Hack The Box — Starting Point: FoundationsTier 0 | 01 — Meow

Very Easy · Linux · Telnet

Enumeration

The first step was to enumerate the target and identify its exposed services. I discovered that Telnet was open.

Telnet is a remote-access protocol that allows users to connect to a system and interact with its command line. However, it is considered insecure because communication is sent without encryption.

Password Attack

I extracted the RockYou wordlist using gzip. rockyou.txt is a well-known password wordlist commonly used in penetration-testing labs and CTFs.

I then used Hydra to perform a password-guessing attack against the Telnet service:

hydra -l root -P rockyou.txt <target_ip> telnet

hydra -l root -P rockyou.txt <target_ip> telnet

The attack revealed the password:

root

root

Using these credentials, I was able to authenticate to the machine through Telnet.

Useful Hydra Options

-l    Single username
-L    Username list
-p    Single password
-P    Password list
-e n  Try a blank password
-e s  Try the username as the password

-l    Single username
-L    Username list
-p    Single password
-P    Password list
-e n  Try a blank password
-e s  Try the username as the password

What I Learned

This machine introduced the basic penetration-testing process:

Enumeration → Identify the service → Research → Test credentials → Gain access

Key takeaways:

• How to identify an exposed Telnet service.
• Why Telnet is insecure.
• How password wordlists such as rockyou.txt are used.
• How Hydra automates credential-guessing attacks.
• The difference between -l/-L and -p/-P.
• How weak credentials can potentially lead to system access.

Main takeaway: Even a simple exposed service can become a serious security risk when combined with weak credentials.