This is the first in a series of walkthroughs for the ThunderDome multi-cloud Cyber Range from Pwned Labs. This post will guide you through capturing the first flag, "Emerge Through the Breach". In the process, I will cover various tools and techniques, illustrating that there are multiple ways to achieve an objective.

Beginners can benefit from replicating this tradecraft, and even pros might learn a new thing or two! Walkthroughs also give me the opportunity to solidify and refresh my own understanding of offensive security concepts.

data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7

Starting point 🎯

Since all we have to start with is the IP address 44.208.228.94, it makes sense to scan it and see what we find. Run nmap, rustscan, masscan or your port scanner of choice. You just need to run a tool with options that give you a reliable scan.

$ nmap -v -Pn -sCV -T4 -oN nmap.out 44.208.228.94

Quick breakdown of the Nmap flags

I'm not going to go into a lot of detail as there are plenty of Nmap tutorials out there and also the official docs.

• v - verbose output in real time
• Pn - skip host discovery (useful if ping requests are blocked)
• sCV - C - detect common vulnerabilities, V - detect versions
• T4 - timing template - T1 is slowest and stealthiest and T5 is the most aggressive - fastest but noisiest and may overwhelm a host. Lower timings can provide more accurate results
• oN - normal output (as opposed to XML or grepable
• You can use A instead of sCV to give you OS versions (if detected) and traceroute output as well as what sCV provides

The Nmap output shows a few interesting things:

• Ports 22, 80 and 443 are open
• HTTP is being served on port 443, which is not a standard configuration
• 44.208.228.94 resolves to ec2-44-208-228-94.compute-1.amazonaws.com