For the Impatient: A walkthrough for Born2root on Vulnhub from Offensive Security’s site

1. nmap scan reveals open ports while dirb found hidden URLs, one called http://192.168.153.49/icons/ with a text file called VDSoyuAXiO.txt (A private key)
2. Cool. Private key. ssh with it.
3. Found usernames on the start page, martin, jimmy and hadi.
4. $ssh -i id_rsa martin@192.168.153.49 and we have a toe hold for the first flag for credit in /home/martin/local.txt for credit.
5. Brute forced hadi’s password which turned out to be hadi123.
6. Which was also root’s pass lolfail
7. Last flag was /root/proof.txt for credit on the box.

This was an ‘intermediate’ box on Offensive Security’s proving grounds.

You can download these VMs, run them on your local network on like Vmware and attack them locally for educational purposes.