Skip to main content

We use cookies to ensure you get the best user experience. For more information see our cookie policy.

Nax

Identify the critical security flaw in the most powerful and trusted network monitoring software on the market, that allows an user authenticated execute remote code execution.

Task 1: Flag


Are you able to complete the challenge?
The machine may take up to 5 minutes to boot and configure
Note: This room requires Metasploit 6.

Answer the questions below

  1. What hidden file did you find?

  2. Who is the creator of the file?

  3. If you get an error running the tool on your downloaded image about an unknown ppm format -- open it with gimp or another paint program and export to ppm format, and try again!

  4. What is the username you found?

  5. What is the password you found?

  6. What is the CVE number for this vulnerability? This will be in the format: CVE-0000-0000

  7. Now that we've found our vulnerability, let's find our exploit. For this section of the room, we'll use the Metasploit module associated with this exploit. Let's go ahead and start Metasploit using the command `msfconsole`.

  8. After Metasploit has started, let's search for our target exploit using the command 'search applicationame'. What is the full path (starting with exploit) for the exploitation module?

  9. Compromise the machine and locate user.txt

  10. Locate root.txt