picoCTF 2021 Solution - Wireshark twoo twooo two twoo...

Solved a CTF challenge by analyzing a packet capture file with Wireshark, identifying a substitution cipher using quipqiup, and decrypting it with CyberChef, revealing the secret message and flag.

Author cracked their first challenge on the Hackthebox platform, explored a machine called 'Meow' by using telnet, found an open port and logged in as root without a password, retrieved the contents of flag.txt, and successfully completed the challenge.

The given target is 192.168.186.23. Recon reveals open ports and services including SSH and HTTP. Dirbuster identifies directories. The main site has an admin login page. Using a hydra command, admin:admin login credentials are found. A search for exploits leads to an arbitrary file upload to RCE vulnerability. A shell is obtained. Privilege escalation is performed by upgrading the shell, running linpeas, and finding the root password. Access is gained as root. Proof.txt contains the proof.

After spawning the machine, we obtained the IP address and ran nmap to find open ports. Port 445 was running Server Message Block (SMB). Using smbclient -L command, we discovered four sharenames. We explored each share and found a text file and a flag file.

The crew hacks into an abandoned fertilizer plant's network, searching for the password to gain full access to a crucial control device.

Enumeration using netdiscover and subnet ping scan. Nmap scan reveals open ports 22/ssh, 80/http, and 33060/mysqlx. Found /secret.txt on the website.