Challenge

A cluster of beginner-friendly hosts (10.1.1.100, 10.1.1.122) whose flags came from basic enumeration rather than exploitation.

SNMP (10.1.1.100)

10.1.1.100 had SNMP open on 161 with the default public community string. snmpwalk read the system description fields, and the flag was sitting in sysLocation:

snmpwalk -v2c -c public 10.1.1.100:161
SNMPv2-MIB::sysLocation.0 = STRING: "flag:{Why4r3Y0uR34d1ngTh1s?}"

Backdoor ports (10.1.1.122)

A full port scan of 10.1.1.122 found extra services on high ports. Two of them just printed flags on connect:

nc 10.1.1.122 13337   ->  flag:{B4ckd00rL337P0r7s}

nc 10.1.1.122 60000
Welcome to Milton's h4x0r reverse shell...
# cat FLAG.txt
FLAG:H4lfB4k3dRev3rs3Sh3ll

(Port 22 on this host had a deliberately broken SSH, and a flag.txt reading {7h15_15_0bv10u51y_7h3_f14g} was a decoy that the scoreboard rejected.)

Flags

  • Why4r3Y0uR34d1ngTh1s?
  • B4ckd00rL337P0r7s
  • H4lfB4k3dRev3rs3Sh3ll