The stories and information posted here are artistic works of fiction and falsehood. Only a fool would take anything posted here as fact.
Thirteen Years of Service
Posts: 1,185
Threads: 62
RE: [Walkthrough] De-ICE S1.100 06-11-2013, 12:33 PM
#11
How I got root:
Step 1: start the VM.
Step 2: wait for the Slax logo to appear.
Step 3: enter:
Step 4: wait for "slax login: ".
Step 5:
Code:
slax login: root
password: toor
De-ICE Wrote:root@slax:~#
Code:
root@slax:~# whoami
root
root@slax:~# oh-ho!
-bash: oh-ho!: command not found
@
shp0ngl3, is this valid?
![[+]](https://sinister.ly/images/modern/collapse_collapsed.png)
•
Thirteen Years of Service
Posts: 664
Threads: 57
RE: [Walkthrough] De-ICE S1.100 06-11-2013, 12:46 PM
#12
Hahaha :lol: that made me laugh
Well, it's valid if you have physical access to the server
And you have since it's a VM on localhost
Try it on
www.hack.me I think they have the De-ICE discs there
•
Thirteen Years of Service
Posts: 1,185
Threads: 62
RE: [Walkthrough] De-ICE S1.100 06-11-2013, 12:59 PM
#13
•
Thirteen Years of Service
Posts: 664
Threads: 57
RE: [Walkthrough] De-ICE S1.100 06-11-2013, 01:05 PM
#14
There's a scenario as well
Quote:The scenario for this LiveCD is that a CEO of a small company has been pressured by the Board of Directors to have a penetration test done within the company. The CEO, believing his company is secure, feels this is a huge waste of money, especially since he already has a company scan their network for vulnerabilities (using nessus). To make the BoD happy, he decides to hire you for a 5-day job; and because he really doesn't believe the company is insecure, he has contracted you to look at only one server - a old system that only has a web-based list of the company's contact information.
The CEO expects you to prove that the admins of the box follow all proper accepted security practices, and that you will not be able to obtain access to the box. Prove to him that a full penetration test of their entire corporation would be the best way to ensure his company is actually following best security practices.
Source:
http://vulnhub.com/entry/de-ice_s1100-level-1,8/
•
Thirteen Years of Service
Posts: 1,185
Threads: 62
RE: [Walkthrough] De-ICE S1.100 06-11-2013, 01:09 PM
#15
(06-11-2013, 01:05 PM)shp0ngl3 Wrote: There's a scenario as well
Quote:The scenario for this LiveCD is that a CEO of a small company has been pressured by the Board of Directors to have a penetration test done within the company. The CEO, believing his company is secure, feels this is a huge waste of money, especially since he already has a company scan their network for vulnerabilities (using nessus). To make the BoD happy, he decides to hire you for a 5-day job; and because he really doesn't believe the company is insecure, he has contracted you to look at only one server - a old system that only has a web-based list of the company's contact information.
The CEO expects you to prove that the admins of the box follow all proper accepted security practices, and that you will not be able to obtain access to the box. Prove to him that a full penetration test of their entire corporation would be the best way to ensure his company is actually following best security practices.
Source: http://vulnhub.com/entry/de-ice_s1100-level-1,8/
Yeah, I know there is a scenario, I've read about it, but, lol, I just proved how easy it could be to get root. If there were any other objectives, I didn't notice them, so, please, let me know.
•
Thirteen Years of Service
Posts: 664
Threads: 57
RE: [Walkthrough] De-ICE S1.100 06-11-2013, 01:17 PM
#16
(06-11-2013, 01:09 PM)noize Wrote: (06-11-2013, 01:05 PM)shp0ngl3 Wrote: There's a scenario as well
Quote:The scenario for this LiveCD is that a CEO of a small company has been pressured by the Board of Directors to have a penetration test done within the company. The CEO, believing his company is secure, feels this is a huge waste of money, especially since he already has a company scan their network for vulnerabilities (using nessus). To make the BoD happy, he decides to hire you for a 5-day job; and because he really doesn't believe the company is insecure, he has contracted you to look at only one server - a old system that only has a web-based list of the company's contact information.
The CEO expects you to prove that the admins of the box follow all proper accepted security practices, and that you will not be able to obtain access to the box. Prove to him that a full penetration test of their entire corporation would be the best way to ensure his company is actually following best security practices.
Source: http://vulnhub.com/entry/de-ice_s1100-level-1,8/
Yeah, I know there is a scenario, I've read about it, but, lol, I just proved how easy it could be to get root. If there were any other objectives, I didn't notice them, so, please, let me know.
Read the key.txt in /root
And like I said, your method is valid with physical server access
•
Users browsing this thread:
