RowdyHacks XII: Do You Know What Will Rock You?

Challenge

Miscellaneous · 300 points. A website hints that another page exists, and the flag is several hops away.

Step 1: the hidden page

A bounded scan for .html pages finds /dakota.html, which gives the SSH username rowdy-rocks but shows the password as REDACTED. The challenge also supplies a tunnel mapping its SSH service to a local port.

Step 2: the SSH password (RockYou)

The obvious page- and title-derived passwords were rejected, so the password was a common one. A single, slow, rate-limited credential run against the first 100 entries of the local RockYou list stopped quickly at iloveu (line 22) for rowdy-rocks. On the host, /home/rowdy-rocks/flag/download.txt pointed to a website route, /flag_Rnaitnatsat.zip.

Step 3: the ZIP password (RockYou again)

The downloaded ZIP holds one encrypted flag.txt. Extracting its hash and checking it against RockYou finds the password scooter (line 455) in under a second:

zip2john flag_Rnaitnatsat.zip > flag_zip.hash
john --wordlist=/usr/share/wordlists/rockyou.txt flag_zip.hash
unzip -P scooter -p flag_Rnaitnatsat.zip flag.txt

Two independent secrets in the chain were both in the first few hundred lines of RockYou.

Takeaway

RockYou is where every attacker starts, and both gates here, an SSH login and a ZIP, fell to its first few hundred lines. The defenses are well known and compound: ban breached passwords, favor length over complexity, rate-limit and lock out SSH (or drop password auth for keys) and add MFA, and alert on the burst of failures that precedes the hit.

Flag

rowdy{bRu13_f0rC1nG-r0Ck5}