My school has setup a webserver with mutillidae installed for us to train our hacking skills. Our goal is to find a text file. After some hacking done, I'm currently able to use remote desktop connection and login to the webserver with administrator rights. However, after searching everywhere i still couldn't find the text file. I'm sure it's not inside the webserver.
Is it possible that the file is on other machine that only the webserver is able to connect to it? If so, how?
What are the possible clues i can gather from the webserver in order to find the text file?

  • What information do you have on the text file? Do you have a file name, or just some idea of its contents? If you have a file name, do the following from an elevated command prompt (presuming the target is running Windows): cd /d C:\ & dir filename /a /s. Repeat for each drive letter until found. If you don't find it this way, it's probably not there.
    – Iszi
    Sep 7, 2012 at 14:41
  • I only know the filename. It's called confidential.txt. I tried the command you gave.. it says file not found instantly.
    – ysj
    Sep 8, 2012 at 15:31
  • It shouldn't be instant. It should take some time for the system to search the entire partition. Sounds like you've got some other limitation to your access, possibly.
    – Iszi
    Sep 8, 2012 at 18:55
  • @shaun what is the operating system?
    – schroeder
    Sep 10, 2012 at 18:58
  • It's windows xp 3.
    – ysj
    Sep 11, 2012 at 4:07

1 Answer 1


I don't have permission to comment yet so I'll have to add this as an answer.

  1. You can try using the command net use and net view to see what the server is currently accessing over the network.
  2. You could go to start->run->compmgmt.msc then look at Shared Folders and see if anything is currently open on a different server from the current server you're on. (thanks Iszi for the shorter path to shares)
  3. Another kind of odd possibility is that the file confidential.txt is stored in an Alternate Data Stream in which case you can use Sysinternals Streams to search for existing streams.

It's hard to help in this situation because there could be any number of different things used to hide the file; there could even be a "rootkit" like system driver installed to hide files from user view but depending on the level of the challenge, that might not be the case.

  • 1
    To shorten the route to folder shares, run compmgmt.msc instead of starting from mmc.
    – Iszi
    Sep 11, 2012 at 14:55
  • after executing net view command, i only see the computer itself. For the shares, i went to look at all the shares but still cannot find it :(
    – ysj
    Sep 11, 2012 at 15:30
  • @shaun are there any kind of "rules of engagement" for this or a set of instructions or knowns for this assignment? Does the assignment guarantee anything about the file confidential.txt?
    – vane
    Sep 11, 2012 at 17:33
  • nope. No special instructions were given. My teacher is sure there is confidential.txt hidden.Well, i tried pivoting but end up stuck to login smb client. Could it be steganography?
    – ysj
    Sep 11, 2012 at 18:28
  • @shaun It could be, but like I said, it could by any number of things. There are a ton of ways to hide files on a system. Did you try searching for Alternate Data Streams? Without any guidelines from your teacher I would think it couldn't be too hidden because once you get into the realm of steg and other such techniques, it really is a needle in a hay stack when you're looking at a whole server which could have over a hundred thousand files on it. I'm afraid we'd (at least I would) need more context surrounding the challenge and what has been provided to you.
    – vane
    Sep 11, 2012 at 18:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .