De-ICE Wrote:root@slax:~#

(06-11-2013, 12:46 PM)shp0ngl3 Wrote: Hahaha :lol: that made me laugh Well, it's valid if you have physical access to the server And you have since it's a VM on localhost Try it on www.hack.me I think they have the De-ICE discs there

Quote:The scenario for this LiveCD is that a CEO of a small company has been pressured by the Board of Directors to have a penetration test done within the company. The CEO, believing his company is secure, feels this is a huge waste of money, especially since he already has a company scan their network for vulnerabilities (using nessus). To make the BoD happy, he decides to hire you for a 5-day job; and because he really doesn't believe the company is insecure, he has contracted you to look at only one server - a old system that only has a web-based list of the company's contact information.

The CEO expects you to prove that the admins of the box follow all proper accepted security practices, and that you will not be able to obtain access to the box. Prove to him that a full penetration test of their entire corporation would be the best way to ensure his company is actually following best security practices.

(06-11-2013, 01:05 PM)shp0ngl3 Wrote: There's a scenario as well

Quote:The scenario for this LiveCD is that a CEO of a small company has been pressured by the Board of Directors to have a penetration test done within the company. The CEO, believing his company is secure, feels this is a huge waste of money, especially since he already has a company scan their network for vulnerabilities (using nessus). To make the BoD happy, he decides to hire you for a 5-day job; and because he really doesn't believe the company is insecure, he has contracted you to look at only one server - a old system that only has a web-based list of the company's contact information.

The CEO expects you to prove that the admins of the box follow all proper accepted security practices, and that you will not be able to obtain access to the box. Prove to him that a full penetration test of their entire corporation would be the best way to ensure his company is actually following best security practices.

Source: http://vulnhub.com/entry/de-ice_s1100-level-1,8/

(06-11-2013, 01:09 PM)noize Wrote:

(06-11-2013, 01:05 PM)shp0ngl3 Wrote: There's a scenario as well

Quote:The scenario for this LiveCD is that a CEO of a small company has been pressured by the Board of Directors to have a penetration test done within the company. The CEO, believing his company is secure, feels this is a huge waste of money, especially since he already has a company scan their network for vulnerabilities (using nessus). To make the BoD happy, he decides to hire you for a 5-day job; and because he really doesn't believe the company is insecure, he has contracted you to look at only one server - a old system that only has a web-based list of the company's contact information.

The CEO expects you to prove that the admins of the box follow all proper accepted security practices, and that you will not be able to obtain access to the box. Prove to him that a full penetration test of their entire corporation would be the best way to ensure his company is actually following best security practices.

Source: http://vulnhub.com/entry/de-ice_s1100-level-1,8/

Yeah, I know there is a scenario, I've read about it, but, lol, I just proved how easy it could be to get root. If there were any other objectives, I didn't notice them, so, please, let me know.