Skip to main content

We use cookies to ensure you get the best user experience. For more information see our cookie policy.

h4cked

Find out what happened by analysing a .pcap file and hack your way back into the machine

Task 1: Oh no! We've been hacked!


Answer the questions below

  1. It seems like our machine got hacked by an anonymous threat actor. However, we are lucky to have a .pcap file from the attack. Can you determine what happened? Download the .pcap file and use Wireshark to view it.
  2. The attacker is trying to log into a specific service. What service is this?

  3. There is a very popular tool by Van Hauser which can be used to brute force a series of services. What is the name of this tool?

  4. The attacker is trying to log on with a specific username. What is the username?

  5. What is the user's password?

  6. What is the current FTP working directory after the attacker logged in?

  7. The attacker uploaded a backdoor. What is the backdoor's filename?

  8. The backdoor can be downloaded from a specific URL, as it is located inside the uploaded file. What is the full URL?
  9. Which command did the attacker manually execute after getting a reverse shell?
  10. What is the computer's hostname?

  11. Which command did the attacker execute to spawn a new TTY shell?

  12. Which command was executed to gain a root shell?

  13. The attacker downloaded something from GitHub. What is the name of the GitHub project?

  14. The project can be used to install a stealthy backdoor on the system. It can be very hard to detect. What is this type of backdoor called?

Task 2: Hack your way back into the machine


Answer the questions below

  1. Deploy the machine.

    The attacker has changed the user's password! Can you replicate the attacker's steps and read the flag.txt? The flag is located in the /root/Reptile directory. Remember, you can always look back at the .pcap file if necessary. Good luck!

  2. Run Hydra (or any similar tool) on the FTP service. The attacker might not have chosen a complex password. You might get lucky if you use a common word list.

  3. Change the necessary values inside the web shell and upload it to the webserver

  4. Create a listener on the designated port on your attacker machine. Execute the web shell by visiting the .php file on the targeted web server.

  5. Become root!

  6. Read the flag.txt file inside the Reptile directory

Room Icon

h4cked

Find out what happened by analysing a .pcap file and hack your way back into the machine

easy

45 min

37,089

User profile photo.

To access material, start machines and answer questions login.

Score updated
Score updated


Answer the questions below
It seems like our machine got hacked by an anonymous threat actor. However, we are lucky to have a .pcap file from the attack. Can you determine what happened? Download the .pcap file and use Wireshark to view it.
The attacker is trying to log into a specific service. What service is this?

There is a very popular tool by Van Hauser which can be used to brute force a series of services. What is the name of this tool?

The attacker is trying to log on with a specific username. What is the username?

What is the user's password?

What is the current FTP working directory after the attacker logged in?

The attacker uploaded a backdoor. What is the backdoor's filename?

The backdoor can be downloaded from a specific URL, as it is located inside the uploaded file. What is the full URL?
Which command did the attacker manually execute after getting a reverse shell?
What is the computer's hostname?

Which command did the attacker execute to spawn a new TTY shell?

Which command was executed to gain a root shell?

The attacker downloaded something from GitHub. What is the name of the GitHub project?

The project can be used to install a stealthy backdoor on the system. It can be very hard to detect. What is this type of backdoor called?

Set up your virtual environment

To successfully complete this room, you'll need to set up your virtual environment. This involves starting both your AttackBox (if you're not using your VPN) and Lab Machines, ensuring you're equipped with the necessary tools and access to tackle the challenges ahead.
Attacker machine
Status:Off
Lab machine
Status:Off

Answer the questions below

Deploy the machine.

The attacker has changed the user's password! Can you replicate the attacker's steps and read the flag.txt? The flag is located in the /root/Reptile directory. Remember, you can always look back at the .pcap file if necessary. Good luck!

Run Hydra (or any similar tool) on the FTP service. The attacker might not have chosen a complex password. You might get lucky if you use a common word list.

Change the necessary values inside the web shell and upload it to the webserver

Create a listener on the designated port on your attacker machine. Execute the web shell by visiting the .php file on the targeted web server.

Become root!

Read the flag.txt file inside the Reptile directory