Skip to main content

We use cookies to ensure you get the best user experience. For more information see our cookie policy.

Badbyte

Infiltrate BadByte and help us to take over root.

Task 1: Deploy the machine

Deploy The VM.

Answer the questions below

  1. Wait 2-3 minutes for the VM to boot up.

Task 2: Reconnaissance



Nmap is a free open source tool, employed to discover hosts and services on a computer network by sending packets and analyzing the retrieved responses. In this task  nmap will be used to enumerate open ports and what services are running on machine. Check out the Nmap room for more on this!


Nmap Flag
Example
Description
-pnmap -p 21 MACHINE_IPPort scan for port 21
-p-

nmap  -p- MACHINE_IP

Port scan all ports

-Pnnmap  -Pn MACHINE_IPDisable host discovery. Port scan only.
-Anmap  -A MACHINE_IP

Enables OS detection, version detection, script scanning, and traceroute

-sC
nmap -sC MACHINE_IPScan with default NSE scripts. Considered useful for discovery and safe
-sV
nmap -sV MACHINE_IP

Attempts to determine the version of the service running on port

-v
nmap -v[-vv] MACHINE_IPIncrease the verbosity level (use -vv or more for greater effect)
-oA
nmap MACHINE_IP -oA nmap_ouput
Output in the three major formats at once
--script

nmap --script http-sql-injection MACHINE_IP

Scan with a single script. Example checks for sql injections
--script-args

--script-args

nmap --script snmp-sysdescr --script-args snmpcommunity=admin MACHINE_IP

NSE script with arguments




In this task:

  1.  First scan which ports are open on the box: nmap -p-  -vv MACHINE_IP
  2.  Then after finding the ports number, enumerate what services are running on those port:
    nmap -A -p port1,port2,port3 MACHINE_IP

Answer the questions below

  1. How many ports are open?

  2. What service is running on the lowest open port?
  3. What non-standard port is open?
  4. What service is running on the non-standard port?

Task 3: Foothold


John the Ripper is an Open Source password security auditing and password recovery tool available for many operating systems.

Check out the Crackthehash or Crackthehash2 for more hash cracking.

To crack ssh private key first use ssh2john python script convert private key to hash (It comes with Kali Linux. Run locate ssh2john).

python path/to/ssh2john.py privatekey > privatekey.hash

Then use john to crack the hash.

john privatekey.hash -w=/path/to/wordlist

Crack the passphrase of the private key and SSH into the machine. Make sure to change the file permissions of SSH private key to 600.

Answer the questions below

  1. What username do we find during the enumeration process?

  2. What is the passphrase for the RSA private key?

Task 4: Port Forwarding

According to Wikipedia SSH or Secure Shell is a cryptographic network protocol for operating network services securely over an unsecured network. Typical applications include remote command-line, login, and remote command execution, but any network service can be secured with SSH.

Some important flags that will be used in this task are below.


Flag
Description
-i
If you want to access a remote server using a private key.
-L
For local port forwarding. Followed by 
local_port:remote_address:remote_port
-R
For remote port forwarding. Followed by 
port:local_address:local_port
-D

For Dynamic port forwarding. Creates a socks proxy on localhost. Followed by 

local_PORT

-N
Do not execute a remote command.  This is useful for just forwarding ports

In the above picture the user from blue server wants to connect to port 80 on the red server but the port is blocked by the firewall. User can connect through ssh and create a tunnel which would allow him to connect to port 80 on the red server. In this case user can use Local port forwarding to connect the port on the red server to his local machine.

To complete this task:

  1. Setup Dynamic Port Forwarding using SSH.
    HINT: -i id_rsa -D 1337
  2. Set up proxychains for the Dynamic Port Forwarding. Ensure you have commented out socks4 127.0.0.1 9050 in your proxychains configuration and add socks5 127.0.0.1 1337 to the end of configuration file (/etc/proxychains.conf).
    The file name may vary depending on the distro you are using.

  3. Run a port scan to enumerate internal ports on the server using proxychains. If you use Nmap your command should look like this proxychains nmap -sT 127.0.0.1 .
  4. After finding the port of the webserver, perform Local Port Forwarding to that port using SSH with the -L flag.
    HINT: -i id_rsa -L 80:127.0.0.1:(remote port) (Try using with sudo)

Answer the questions below

  1. What main TCP ports are listening on localhost?
  2. What protocols are used for these ports?

Task 5: Web Exploitation


Use nmap to scan for the vulnerability in the CMS that is running on the webserver. Nmap has a script that can find vulnerabilities in the CMS which used in this machine.

Now that you have locally forwarded the port, the webserver is running on localhost and you can access it from your browser.

In this task:

  1. Scan the internal web server and find vulnerable plugins using Nmap or the popular scanning tool for this CMS.
  2. Exploit the vulnerability either using metasploit or following any POC(proof of concept).
  3. Get the user flag.

Answer the questions below

  1. What CMS is running on the machine?

  2. Can you find any vulnerable plugins?

  3. What is the CVE number for directory traversal vulnerability?

  4. What is the CVE number for remote code execution vulnerability?

  5. There is a metasploit module for the exploit. You can use it to get the reverse shell. If you are feeling lucky you can follow any POC( Proof of Concept).

  6. What is the name of user that was running CMS?

  7. What is the user flag?

Task 6: Privilege Escalation


Passwords are a pretty simple concept and can be an effective way of protecting sensitive information. Ensuring that only people who know the "secret code" have access to a given resource helps to raise the bar
 for attackers attempting to gain illegitimate access.  Passwords can 
definitely be lost or stolen though, especially when they are poorly 
protected.
Sometimes the user may reuse the same password or they slightly change their password after a data breach. For example they may change it from "Goodpassword2019" to "Goodpassword2020" or from "Autumn20!" to "Spring20!". If the attacker get hands on the old database dump of the company and find pattern in the passwords used, the attacker can guess the correct password.
In this task:
  1. Find that user has left password somewhere accidentally. Management now requires SSH sessions to be logged.
  2. Guess the user's new password.
  3. Get the root flag.

 ________________________
< Made with ❤ by BadByte >
 ------------------------
        \   ^__^
         \  (oo)\_______
            (__)\       )\/\
                ||----w |
                ||     ||
Answer the questions below
  1. What is the user's old password?
  2. What is the root flag?
Back to all walkthroughs
Room Icon
Badbyte
Infiltrate BadByte and help us to take over root.
easy
45 min
12,234
User profile photo.
User profile photo.
To access material, start machines and answer questions login.
Set up your virtual environment
To successfully complete this room, you'll need to set up your virtual environment. This involves starting both your AttackBox (if you're not using your VPN) and Lab Machines, ensuring you're equipped with the necessary tools and access to tackle the challenges ahead.
Attacker machine
Status:Off
Lab machine
Status:Off
Deploy The .
Answer the questions below
Wait 2-3 minutes for the VM to boot up.


 is a free open source tool, employed to discover hosts and 
services on a computer network by sending packets and analyzing the 
retrieved responses. In this task  nmap will be used to enumerate open ports and what services are running on machine. Check out the Nmap room for more on this!

Nmap Flag
Example
Description
-pnmap -p 21 MACHINE_IPPort scan for port 21
-p-
 nmap  -p- MACHINE_IP
 Port scan all ports 
-Pnnmap  -Pn MACHINE_IPDisable host discovery. Port scan only.
-Anmap  -A MACHINE_IP
 Enables OS detection, version detection, script scanning, and traceroute 
-sC
nmap -sC MACHINE_IPScan with default NSE scripts. Considered useful for discovery and safe
-sV
nmap -sV MACHINE_IP
 Attempts to determine the version of the service running on port
-v
nmap -v[-vv] MACHINE_IPIncrease the verbosity level (use -vv or more for greater effect)
-oA
nmap MACHINE_IP -oA nmap_ouput
Output in the three major formats at once 
--script
nmap --script http-sql-injection MACHINE_IP
Scan with a single script. Example checks for  injections
--script-args
--script-args
nmap --script snmp-sysdescr --script-args snmpcommunity=admin MACHINE_IP
NSE script with arguments




In this task:
  1.  First scan which ports are open on the box: nmap -p-  -vv MACHINE_IP
  2.  Then after finding the ports number, enumerate what services are running on those port:
    nmap -A -p port1,port2,port3 MACHINE_IP
Answer the questions below
How many ports are open?
What service is running on the lowest open port?
What non-standard port is open?
What service is running on the non-standard port?

 is an Open Source password security auditing and password recovery tool available for many operating systems.
Check out the Crackthehash or Crackthehash2 for more hash cracking.
To crack  private key first use ssh2john python script convert private key to hash (It comes with Kali . Run locate ssh2john). 
python path/to/ssh2john.py privatekey > privatekey.hash
Then use john to crack the hash.
john privatekey.hash -w=/path/to/wordlist
Crack the passphrase of the private key and SSH into the machine. Make sure to change the file permissions of SSH private key to 600.
Answer the questions below
What username do we find during the enumeration process?
What is the passphrase for the RSA private key?
According to Wikipedia  or Secure Shell is a cryptographic network protocol for operating network services securely over an unsecured network. Typical applications include remote command-line, login, and remote command execution, but any network service can be secured with SSH.
Some important flags that will be used in this task are below.

Flag
Description
-i 
If you want to access a remote server using a private key.
-L
For local port forwarding. Followed by 
local_port:remote_address:remote_port
-R
For remote port forwarding. Followed by 
port:local_address:local_port
-D 
For Dynamic port forwarding. Creates a socks  on localhost. Followed by 
local_PORT
 
-N
Do not execute a remote command.  This is useful for just forwarding ports
In the above picture the user from blue server wants to connect to port 80 on the red server but the port is blocked by the . User can connect through ssh and create a tunnel which would allow him to connect to port 80 on the red server. In this case user can use Local port forwarding to connect the port on the red server to his local machine.
To complete this task:
  1. Setup Dynamic Port Forwarding using SSH.
    HINT: -i id_rsa  -D 1337 
  2. Set up proxychains for the Dynamic Port Forwarding. Ensure you have commented out socks4 127.0.0.1 9050 in your proxychains configuration and add socks5 127.0.0.1 1337 to the end of configuration file (/etc/proxychains.conf).
    The file name may vary depending on the distro you are using.

  3. Run a port scan to enumerate internal ports on the server using proxychains. If you use Nmap your command should look like this proxychains nmap -sT 127.0.0.1 .
  4. After finding the port of the webserver, perform Local Port Forwarding to that port using SSH with the -L flag.
    HINT: -i id_rsa -L 80:127.0.0.1:(remote port) (Try using with sudo)
Answer the questions below
What main TCP ports are listening on localhost?
What protocols are used for these ports?

Use nmap to scan for the vulnerability in the  that is running on the webserver.  has a script that can find vulnerabilities in the CMS which used in this machine.
Now that you have locally forwarded the port, the webserver is running on localhost and you can access it from your browser.
In this task:
  1. Scan the internal web server and find vulnerable plugins using Nmap or the popular scanning tool for this CMS.
  2. Exploit the vulnerability either using  or following any (proof of concept).
  3. Get the user flag.
Answer the questions below
What CMS is running on the machine?
Can you find any vulnerable plugins?
What is the CVE number for directory traversal vulnerability?
What is the CVE number for remote code execution vulnerability?
There is a metasploit module for the exploit. You can use it to get the reverse shell. If you are feeling lucky you can follow any POC( Proof of Concept).
What is the name of user that was running CMS?
What is the user flag?

Passwords are a pretty simple concept and can be an effective way of protecting sensitive information. Ensuring that only people who know the "secret code" have access to a given resource helps to raise the bar
 for attackers attempting to gain illegitimate access.  Passwords can 
definitely be lost or stolen though, especially when they are poorly 
protected.
Sometimes the user may reuse the same password or they slightly change their password after a data breach. For example they may change it from "Goodpassword2019" to "Goodpassword2020" or from "Autumn20!" to "Spring20!". If the attacker get hands on the old database dump of the company and find pattern in the passwords used, the attacker can guess the correct password.
In this task:
  1. Find that user has left password somewhere accidentally. Management now requires  sessions to be logged.
  2. Guess the user's new password.
  3. Get the root flag.

 ________________________
< Made with ❤ by BadByte >
 ------------------------
        \   ^__^
         \  (oo)\_______
            (__)\       )\/\
                ||----w |
                ||     ||


Answer the questions below
What is the user's old password?
What is the root flag?