← Back to SAVARA FEST CTF

FLAG 3 - SSH CREDENTIALS REUSE

Log in via SSH by reusing the password retrieved from the ICMP packets in the PCAP analysis.

Tools Used

SSHCredential Stuffing

Overview

With the target running SSH on port 22 and having recovered the credential vK9#mX7w!Qz$2n, we test for password reuse across system users.

Reconnaissance

Looking at /etc/passwd, we see a user account named user1.

Exploitation Strategy

We log in via SSH using: ssh user1@<Target-IP> and input the password vK9#mX7w!Qz$2n. This logs us in successfully and grants us the shell for user1, where we find flag3.txt.

Solution Code

ssh user1@<Target-IP>
Password: vK9#mX7w!Qz$2n
cat flag3.txt

Flag

Dynamic Flag (User 1 SSH Flag)