Rating:

See http://jtwp470.hatenablog.jp/entry/juniors-ctf


<span>I saw a dump pcap file to use Wireshark. I found the fact:</span>

  • SSH connection between 10.1.0.41 and 10.0.23.37. Port number is 38574.
  • 10.0.23.37 is alive via VPN.
  • Download .ssh/id_rsa ;)
  • See passwd: I think this is /etc/passwd. and found a user: hirsch.
<span>So, I guess I need to connect 10.0.23.37 to use SSH and .ssh/id_rsa
</span>
$ ssh -i ./id_rsa -p 38574 hirsch@10.0.23.37

The_third_season_was_sold_to_the_aliens

Connection to 10.0.23.37 closed.

Gotcha. I got a flag.
<span>
Flag: The_third_season_was_sold_to_the_aliens</span>

Original writeup (http://jtwp470.hatenablog.jp/entry/juniors-ctf).