Climb through the Looking Glass and capture the flags.
Enumeration
IP: 10.10.104.169
threader3000 scan:
huhh, This seems to be raining down open ports, :-; just gonna drop a ss and run suggested nmap scan.
1
nmap -p22,9000,9003,9004,9005,9007,9006,9001,9022,9002,9011,9013,9016,9012,9010,9017,9008,9020,9014,9009,9015,9025,9027,9024,9023,9021,9030,9019,9029,9018,9031,9032,9045,9026,9034,9041,9047,9050,9040,9065,9028,9039,9033,9053,9055,9068,9035,9059,9048,9038,9042,9036,9052,9051,9046,9057,9062,9075,9058,9037,9049,9044,9063,9054,9060,9056,9067,9043,9069,9076,9082,9066,9079,9074,9089,9064,9090,9061,9084,9070,9072,9078,9073,9081,9091,9087,9071,9088,9086,9092,9106,9077,9083,9094,9103,9095,9080,9098,9107,9085,9097,9099,9108,9104,9093,9122,9101,9112,9115,9105,9100,9096,9129,9119,9102,9109,9130,9111,9120,9116,9125,9138,9114,9131,9128,9132,9118,9110,9113,9124,9117,9127,9126,9133,9134,9139,9123,9135,9121,9137,9141,9146,9140,9142,9147,9145,9136,9149,9144,9153,9151,9150,9148,9143,9154,9162,9156,9168,9163,9159,9160,9167,9161,9158,9164,9169,9176,9155,9170,9152,9157,9171,9175,9178,9166,9180,9165,9183,9182,9173,9186,9174,9172,9181,9177,9185,9184,9179,9190,9187,9188,9191,9189,9192,9194,9193,9196,9198,9195,9197,9199,9200,9204,9201,9209,9202,9205,9212,9211,9203,9215,9208,9206,9216,9219,9207,9221,9224,9218,9213,9214,9222,9210,9229,9233,9220,9217,9232,9231,9227,9226,9223,9225,9228,9260,9241,9237,9245,9254,9265,9242,9243,9244,9249,9238,9251,9235,9255,9247,9267,9252,9257,9264,9248,9230,9240,9263,9278,9234,9269,9250,9261,9246,9236,9275,9239,9274,9270,9258,9262,9266,9272,9259,9277,9256,9268,9271,9295,9279,9280,9253,9276,9286,9289,9283,9281,9273,9285,9284,9288,9294,9293,9296,9292,9305,9297,9323,9291,9308,9306,9300,9304,9303,9317,9282,9290,9322,9314,9316,9307,9302,9313,9301,9311,9287,9299,9321,9325,9309,9298,9334,9318,9327,9310,9320,9315,9319,9328,9330,9312,9336,9337,9324,9333,9329,9335,9331,9338,9340,9339,9342,9326,9345,9332,9341,9343,9346,9355,9347,9361,9349,9350,9356,9354,9348,9363,9351,9353,9352,9344,9360,9359,9368,9375,9362,9358,9364,9370,9369,9357,9374,9365,9366,9373,9377,9379,9382,9380,9372,9376,9371,9367,9381,9384,9378,9383,9387,9385,9388,9390,9389,9386,9391,9392,9393,9394,9397,9395,9396,9398,9399,9400,9405,9402,9404,9401,9403,9406,9411,9409,9417,9407,9413,9410,9422,9414,9423,9408,9419,9418,9427,9416,9412,9426,9421,9415,9425,9430,9420,9432,9428,9444,9436,9439,9434,9424,9441,9446,9449,9431,9435,9443,9455,9429,9461,9451,9450,9470,9453,9433,9445,9438,9464,9459,9442,9471,9448,9452,9454,9460,9437,9447,9465,9457,9462,9440,9456,9467,9466,9472,9475,9476,9478,9473,9480,9468,9485,9481,9463,9488,9458,9469,9474,9494,9477,9479,9489,9482,9484,9493,9487,9504,9486,9500,9509,9496,9502,9495,9516,9492,9501,9507,9483,9490,9499,9497,9521,9508,9498,9503,9491,9514,9513,9515,9519,9520,9522,9523,9512,9526,9517,9510,9528,9505,9518,9511,9506,9524,9531,9538,9537,9525,9527,9544,9541,9532,9543,9530,9529,9536,9535,9534,9539,9553,9533,9551,9550,9542,9540,9552,9556,9549,9548,9545,9546,9547,9559,9563,9557,9568,9554,9558,9572,9571,9578,9565,9555,9575,9570,9577,9561,9562,9569,9566,9564,9560,9574,9580,9576,9567,9573,9582,9581,9584,9579,9586,9587,9583,9585,9588,9589,9591,9590,9592,9593,9594,9597,9596,9595,9599,9598,9600,9601,9605,9603,9604,9602,9616,9622,9614,9606,9615,9610,9612,9613,9619,9625,9618,9611,9628,9608,9624,9620,9627,9607,9617,9623,9621,9626,9609,9629,9630,9636,9633,9632,9645,9642,9634,9638,9635,9640,9646,9652,9637,9658,9651,9639,9656,9657,9659,9644,9631,9672,9647,9649,9662,9660,9643,9664,9666,9670,9687,9650,9655,9641,9653,9669,9675,9648,9673,9665,9654,9678,9661,9663,9674,9671,9688,9686,9689,9683,9679,9677,9682,9684,9681,9676,9668,9667,9685,9680,9696,9699,9700,9692,9691,9695,9698,9710,9697,9694,9690,9712,9693,9723,9701,9711,9715,9718,9706,9708,9704,9709,9703,9722,9726,9702,9705,9707,9733,9714,9717,9719,9728,9716,9749,9727,9713,9731,9721,9744,9742,9724,9740,9732,9745,9737,9720,9736,9743,9735,9747,9750,9725,9741,9739,9758,9729,9734,9746,9755,9748,9753,9738,9751,9730,9754,9752,9756,9767,9762,9768,9765,9760,9780,9769,9772,9757,9764,9774,9776,9773,9763,9777,9766,9775,9761,9759,9781,9778,9771,9770,9779,9782,9784,9788,9785,9783,9787,9790,9786,9791,9789,9792,9793,9796,9795,9794,9797,9799,9798,9800,9807,9802,9806,9801,9808,9803,9814,9819,9804,9813,9812,9810,9818,9815,9811,9809,9816,9825,9817,9824,9823,9805,9820,9835,9828,9833,9840,9822,9843,9826,9829,9832,9821,9842,9827,9834,9837,9831,9830,9838,9841,9849,9846,9836,9858,9847,9857,9855,9839,9870,9856,9851,9850,9873,9878,9862,9852,9861,9871,9859,9879,9848,9853,9867,9863,9864,9876,9887,9866,9885,9883,9854,9872,9874,9868,9877,9865,9890,9875,9889,9884,9891,9869,9907,9901,9882,9888,9899,9897,9905,9886,9895,9915,9903,9892,9902,9896,9898,9900,9906,9919,9918,9917,9911,9904,9926,9921,9925,9912,9913,9930,9916,9894,9914,9910,9909,9928,9936,9931,9920,9934,9908,9923,9952,9941,9938,9929,9927,9924,9933,9950,9942,9932,9935,9949,9937,9953,9939,9943,9947,9951,9940,9922,9945,9948,9957,9944,9955,9954,9958,9961,9956,9946,9960,9962,9970,9959,9967,9964,9972,9979,9966,9968,9969,9963,9971,9975,9976,9973,9986,9965,9982,9974,9981,9980,9977,9984,9983,9978,9985,9987,9988,9989,9992,9991,9990,9996,9994,9993,9995,9998,9997,9999,10000,10002,10005,10006,10004,10008,10003,10007,10009,10001,10010,10015,10012,10019,10027,10014,10021,10023,10017,10011,10028,10031,10026,10022,10039,10024,10034,10025,10013,10016,10018,10020,10033,10035,10038,10032,10040,10029,10037,10042,10030,10036,10041,10043,10044,10062,10046,10057,10047,10067,10048,10058,10050,10045,10049,10070,10056,10063,10054,10055,10053,10064,10068,10060,10069,10051,10075,10066,10083,10052,10065,10082,10059,10073,10072,10080,10061,10077,10074,10088,10071,10076,10081,10079,10078,10091,10087,10092,10099,10095,10101,10086,10113,10096,10084,10093,10098,10090,10105,10111,10085,10094,10109,10089,10102,10115,10106,10108,10100,10104,10118,10127,10097,10103,10124,10112,10114,10110,10128,10107,10116,10117,10123,10122,10119,10138,10121,10142,10152,10120,10130,10139,10136,10129,10126,10131,10145,10147,10133,10157,10134,10137,10140,10132,10149,10143,10125,10135,10146,10154,10159,10151,10141,10150,10155,10162,10148,10156,10158,10163,10161,10144,10171,10166,10164,10153,10167,10160,10169,10175,10168,10170,10176,10177,10178,10165,10180,10173,10172,10179,10174,10182,10181,10184,10183,10185,10187,10186,10189,10188,10190,10192,10191,10193,10194,10195,10196,10198,10197,10199,10200,10201,10202,10204,10208,10203,10212,10207,10211,10205,10206,10210,10209,10213,10214,10221,10227,10215,10216,10217,10219,10224,10223,10225,10226,10222,10220,10236,10231,10229,10232,10233,10230,10242,10237,10244,10218,10248,10249,10234,10228,10235,10255,10238,10245,10252,10243,10260,10239,10253,10254,10259,10246,10270,10240,10247,10241,10264,10267,10257,10265,10251,10272,10258,10256,10266,10262,10261,10263,10250,10273,10269,10268,10271,10280,10281,10275,10285,10276,10278,10274,10288,10279,10284,10283,10286,10277,10282,10291,10290,10289,10287,10297,10310,10300,10317,10296,10311,10298,10293,10299,10301,10304,10302,10313,10294,10323,10303,10314,10305,10309,10321,10292,10312,10316,10315,10331,10307,10308,10335,10330,10295,10319,10332,10318,10306,10322,10337,10348,10328,10324,10329,10327,10340,10351,10341,10326,10347,10325,10334,10338,10356,10343,10336,10350,10346,10349,10344,10320,10333,10358,10353,10355,10339,10345,10342,10361,10373,10359,10354,10362,10357,10352,10369,10360,10380,10376,10363,10368,10378,10367,10365,10366,10379,10372,10377,10370,10382,10371,10374,10375,10381,10364,10384,10387,10383,10388,10385,10386,10391,10390,10389,10392,10393,10394,10396,10398,10395,10399,10397,10400,10404,10403,10401,10402,10406,10410,10405,10412,10408,10407,10409,10411,10413,10422,10415,10414,10417,10420,10431,10423,10427,10434,10437,10445,10441,10438,10429,10418,10425,10452,10455,10433,10424,10419,10426,10439,10446,10416,10432,10430,10444,10421,10428,10442,10443,10435,10449,10454,10447,10440,10453,10463,10462,10451,10457,10436,10464,10461,10459,10448,10472,10450,10470,10456,10471,10466,10468,10474,10477,10473,10465,10467,10458,10476,10481,10478,10460,10469,10479,10486,10484,10482,10488,10483,10480,10492,10489,10491,10475,10490,10485,10500,10494,10497,10487,10505,10496,10504,10493,10495,10498,10503,10513,10501,10508,10502,10507,10499,10526,10511,10515,10520,10514,10518,10516,10522,10530,10519,10506,10523,10521,10510,10527,10547,10528,10531,10512,10524,10509,10532,10534,10529,10538,10552,10525,10540,10539,10517,10537,10533,10546,10535,10542,10541,10536,10548,10557,10554,10549,10551,10565,10550,10545,10555,10573,10563,10578,10561,10576,10543,10567,10544,10558,10571,10553,10566,10556,10564,10580,10572,10570,10560,10569,10559,10577,10581,10562,10574,10568,10575,10582,10579,10585,10584,10587,10583,10586,10588,10590,10589,10592,10591,10593,10594,10597,10596,10595,10599,10598,10600,10601,10602,10604,10605,10603,10613,10607,10606,10612,10609,10611,10608,10614,10617,10615,10610,10616,10621,10622,10618,10623,10625,10620,10627,10628,10626,10636,10619,10624,10639,10631,10635,10630,10662,10629,10643,10649,10634,10652,10645,10650,10642,10640,10644,10665,10653,10673,10646,10661,10638,10647,10660,10651,10637,10655,10676,10667,10632,10641,10658,10648,10633,10664,10675,10657,10681,10670,10663,10656,10654,10671,10666,10680,10679,10668,10682,10672,10686,10678,10659,10684,10669,10677,10687,10674,10690,10689,10688,10691,10683,10693,10698,10685,10694,10692,10696,10695,10697,10706,10701,10703,10702,10709,10704,10716,10708,10713,10705,10723,10699,10715,10722,10726,10707,10711,10700,10710,10724,10718,10733,10725,10721,10712,10735,10739,10720,10714,10734,10717,10729,10719,10728,10740,10741,10731,10727,10744,10736,10745,10765,10743,10748,10732,10757,10754,10738,10737,10775,10747,10756,10776,10759,10749,10751,10730,10755,10767,10742,10753,10771,10746,10761,10752,10772,10760,10763,10779,10766,10769,10777,10750,10762,10758,10782,10764,10773,10783,10768,10770,10774,10781,10784,10778,10780,10786,10785,10789,10788,10787,10791,10792,10790,10793,10794,10796,10795,10797,10798,10800,10799,10802,10801,10803,10805,10804,10808,10807,10809,10814,10810,10811,10813,10806,10812,10815,10816,10818,10820,10829,10817,10825,10822,10833,10823,10844,10826,10835,10827,10824,10821,10819,10828,10830,10837,10832,10864,10831,10838,10850,10871,10856,10843,10848,10846,10852,10836,10860,10851,10854,10842,10847,10840,10839,10866,10834,10874,10863,10849,10841,10884,10853,10857,10868,10845,10855,10865,10888,10872,10862,10882,10858,10869,10880,10859,10879,10876,10867,10881,10861,10878,10875,10887,10885,10890,10883,10873,10877,10870,10892,10886,10889,10900,10898,10895,10893,10904,10891,10894,10896,10899,10903,10910,10897,10908,10901,10905,10907,10909,10911,10917,10918,10925,10902,10923,10915,10919,10906,10934,10920,10921,10932,10931,10928,10951,10913,10929,10912,10914,10939,10924,10950,10922,10916,10926,10947,10949,10937,10935,10936,10943,10938,10930,10927,10973,10960,10956,10959,10961,10964,10942,10952,10946,10958,10940,10941,10933,10944,10955,10948,10954,10957,10963,10962,10979,10945,10966,10953,10968,10969,10974,10981,10971,10967,10982,10970,10965,10977,10978,10985,10972,10986,10984,10983,10975,10980,10976,10989,10988,10991,10987,10990,10992,10993,10994,10996,10995,10998,10999,10997,11000,11001,11003,11004,11011,11005,11008,11007,11013,11006,11002,11009,11012,11010,11014,11015,11017,11020,11018,11024,11026,11022,11016,11021,11023,11019,11025,11027,11029,11031,11051,11048,11030,11039,11032,11038,11040,11028,11049,11036,11045,11037,11053,11046,11050,11034,11033,11075,11083,11054,11076,11047,11067,11055,11077,11062,11042,11079,11035,11063,11060,11057,11078,11066,11041,11056,11064,11044,11099,11074,11080,11082,11058,11061,11093,11052,11086,11089,11073,11059,11103,11043,11070,11088,11091,11068,11090,11069,11065,11106,11072,11081,11095,11087,11071,11100,11092,11101,11096,11094,11085,11098,11084,11113,11102,11115,11108,11111,11117,11114,11110,11097,11107,11112,11105,11109,11104,11124,11119,11118,11116,11129,11128,11131,11133,11121,11126,11120,11139,11122,11123,11130,11125,11136,11151,11132,11140,11143,11127,11145,11148,11134,11141,11146,11152,11135,11144,11169,11154,11138,11137,11142,11155,11161,11163,11164,11150,11162,11149,11174,11156,11159,11168,11165,11170,11158,11166,11153,11157,11147,11175,11177,11172,11160,11167,11173,11171,11179,11176,11178,11185,11180,11181,11184,11182,11186,11187,11183,11188,11189,11191,11190,11192,11193,11194,11195,11196,11199,11197,11198,11200,11201,11202,11209,11203,11214,11212,11208,11205,11204,11206,11210,11207,11211,11213,11215,11218,11220,11221,11217,11216,11223,11225,11222,11219,11226,11224,11227,11230,11229,11228,11237,11240,11238,11236,11242,11241,11233,11231,11239,11232,11254,11247,11243,11252,11250,11244,11234,11259,11245,11235,11253,11251,11260,11265,11264,11262,11256,11270,11248,11249,11272,11266,11257,11263,11261,11255,11284,11291,11246,11268,11281,11289,11267,11300,11295,11283,11258,11293,11274,11285,11271,11277,11276,11273,11269,11275,11288,11299,11278,11280,11282,11306,11286,11290,11304,11316,11287,11279,11296,11297,11317,11294,11301,11332,11310,11320,11313,11303,11324,11292,11308,11322,11326,11321,11323,11298,11312,11318,11305,11314,11328,11309,11319,11302,11311,11307,11336,11341,11327,11333,11315,11346,11329,11335,11357,11331,11350,11344,11345,11330,11349,11352,11339,11337,11334,11351,11338,11325,11353,11355,11359,11358,11347,11342,11348,11356,11368,11343,11362,11363,11354,11360,11367,11371,11369,11364,11374,11361,11379,11375,11340,11378,11376,11365,11366,11370,11372,11380,11373,11381,11377,11383,11382,11384,11387,11389,11385,11388,11391,11386,11390,11392,11393,11394,11396,11398,11397,11395,11399,11400,11401,11406,11414,11402,11409,11403,11407,11404,11408,11405,11412,11415,11410,11411,11413,11418,11422,11416,11417,11421,11423,11425,11419,11420,11427,11424,11426,11428,11434,11429,11431,11430,11441,11436,11432,11437,11438,11444,11440,11433,11445,11455,11457,11451,11448,11456,11463,11435,11446,11452,11454,11443,11450,11442,11439,11466,11460,11468,11459,11476,11470,11480,11449,11464,11447,11474,11462,11473,11458,11467,11453,11465,11469,11483,11493,11498,11461,11472,11477,11482,11499,11488,11479,11507,11494,11471,11489,11492,11504,11487,11481,11515,11519,11486,11478,11475,11490,11506,11485,11500,11523,11495,11497,11509,11520,11501,11491,11511,11512,11516,11496,11528,11484,11502,11533,11510,11518,11503,11532,11527,11517,11514,11513,11508,11530,11522,11529,11534,11521,11505,11535,11525,11524,11537,11526,11543,11545,11538,11548,11542,11531,11562,11550,11544,11574,11539,11549,11551,11541,11553,11555,11540,11567,11536,11564,11558,11572,11576,11556,11577,11547,11571,11563,11573,11552,11561,11554,11546,11557,11559,11560,11579,11584,11569,11581,11580,11568,11578,11575,11582,11565,11570,11583,11566,11587,11586,11589,11590,11585,11588,11592,11591,11593,11594,11595,11597,11598,11596,11600,11599,11601,11608,11603,11611,11604,11602,11606,11607,11609,11610,11605,11615,11613,11612,11614,11620,11617,11618,11616,11623,11622,11619,11621,11624,11625,11626,11627,11628,11629,11636,11632,11630,11631,11634,11635,11646,11638,11650,11637,11633,11643,11644,11645,11651,11655,11647,11667,11663,11639,11648,11659,11641,11661,11656,11640,11660,11642,11668,11654,11664,11653,11658,11649,11657,11652,11671,11662,11676,11666,11683,11673,11672,11665,11680,11674,11679,11675,11682,11670,11689,11669,11681,11677,11678,11691,11686,11690,11684,11692,11708,11685,11705,11688,11723,11711,11707,11714,11687,11706,11695,11702,11694,11721,11701,11704,11716,11737,11720,11722,11700,11734,11733,11725,11728,11699,11696,11693,11727,11719,11712,11703,11713,11724,11717,11697,11730,11698,11731,11740,11739,11715,11710,11718,11709,11726,11729,11735,11732,11741,11744,11738,11736,11743,11742,11770,11750,11777,11748,11746,11761,11759,11754,11763,11767,11755,11774,11769,11756,11757,11778,11751,11758,11747,11784,11749,11781,11780,11764,11771,11753,11752,11779,11783,11760,11772,11768,11762,11765,11776,11766,11745,11782,11773,11775,11787,11788,11785,11789,11786,11792,11790,11791,11793,11794,11795,11798,11796,11797,11799,11800,11805,11802,11804,11801,11803,11809,11808,11813,11810,11806,11812,11807,11815,11811,11814,11818,11822,11816,11817,11821,11819,11825,11824,11826,11820,11823,11827,11828,11830,11829,11833,11834,11837,11831,11842,11832,11840,11841,11835,11850,11839,11844,11852,11847,11843,11838,11849,11836,11846,11845,11853,11856,11855,11872,11866,11861,11865,11858,11860,11851,11873,11880,11874,11859,11869,11877,11854,11848,11864,11868,11870,11862,11867,11857,11882,11878,11863,11879,11885,11875,11881,11871,11876,11891,11886,11892,11884,11890,11894,11888,11893,11905,11887,11906,11896,11883,11900,11897,11889,11899,11898,11902,11917,11903,11909,11904,11908,11925,11913,11895,11919,11910,11914,11907,11912,11927,11901,11921,11920,11924,11929,11943,11911,11931,11941,11926,11922,11918,11937,11935,11928,11932,11930,11939,11934,11933,11938,11936,11916,11944,11940,11953,11950,11945,11947,11915,11960,11948,11923,11942,11963,11946,11956,11954,11969,11961,11971,11949,11951,11955,11970,11968,11957,11972,11952,11958,11978,11959,11965,11981,11962,11966,11979,11974,11964,11976,11973,11980,11967,11977,11975,11982,11984,11986,11988,11985,11983,11987,11989,11991,11990,11992,11993,11994,11995,11996,11998,11997,11999,12000,12002,12001,12007,12003,12004,12005,12006,12009,12015,12008,12011,12014,12012,12010,12019,12013,12018,12016,12021,12025,12020,12017,12023,12028,12022,12024,12026,12027,12035,12032,12033,12029,12030,12034,12041,12031,12043,12036,12037,12054,12039,12040,12052,12047,12042,12046,12050,12044,12055,12051,12038,12053,12061,12062,12048,12059,12058,12066,12049,12056,12070,12064,12063,12045,12069,12065,12057,12060,12074,12073,12068,12067,12075,12071,12079,12080,12072,12084,12083,12082,12077,12081,12076,12086,12078,12085,12089,12097,12096,12093,12092,12087,12088,12098,12091,12104,12100,12101,12099,12095,12094,12115,12090,12121,12108,12105,12114,12120,12109,12117,12112,12106,12103,12111,12119,12110,12128,12143,12107,12122,12102,12124,12134,12118,12113,12133,12116,12148,12140,12141,12142,12127,12139,12130,12131,12144,12126,12129,12136,12125,12137,12145,12123,12135,12157,12169,12155,12164,12170,12147,12154,12156,12132,12138,12158,12150,12149,12152,12172,12146,12162,12151,12180,12161,12167,12171,12159,12166,12153,12160,12176,12174,12173,12177,12168,12179,12189,12165,12185,12183,12181,12182,12163,12175,12187,12178,12186,12184,12191,12192,12188,12190,12193,12194,12195,12197,12196,12198,12199,12200,12201,12205,12202,12207,12206,12213,12204,12203,12211,12208,12212,12210,12209,12214,12218,12217,12216,12222,12219,12220,12215,12223,12225,12221,12226,12227,12230,12224,12228,12239,12237,12233,12229,12234,12235,12247,12232,12236,12244,12252,12238,12240,12248,12245,12250,12242,12241,12254,12253,12251,12243,12257,12258,12268,12265,12259,12255,12249,12246,12272,12266,12264,12260,12271,12270,12262,12277,12269,12263,12256,12281,12261,12267,12280,12275,12276,12279,12274,12273,12282,12285,12286,12301,12284,12283,12278,12295,12291,12299,12297,12294,12290,12298,12296,12293,12289,12292,12288,12302,12300,12307,12308,12306,12287,12309,12310,12312,12311,12303,12305,12318,12314,12315,12304,12336,12313,12320,12317,12321,12332,12338,12335,12323,12331,12316,12334,12333,12319,12328,12348,12330,12324,12322,12339,12344,12353,12325,12342,12349,12329,12346,12327,12352,12358,12343,12337,12351,12356,12345,12340,12347,12355,12357,12354,12359,12360,12362,12350,12326,12361,12370,12378,12368,12341,12363,12364,12365,12374,12367,12385,12380,12372,12382,12377,12376,12381,12375,12366,12389,12379,12371,12383,12373,12386,12387,12369,12384,12392,12388,12391,12390,12393,12394,12395,12397,12396,12398,12399,12400,12406,12404,12405,12408,12403,12402,12401,12407,12412,12409,12411,12410,12413,12420,12414,12418,12417,12419,12416,12421,12423,12415,12425,12424,12422,12426,12428,12427,12435,12439,12434,12437,12433,12438,12446,12430,12431,12429,12450,12440,12443,12442,12456,12436,12457,12441,12453,12452,12432,12465,12467,12444,12449,12459,12447,12462,12448,12458,12455,12470,12476,12475,12471,12461,12469,12460,12472,12477,12464,12445,12454,12451,12479,12473,12466,12478,12474,12463,12482,12468,12489,12485,12488,12483,12490,12497,12480,12481,12493,12487,12496,12486,12492,12498,12484,12491,12499,12511,12501,12508,12517,12495,12513,12494,12503,12505,12512,12526,12518,12506,12527,12522,12502,12509,12500,12521,12515,12523,12507,12504,12532,12519,12514,12516,12534,12537,12529,12540,12528,12510,12546,12524,12520,12533,12538,12543,12542,12548,12525,12531,12547,12541,12544,12557,12550,12545,12554,12530,12536,12539,12560,12535,12553,12549,12555,12570,12551,12552,12556,12566,12558,12573,12576,12563,12568,12564,12559,12575,12572,12567,12565,12569,12571,12585,12574,12578,12561,12562,12577,12584,12582,12581,12586,12579,12587,12589,12580,12588,12583,12591,12590,12592,12593,12596,12595,12594,12597,12598,12599,12600,12604,12608,12601,12602,12603,12606,12613,12605,12607,12610,12609,12611,12612,12615,12614,12616,12620,12617,12618,12621,12622,12625,12623,12619,12624,12626,12627,12628,12636,12635,12634,12633,12629,12630,12632,12631,12645,12638,12646,12644,12652,12639,12637,12654,12649,12641,12653,12640,12660,12643,12650,12659,12647,12655,12656,12651,12642,12648,12663,12674,12665,12667,12662,12675,12657,12672,12669,12673,12664,12670,12658,12671,12682,12668,12666,12680,12679,12661,12678,12694,12677,12676,12684,12692,12683,12681,12690,12685,12688,12701,12695,12700,12686,12687,12691,12693,12703,12697,12689,12707,12696,12699,12698,12709,12705,12721,12704,12706,12702,12712,12711,12718,12732,12720,12710,12724,12708,12713,12726,12722,12736,12727,12725,12715,12742,12731,12738,12737,12729,12719,12714,12747,12716,12734,12744,12741,12728,12746,12723,12730,12735,12740,12739,12717,12750,12743,12753,12754,12756,12745,12733,12749,12764,12752,12757,12755,12748,12751,12763,12765,12758,12770,12762,12761,12769,12777,12766,12772,12760,12771,12767,12779,12768,12773,12782,12781,12759,12778,12784,12780,12774,12786,12775,12776,12783,12788,12785,12787,12790,12789,12791,12792,12793,12795,12794,12796,12797,12798,12800,12799,12801,12806,12803,12802,12805,12810,12809,12813,12804,12811,12808,12807,12812,12815,12821,12818,12816,12819,12814,12817,12820,12825,12823,12822,12824,12827,12826,12828,12829,12830,12834,12831,12832,12839,12836,12851,12843,12837,12844,12850,12849,12838,12833,12845,12840,12841,12853,12848,12846,12835,12856,12857,12852,12842,12859,12862,12869,12860,12867,12866,12847,12861,12868,12854,12863,12875,12881,12879,12855,12871,12872,12865,12878,12873,12858,12864,12886,12874,12880,12877,12870,12889,12882,12888,12883,12896,12891,12876,12884,12900,12893,12897,12895,12902,12887,12894,12885,12890,12892,12906,12909,12904,12898,12910,12905,12903,12914,12899,12907,12911,12901,12908,12927,12915,12926,12920,12913,12918,12912,12924,12921,12942,12917,12930,12944,12919,12935,12928,12933,12939,12943,12936,12938,12925,12916,12922,12923,12931,12951,12937,12932,12945,12940,12929,12934,12947,12950,12946,12948,12953,12941,12949,12961,12952,12977,12967,12955,12954,12956,12973,12971,12959,12965,12969,12964,12975,12963,12966,12968,12970,12974,12957,12960,12958,12979,12985,12982,12976,12972,12962,12984,12989,12983,12978,12986,12980,12981,12987,12988,12991,12990,12992,12993,12995,12994,12997,12996,12998,12999,13000,13002,13003,13004,13001,13011,13005,13013,13012,13014,13006,13009,13008,13007,13010,13015,13021,13019,13017,13018,13020,13022,13023,13016,13025,13024,13028,13026,13027,13031,13030,13034,13040,13033,13046,13035,13032,13039,13043,13037,13058,13051,13050,13038,13029,13041,13049,13048,13044,13036,13042,13052,13054,13047,13045,13053,13055,13056,13067,13070,13064,13060,13068,13057,13078,13061,13059,13069,13089,13065,13071,13080,13086,13075,13073,13087,13076,13062,13072,13083,13066,13082,13063,13092,13088,13079,13096,13101,13077,13103,13074,13097,13090,13091,13081,13084,13093,13106,13085,13107,13099,13113,13095,13108,13094,13100,13116,13098,13109,13102,13105,13104,13115,13111,13110,13114,13118,13112,13134,13117,13130,13128,13120,13142,13119,13124,13131,13126,13122,13129,13138,13123,13139,13148,13137,13125,13127,13121,13132,13151,13136,13141,13143,13133,13150,13140,13144,13147,13162,13154,13153,13135,13145,13146,13149,13159,13161,13157,13158,13155,13152,13160,13163,13172,13169,13166,13176,13164,13156,13177,13171,13173,13165,13174,13168,13170,13178,13183,13184,13167,13175,13179,13182,13187,13180,13186,13188,13185,13181,13190,13189,13191,13192,13193,13195,13194,13197,13196,13198,13199,13200,13201,13202,13205,13206,13204,13211,13209,13210,13213,13203,13208,13207,13216,13217,13215,13219,13214,13212,13218,13221,13222,13220,13223,13225,13224,13226,13227,13231,13228,13236,13237,13234,13229,13233,13232,13240,13235,13230,13238,13242,13239,13258,13245,13241,13250,13247,13252,13246,13244,13243,13260,13248,13253,13254,13251,13265,13249,13263,13257,13256,13259,13255,13262,13272,13269,13264,13277,13276,13267,13275,13271,13268,13270,13280,13274,13266,13261,13282,13279,13273,13294,13289,13283,13292,13286,13285,13284,13290,13278,13288,13295,13281,13291,13287,13300,13310,13307,13301,13293,13296,13305,13303,13323,13297,13308,13298,13299,13312,13304,13318,13317,13319,13306,13302,13314,13313,13330,13316,13329,13311,13315,13322,13326,13320,13321,13328,13309,13324,13327,13331,13332,13340,13333,13325,13345,13336,13335,13342,13334,13339,13346,13349,13344,13338,13341,13356,13343,13337,13348,13361,13353,13347,13351,13355,13352,13359,13364,13360,13354,13366,13369,13350,13358,13367,13357,13370,13365,13363,13371,13362,13381,13375,13376,13368,13372,13374,13385,13377,13388,13380,13382,13384,13379,13386,13387,13373,13378,13383,13390,13391,13389,13392,13393,13394,13395,13396,13398,13397,13399,13400,13401,13404,13402,13407,13403,13406,13410,13412,13408,13413,13405,13419,13417,13416,13409,13418,13415,13411,13414,13420,13421,13422,13423,13425,13427,13426,13424,13433,13428,13429,13436,13434,13438,13439,13437,13435,13430,13432,13445,13440,13447,13431,13451,13441,13452,13456,13443,13442,13453,13460,13448,13457,13455,13470,13462,13461,13446,13449,13454,13458,13467,13459,13468,13466,13465,13444,13476,13472,13450,13486,13464,13474,13479,13471,13463,13481,13469,13483,13473,13478,13482,13487,13491,13480,13489,13484,13490,13475,13492,13505,13485,13477,13493,13502,13495,13488,13497,13494,13499,13496,13507,13504,13498,13501,13510,13508,13500,13509,13515,13514,13520,13513,13503,13516,13506,13523,13519,13533,13511,13531,13517,13521,13527,13537,13526,13524,13512,13525,13528,13536,13532,13518,13540,13534,13541,13539,13542,13522,13530,13535,13529,13553,13543,13547,13544,13538,13558,13545,13559,13551,13549,13550,13546,13555,13563,13571,13554,13557,13552,13564,13560,13548,13562,13569,13577,13556,13561,13568,13566,13574,13567,13565,13579,13570,13580,13575,13578,13576,13583,13589,13572,13573,13586,13582,13581,13584,13587,13588,13585,13590,13592,13591,13593,13596,13595,13594,13598,13597,13599,13600,13601,13603,13602,13605,13608,13604,13611,13612,13610,13609,13617,13607,13606,13613,13621,13615,13618,13616,13620,13622,13619,13623,13614,13626,13624,13625,13627,13631,13629,13628,13640,13635,13638,13633,13634,13637,13632,13630,13636,13655,13641,13642,13649,13643,13648,13653,13647,13652,13651,13639,13660,13650,13646,13644,13661,13662,13657,13675,13656,13654,13664,13659,13666,13663,13645,13658,13667,13668,13683,13669,13692,13665,13670,13676,13671,13682,13678,13672,13689,13680,13688,13677,13681,13674,13696,13690,13679,13685,13699,13694,13697,13691,13687,13673,13684,13700,13695,13686,13708,13693,13702,13704,13698,13715,13712,13706,13701,13703,13714,13709,13707,13711,13713,13720,13705,13716,13727,13724,13721,13710,13723,13728,13718,13719,13725,13722,13732,13729,13717,13742,13726,13746,13748,13733,13745,13749,13731,13730,13738,13747,13734,13735,13736,13741,13759,13740,13744,13750,13737,13755,13743,13739,13758,13761,13752,13762,13756,13760,13754,13753,13775,13763,13751,13765,13766,13773,13772,13757,13767,13771,13768,13764,13776,13770,13778,13777,13774,13769,13783,13782,13780,13788,13779,13781,13786,13784,13785,13787,13789,13790,13792,13791,13793,13794,13795,13798,13796,13797,13799,13800,13801,13803,13804,13806,13802,13805,13809,13811,13808,13810,13814,13807,13813,13816,13817,13820,13818,13812,13815,13823,13819,13822,13821,13826,13825,13824,13828,13829,13830,13833,13831,13827,13834,13837,13838,13835,13840,13832,13841,13853,13836,13839,13848,13844,13843,13846,13849,13842,13858,13859,13847,13861,13850,13851,13852,13865,13856,13864,13845,13863,13871,13855,13868,13857,13875,13882,13854,13870,13862,13874,13876,13872,13860,13880,13867,13869,13866,13873,13894,13887,13883,13881,13878,13897,13879,13895,13884,13877,13886,13899,13893,13891,13889,13885,13912,13890,13898,13903,13892,13888,13901,13900,13908,13896,13917,13902,13919,13906,13904,13907,13905,13910,13913,13909,13918,13927,13928,13914,13923,13911,13915,13924,13926,13920,13929,13925,13921,13933,13916,13931,13940,13945,13937,13936,13935,13930,13938,13922,13934,13944,13950,13947,13939,13959,13946,13942,13948,13943,13951,13941,13949,13957,13932,13955,13958,13954,13956,13968,13973,13960,13966,13962,13964,13967,13953,13952,13971,13974,13961,13978,13965,13972,13963,13980,13970,13977,13976,13969,13983,13975,13987,13979,13981,13982,13985,13986,13984,13988,13989,13990,13991,13992,13993,13994,13996,13995,13998,13997,13999 -sV -sC -T4 -Pn -oA 10.10.104.169 10.10.104.169
(I don’t remember looking at the output at all & so, I don’t have a copy of it.)
So while the nmap results come out, I tried connecting to one of the ports via nc and found that its running SSH-2.0-dropbear.
I found this exploit which doesn’t seem to work but I found interesting results trying to connect to one of the non standard ports: LINK
For lower port ranges it replies with Lower and for higher, it replies with Higher.
So lets try to find the port in between and we might get something interesting.
After few tries, I was manually able to find the right port 9766 (hoping it to be the right serverrrrrrr!)
So It results in some weird aff strings asking for a secret. uhh
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
You've found the real service.
Solve the challenge to get access to the box
Jabberwocky
'Mdes mgplmmz, cvs alv lsmtsn aowil
Fqs ncix hrd rxtbmi bp bwl arul;
Elw bpmtc pgzt alv uvvordcet,
Egf bwl qffl vaewz ovxztiql.
'Fvphve ewl Jbfugzlvgb, ff woy!
Ioe kepu bwhx sbai, tst jlbal vppa grmjl!
Bplhrf xag Rjinlu imro, pud tlnp
Bwl jintmofh Iaohxtachxta!'
Oi tzdr hjw oqzehp jpvvd tc oaoh:
Eqvv amdx ale xpuxpqx hwt oi jhbkhe--
Hv rfwmgl wl fp moi Tfbaun xkgm,
Puh jmvsd lloimi bp bwvyxaa.
Eno pz io yyhqho xyhbkhe wl sushf,
Bwl Nruiirhdjk, xmmj mnlw fy mpaxt,
Jani pjqumpzgn xhcdbgi xag bjskvr dsoo,
Pud cykdttk ej ba gaxt!
Vnf, xpq! Wcl, xnh! Hrd ewyovka cvs alihbkh
Ewl vpvict qseux dine huidoxt-achgb!
Al peqi pt eitf, ick azmo mtd wlae
Lx ymca krebqpsxug cevm.
'Ick lrla xhzj zlbmg vpt Qesulvwzrr?
Cpqx vw bf eifz, qy mthmjwa dwn!
V jitinofh kaz! Gtntdvl! Ttspaj!'
Wl ciskvttk me apw jzn.
'Awbw utqasmx, tuh tst zljxaa bdcij
Wph gjgl aoh zkuqsi zg ale hpie;
Bpe oqbzc nxyi tst iosszqdtz,
Eew ale xdte semja dbxxkhfe.
Jdbr tivtmi pw sxderpIoeKeudmgdstd
Enter Secret:
From a simple google search it’s obvious that it’s vignere ciphered text of the Jabberwocky poem due to a reddit link with somebody asking about it. ;-;
on dcode.fr, I was able to find the decryption key by inserting the top 3 paragraphs using the automatic decryption. It also meets the original poem.
Decryption key: THEALPHABETCIPHER
So we now have our secret:
SECRET: bewareTheJabberwock
Entering the secret returns possible credentials.
1
jabberwock:UnwoundCottagesEnglandQueen
I can login with the credentials . :P
Flag 1
reversing this string, we get our first flag:
1
thm{65d3710e9d75d5f346d2bac669119a23}
Privilege Escalation(s)
hmm, this machine could be vulnerable to known kernel exploits but lets go with How ig its supposedly should be done; idk..
So there are 5 other non root users. I Cannot cd into any of their directories.
Hmm, so theres a cronjob to execute a .sh file on reboot and we have sudo perms to execute reboot.
xD Tried sudo reboot -h and the server’s down now not being able to ssh into the server.
So, I restarted the machine just to realize that the password resets every reboot so the server didn’t exactly have any issues but that I needed to restart the entire process and get the password.
Anyways the cronjob runs as tweedledum.
created the following script: 
:P rebooted the server again. :o Hoping to get a connection trhough tweededum,
Here we go:
Stabilising the shell:
1
2
3
python -c 'import pty;pty.spawn("/bin/bash")'
export TERM=xterm
stty raw -echo; fg
humptydumpty.txt:
1
2
3
4
5
6
7
8
dcfff5eb40423f055a4cd0a8d7ed39ff6cb9816868f5766b4088b9e9906961b9
7692c3ad3540bb803c020b3aee66cd8887123234ea0c6e7143c0add73ff431ed
28391d3bc64ec15cbb090426b04aa6b7649c3cc85f11230bb0105e02d15e3624
b808e156d18d1cecdcc1456375f8cae994c36549a07c8c2315b473dd9d7f404f
fa51fd49abf67705d6a35d18218c115ff5633aec1f9ebfdc9d5d4956416f57f6
b9776d7ddf459c9ad5b0e1d6ac61e27befb5e99fd62446677600d7cacef544d0
5e884898da28047151d0e56f8dc6292773603d0d6aabbdd62a11ef721d1542d8
7468652070617373776f7264206973207a797877767574737271706f6e6d6c6b
poem.txt:
1
2
3
4
5
6
7
8
9
'Tweedledum and Tweedledee
Agreed to have a battle;
For Tweedledum said Tweedledee
Had spoiled his nice new rattle.
Just then flew down a monstrous crow,
As black as a tar-barrel;
Which frightened both the heroes so,
They quite forgot their quarrel.
anyways, we can run bash as tweedledee.
So we’re into tweedledee
So we’re maybe into a loop and ig we need to decipher the text:
crackstation reults:
So lets try ascii code:
we get:
1
the password is zyxwvutsrqponmlk
The password works for the user humptydumpty:
contents of poetry.txt:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
cat poetry.txt
‘You seem very clever at explaining words, Sir,’ said Alice. ‘Would you kindly tell me the meaning of the poem called “Jabberwocky”?’
‘Let’s hear it,’ said Humpty Dumpty. ‘I can explain all the poems that were ever invented—and a good many that haven’t been invented just yet.’
This sounded very hopeful, so Alice repeated the first verse:
‘Twas brillig, and the slithy toves
Did gyre and gimble in the wabe;
All mimsy were the borogoves,
And the mome raths outgrabe.
‘That’s enough to begin with,’ Humpty Dumpty interrupted: ‘there are plenty of hard words there. “Brillig” means four o’clock in the afternoon—the time when you begin broiling things for dinner.’
‘That’ll do very well,’ said Alice: ‘and “slithy”?’
‘Well, “slithy” means “lithe and slimy.” “Lithe” is the same as “active.” You see it’s like a portmanteau—there are two meanings packed up into one word.’
‘I see it now,’ Alice remarked thoughtfully: ‘and what are “toves”?’
‘Well, “toves” are something like badgers—they’re something like lizards—and they’re something like corkscrews.’
‘They must be very curious looking creatures.’
‘They are that,’ said Humpty Dumpty: ‘also they make their nests under sun-dials—also they live on cheese.’
‘And what’s the “gyre” and to “gimble”?’
‘To “gyre” is to go round and round like a gyroscope. To “gimble” is to make holes like a gimlet.’
cat poetry.txt
‘You seem very clever at explaining words, Sir,’ said Alice. ‘Would you kindly tell me the meaning of the poem called “Jabberwocky”?’
‘Let’s hear it,’ said Humpty Dumpty. ‘I can explain all the poems that were ever invented—and a good many that haven’t been invented just yet.’
This sounded very hopeful, so Alice repeated the first verse:
‘Twas brillig, and the slithy toves
Did gyre and gimble in the wabe;
All mimsy were the borogoves,
And the mome raths outgrabe.
‘That’s enough to begin with,’ Humpty Dumpty interrupted: ‘there are plenty of hard words there. “Brillig” means four o’clock in the afternoon—the time when you begin broiling things for dinner.’
‘That’ll do very well,’ said Alice: ‘and “slithy”?’
‘Well, “slithy” means “lithe and slimy.” “Lithe” is the same as “active.” You see it’s like a portmanteau—there are two meanings packed up into one word.’
‘I see it now,’ Alice remarked thoughtfully: ‘and what are “toves”?’
‘Well, “toves” are something like badgers—they’re something like lizards—and they’re something like corkscrews.’
‘They must be very curious looking creatures.’
‘They are that,’ said Humpty Dumpty: ‘also they make their nests under sun-dials—also they live on cheese.’
‘And what’s the “gyre” and to “gimble”?’
‘To “gyre” is to go round and round like a gyroscope. To “gimble” is to make holes like a gimlet.’
‘And “the wabe” is the grass-plot round a sun-dial, I suppose?’ said Alice, surprised at her own ingenuity.
‘Of course it is. It’s called “wabe,” you know, because it goes a long way before it, and a long way behind it—’
‘And a long way beyond it on each side,’ Alice added.
‘Exactly so. Well, then, “mimsy” is “flimsy and miserable” (there’s another portmanteau for you). And a “borogove” is a thin shabby-looking bird with its feathers sticking out all round—something like a live mop.’
‘And then “mome raths”?’ said Alice. ‘I’m afraid I’m giving you a great deal of trouble.’
‘Well, a “rath” is a sort of green pig: but “mome” I’m not certain about. I think it’s short for “from home”—meaning that they’d lost their way, you know.’
‘And what does “outgrabe” mean?’
‘Well, “outgrabing” is something between bellowing and whistling, with a kind of sneeze in the middle: however, you’ll hear it done, maybe—down in the wood yonder—and when you’ve once heard it you’ll be quite content. Who’s been repeating all that hard stuff to you?’
‘I read it in a book,’ said Alice. ‘But I had some poetry repeated to me, much easier than that, by—Tweedledee, I think it was.’
‘As to poetry, you know,’ said Humpty Dumpty, stretching out one of his great hands, ‘I can repeat poetry as well as other folk, if it comes to that—’
‘Oh, it needn’t come to that!’ Alice hastily said, hoping to keep him from beginning.
‘And “the wabe” is the grass-plot round a sun-dial, I suppose?’ said Alice, surprised at her own ingenuity.
‘Of course it is. It’s called “wabe,” you know, because it goes a long way before it, and a long way behind it—’
‘And a long way beyond it on each side,’ Alice added.
‘Exactly so. Well, then, “mimsy” is “flimsy and miserable” (there’s another portmanteau for you). And a “borogove” is a thin shabby-looking bird with its feathers sticking out all round—something like a live mop.’
‘And then “mome raths”?’ said Alice. ‘I’m afraid I’m giving you a great deal of trouble.’
‘Well, a “rath” is a sort of green pig: but “mome” I’m not certain about. I think it’s short for “from home”—meaning that they’d lost their way, you know.’
‘And what does “outgrabe” mean?’
‘Well, “outgrabing” is something between bellowing and whistling, with a kind of sneeze in the middle: however, you’ll hear it done, maybe—down in the wood yonder—and when you’ve once heard it you’ll be quite content. Who’s been repeating all that hard stuff to you?’
‘I read it in a book,’ said Alice. ‘But I had some poetry repeated to me, much easier than that, by—Tweedledee, I think it was.’
‘As to poetry, you know,’ said Humpty Dumpty, stretching out one of his great hands, ‘I can repeat poetry as well as other folk, if it comes to that—’
‘Oh, it needn’t come to that!’ Alice hastily said, hoping to keep him from beginning.
Trying to create a dictionarly list and using hydra to do a dictionary attack:
1
2
html2dic poetry.txt >output.txt
hydra -l alice -P output.txt 10.10.221.32 -t 64 ssh
That didn’t work.
Apparently, I can cd into alice’s home directory but cannot list the directories.
So apparently there’s a private key in .ssh that I can access. HMMMM 
Well the secret key for ssh works. :P
Huhh
we need to check sudo -l privs. We can run :-; linpeas which does it without asking for a password so it must be possible.
so reading the contents.
It needs a different hostname:
So we’re in:
Flag 2
reversing the string:
1
thm{bc2337b6f97d057b01da718ced6ead3f}