HTB: Meow
Meow is a Very Easy Linux box that demonstrates the critical security risk of default credentials. The machine has only one open port (23/TCP - Telnet) and allows root login with a blank password.
This exposes the fundamental principle that even a single misconfiguration can lead to complete system compromise.
Path to root, at a glance:
- Scan the target → discover open port 23 (Telnet)
- Connect via Telnet → login as root with blank password
- Read the flag from root’s home directory
Nmap
┌──(r3vpwnx㉿r3vpwnx)-[~/CTF/HTB/Meow] |
The scan reveals a single open port: 23/tcp (Telnet). No other services are running, which makes Telnet the only attack vector.
The Service
Telnet is a legacy protocol that transmits all data—including credentials—in plaintext. More critically, many systems with Telnet enabled are either:
- Intended for internal use with default credentials
- Legacy systems with poor security configurations
- Training/CTF machines deliberately left vulnerable
Exploitation: Telnet with Default Credentials
Connection Attempt
Since the machine is named “Meow” and only has Telnet exposed, the logical first step is to attempt a connection and test common default credentials:
┌──(r3vpwnx㉿r3vpwnx)-[~/CTF/HTB/Meow] |
I entered root as the username and left the password blank. The system accepted this immediately.
We’re now logged in as root with full system access.
Finding the Flag
After gaining root access, I listed the contents of the root directory to locate the flag:
root@Meow:~# ls -al |
The flag is clearly visible in flag.txt. Reading it reveals the root flag:
root@Meow:~# cat flag.txt |
Task Answers
1 What does VM stand for? Virtual Machine
2 What tool do we use to interact with the OS via command line? Terminal
3 What service forms our VPN connection into HTB labs? OpenVPN
4 What tool tests connection with ICMP echo request? ping
5 Most common tool for finding open ports? nmap
6 What service is on port 23/tcp? Telnet
7 What username logs in with blank password? root
8 Submit the flag: b40ab*******************a4c19
Why It Worked (Key Vulnerabilities)
Default Credentials
The most critical vulnerability was allowing root login with a blank password. This is a fundamental security failure that should never exist in production systems.Telnet Protocol
Telnet transmits all data unencrypted, including passwords. While not directly exploited here (since no password was needed), this would make credential interception trivial on an untrusted network.Root Access by Default
Root is the most privileged account on any Unix/Linux system. Allowing direct root login (especially with no password) gives attackers complete control over the system.
Security Recommendations
- Disable Telnet entirely - Replace with SSH for secure remote access
- Enforce strong passwords - Use password policies requiring minimum complexity
- Disable root login - Use sudo with non-privileged accounts instead
- Implement authentication controls - Use multi-factor authentication where possible
- Regular security audits - Scan for open ports and default credentials
- Apply security updates - The system had 75 pending updates, including 31 security patches
Lessons Learned
This machine, despite being “Very Easy,” demonstrates a real-world vulnerability pattern:
- IoT devices often ship with default credentials and Telnet enabled
- Legacy systems frequently retain insecure services
- Training environments sometimes mirror production misconfigurations
- One vulnerability can lead to complete compromise
The complete compromise from a single open port with default credentials shows why security fundamentals—like disabling unnecessary services and enforcing authentication—remain critical in modern infrastructure.
