I am taking a Sec Lab class and we've been sectioned into teams and tasked with 'attacking' the other teams while 'defending' against them.

Each team is set up with 4 VMs, and we have a few days to harden them. ALL VMs live on a single server which we have physical access to (it's in the lab room). Each VM will be loaded with a flag.txt file which we cannot hide/modify/encrypt etc. The goal is to simply gain entry into other teams' VMs.

I am wondering -- since I have physical access to the server, is there any way for me to tap into all of the VMs and bypass the designated passwords? Or to inject keyloggers or something of the sort in order to collect all of the passwords?

For obvious reasons, I won't be asking this in class, but I am curious.. since everyone is focusing on plans of attack via port scans, mitm network spoofing, etc.. I am thinking of different, less brunt, approaches.

If anyone could offer some advice on what I could actually do after physically plugging into the VM farm server, please let me know!

  • Open services on the host OS, plant a backdoor account with access to the hypervisor, then simply log in and disable all their protections?
    – schroeder
    Apr 23, 2018 at 10:07
  • 4
    Befor you use physical access, you might want to check with course administrators to see if this is allowed. Competitions like this often exclude physical attacks.
    – Anders
    Apr 23, 2018 at 10:35
  • 1
    Can't you change the root password of VMs via GRUB? askubuntu.com/questions/24006/…
    – xandfury
    Apr 23, 2018 at 10:59
  • 1
    In short, if you have enough skill and determination, just about anything you want.
    – SuperAdmin
    Apr 23, 2018 at 14:03
  • 1
    What can't you do with physical access is probably a better question Jul 22, 2018 at 14:42

1 Answer 1


What you can do will to certain extent depend on the setup they have. For example, if they have full disk encryption, you can't extract the flag directly from the host OS.

Also, you can monitor their network traffic (and MITM it), but if they know what they are doing, it should all be encrypted.

However, you can always try to memory-hack the OS, as RAM will not be encrypted. By accessing the memory, you should be able to read any keys, as long as you can locate them. You can also attempt to modify the code running on the machine by simply rewriting (injecting malware) a running process with root privileges or just modifying the security software (disable checks, make it accept any password/key whatever else you need). Again, you need to be able to locate what you want to change and figure out how to change it, which may not be easy.

  • That sounds good.. I doubt a lot of teams will know to set up full disk encryption. Could you provide a few links / refs on how I might go about tapping into all of this? I’ve never done this sort of thing
    – stillot2
    Apr 23, 2018 at 10:26
  • @stillot2 All of it depends on the used VM, host OS and VM OS. Try to check for a tool to open the data file of your VM. Note that setting up encryption of home directory in Linux is easy, it even prompts you to do so on installation, so if the flag is in home directory, this may not work. Apr 23, 2018 at 10:30
  • @stillot2 To monitor the network, you can easily use any bog-standard capture software, such as WireShark. You will see the traffic as going to/from the VM. Apr 23, 2018 at 10:31
  • @stillot2 Memory hacking is far beyond what I can teach you here and now. There are tools for editing memory on almost any OS, but without the knowledge of what to extract/edit and how, it will not be helpful to you. Apr 23, 2018 at 10:32
  • Awesome. I have and understand wireshark so that's good.. and the whole class is on the same network, different IPs. Would I be just as well off capturing traffic from my own OS? Would there be a benefit to try to infiltrate host OS, install wireshark, and run from there? (I guess I could see the decrypted streams?)
    – stillot2
    Apr 24, 2018 at 5:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .