERVICE  VERSION 22/tcp  open  ssh      OpenSSH 8.2p1 Ubuntu 4ubuntu0.1 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: |   3072 25:ba:64:8f:79:9d:5d:95:97:2c:1b:b2:5e:9b:55:0d (RSA) |   256 28:00:89:05:55:f9:a2:ea:3c:7d:70:ea:4d:ea:60:0f (ECDSA) |_  256 77:20:ff:e9:46:c0:68:92:1a:0b:21:29:d1:53:aa:87 (ED25519) 80/tcp  open  http     Apache httpd 2.4.41 |_...
Post a Comment
Read more

A collection of online Security CTF and Learning sites

 Hellbound Hackers    Embedded Security CTF Arizona Cyber Warfare Range Over The Wire - Bandit Pico CTF 2018 Hack The Box.eu Root Me: Challenges/Forensic RingZero CTF Vulnerable By Design - Vulnerable VMs Murder Mystery SQL Challenge Incident Response Challenge Authentication Lab Walkthroughs Defcon CTF Archives Matrix Holiday Hack Cyber Defenders | Blue Team and CTF Crypto Hack - learning Crypto Video Learning Zero to Hero Pentesting by The Cyber Mentor
Post a Comment
Read more