Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 1 down vote favorite

My school has setup a webserver with mutillidae installed for us to train our hacking skills. Our goal is to find a text file. After some hacking done, I'm currently able to use remote desktop connection and login to the webserver with administrator rights. However, after searching everywhere i still couldn't find the text file. I'm sure it's not inside the webserver.
Is it possible that the file is on other machine that only the webserver is able to connect to it? If so, how?
What are the possible clues i can gather from the webserver in order to find the text file?

share|improve this question
What information do you have on the text file? Do you have a file name, or just some idea of its contents? If you have a file name, do the following from an elevated command prompt (presuming the target is running Windows): cd /d C:\ & dir filename /a /s. Repeat for each drive letter until found. If you don't find it this way, it's probably not there. – Iszi Sep 7 '12 at 14:41
I only know the filename. It's called confidential.txt. I tried the command you gave.. it says file not found instantly. – ysj Sep 8 '12 at 15:31
It shouldn't be instant. It should take some time for the system to search the entire partition. Sounds like you've got some other limitation to your access, possibly. – Iszi Sep 8 '12 at 18:55
@shaun what is the operating system? – schroeder Sep 10 '12 at 18:58
It's windows xp 3. – ysj Sep 11 '12 at 4:07
show 1 more comment

1 Answer

up vote 1 down vote

I don't have permission to comment yet so I'll have to add this as an answer.

  1. You can try using the command net use and net view to see what the server is currently accessing over the network.
  2. You could go to start->run->compmgmt.msc then look at Shared Folders and see if anything is currently open on a different server from the current server you're on. (thanks Iszi for the shorter path to shares)
  3. Another kind of odd possibility is that the file confidential.txt is stored in an Alternate Data Stream in which case you can use Sysinternals Streams to search for existing streams.

It's hard to help in this situation because there could be any number of different things used to hide the file; there could even be a "rootkit" like system driver installed to hide files from user view but depending on the level of the challenge, that might not be the case.

share|improve this answer
1  
To shorten the route to folder shares, run compmgmt.msc instead of starting from mmc. – Iszi Sep 11 '12 at 14:55
after executing net view command, i only see the computer itself. For the shares, i went to look at all the shares but still cannot find it :( – ysj Sep 11 '12 at 15:30
@shaun are there any kind of "rules of engagement" for this or a set of instructions or knowns for this assignment? Does the assignment guarantee anything about the file confidential.txt? – vane Sep 11 '12 at 17:33
nope. No special instructions were given. My teacher is sure there is confidential.txt hidden.Well, i tried pivoting but end up stuck to login smb client. Could it be steganography? – ysj Sep 11 '12 at 18:28
@shaun It could be, but like I said, it could by any number of things. There are a ton of ways to hide files on a system. Did you try searching for Alternate Data Streams? Without any guidelines from your teacher I would think it couldn't be too hidden because once you get into the realm of steg and other such techniques, it really is a needle in a hay stack when you're looking at a whole server which could have over a hundred thousand files on it. I'm afraid we'd (at least I would) need more context surrounding the challenge and what has been provided to you. – vane Sep 11 '12 at 18:45
show 5 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.