Well the dust has settled, and one winner has emerged. Out of all 5 players, only Steve Mandelbaum owned the box, and in under 2 hours. Players had to first identify the target server by scanning for available hosts and then using nmap to enumerate services. Then players had a choice between brute forcing the ssh service, or grabbing the passwd and shadow files from the anonymous FTP service, the latter resulting in a faster crack. After that, players needed to find the administrator of the system and use sudo to read the full passwd and shadow files. Finally, the root user could be cracked and full access would be granted.
We all had a good time, and I can’t wait for the next challenge!
S4 is meeting for the first time on June 10th at 6 PM, where we’ll be taking a look at a simple penetration test scenario.
Hope to see you there!
Sounds like I missed a fun and awesome event. Nice work for all who took part.
Congrats to Steve for the win!
Indeed it was an awesome, and Very informative event! Hopefully another unofficial meetup will form before the big event June 10th!
– RB