🐱 HTB Meow — Solution Notes

Platform: Hack The Box — Starting Point (Tier 0) Machine: Meow OS: Linux Difficulty: Very Easy Vulnerability Type: Telnet

🗺️ Attack Chain

Ping → Nmap → Telnet (Port 23) discovery → No Password Root → Shell Access → Flag

🧠 How Does a Hacker Think? — Before You Begin

Before starting any machine, the first question should be: "Is the target up and is my connection working?"

1️⃣ Reconnaissance

bash

ping 10.129.41.224

If you get replies, proceed.

bash

nmap -sV -sC -O 10.129.41.224

Findings:

• Port 23 → Telnet (Linux telnetd)

💡 What is Telnet?

2️⃣ Exploitation — No-Password Telnet Access

bash

telnet 10.129.41.224

Meow login: root
Password: (press Enter, no password needed)

If you see the welcome banner and shell prompt (root@Meow:~#), you've gained root access.

bash

root@Meow:~# cat flag.txt

🧠 How Does a Hacker Think? — Why Did This Vulnerability Exist?

Scenario 1 — Lab Environment: HTB intentionally leaves machines vulnerable for educational purposes.

4️⃣ Remediation

bash

# Disable Telnet entirely
sudo systemctl disable telnetd
sudo systemctl stop telnetd

# Use SSH instead (encrypted, secure)
sudo systemctl enable ssh
sudo systemctl start ssh

# Force SSH key-based authentication (disable passwords)
# Edit /etc/ssh/sshd_config:
PasswordAuthentication no
PubkeyAuthentication yes

📚 Concepts Learned

• Telnet: Port 23, unencrypted remote shell protocol (deprecated)
• No-password authentication: Critical vulnerability in lab/legacy systems
• Ping → Nmap flow: Always verify target is up before exploitation
• SSH over Telnet: SSH is encrypted and should be used instead
• Default security misconfigurations: Lab machines often have intentionally weak security

🔑 General Hacker Mindset Summary

1. Ping first, then nmap: Verify the target is alive and VPN is working.
2. Check for old protocols: Telnet, FTP, HTTP (unencrypted) often have misconfigurations.
3. Try default/no credentials first: Lab machines frequently have root:root or root:(blank).
4. SSH is always better: If you have a choice between Telnet and SSH, SSH is secure.
5. Lab != Production: What you see here (no password root access) should never happen in a real network.