HMV Alzheimer

• Name: Alzheimer
• Difficulty: Easy
• OS: Linux
• IP: Local VM

• [[https://wiki.archlinux.org/title/Port_knocking

][Port Knocking is interesting for controlling the behavior of services]]

FTP is the only service I could access currently, and it allow anonymous login.

❰curtain❙~/workspace/shooting/hmvm/alzheimer❱✔≻ ftp [email protected]
Connected to 192.168.1.147.
220 (vsFTPd 3.0.3)
331 Please specify the password.
Password:
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp>
ftp> ls -al
200 PORT command successful. Consider using PASV.
150 Here comes the directory listing.
drwxr-xr-x    2 0        113          4096 Oct 03  2020 .
drwxr-xr-x    2 0        113          4096 Oct 03  2020 ..
-rw-r--r--    1 0        0              70 Oct 03  2020 .secretnote.txt
226 Directory send OK.
ftp> binary
200 Switching to Binary mode.
ftp> get .secretnote.txt
200 PORT command successful. Consider using PASV.
150 Opening BINARY mode data connection for .secretnote.txt (70 bytes).
226 Transfer complete.
70 bytes received in 0.0009 seconds (73.3553 kbytes/s)

The secret hints us to knocking these thress ports one by one.

❰curtain❙~/workspace/shooting/hmvm/alzheimer❱✔≻ cat secretnote.txt
I need to knock this ports and
one door will be open!
1000
2000
3000

I am not familiar with Port Knocking before, after some search with Google I get this useful page from ArchWiki.

#!/bin/bash
HOST=$1
shift
for ARG in "$@"
do
        nmap -Pn --host-timeout 100 --max-retries 0 -p $ARG $HOST
done

The SSH and Web services will open after knocking.

Starting Nmap 7.98 ( https://nmap.org ) at 2026-03-07 16:49 +0800
Nmap scan report for alzheimer (192.168.1.147)
Host is up (0.0013s latency).
Not shown: 65531 closed tcp ports (conn-refused)
PORT   STATE    SERVICE
21/tcp open     ftp
22/tcp open ssh
80/tcp open http

Then I obtain the user medusa from homepage of web, and his password store into a .txt file.

❰curtain❙~/workspace/shooting/hmvm/alzheimer❱✔≻ cat index.html
I dont remember where I stored my password :(
I only remember that was into a .txt file...
-medusa

<!---. --- - .... .. -. --. -->

And the comment seems include a morse code. I decode with a tool that I write and get 'NOTHING'.

❰curtain❙~/workspace/shooting/hmvm/alzheimer❱✔≻ echo '-. --- - .... .. -. --.' | morsecode -d
NOTHING

Then I enumerate this service by feroxbuster and get some interesting clues.

404      GET        7l       12w      169c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter
200      GET        5l       27w      132c http://192.168.1.147/
301      GET        7l       12w      185c http://192.168.1.147/admin => http://192.168.1.147/admin/
301      GET        7l       12w      185c http://192.168.1.147/home => http://192.168.1.147/home/
301      GET        7l       12w      185c http://192.168.1.147/secret => http://192.168.1.147/secret/
200      GET        2l        7w       34c http://192.168.1.147/home/index.html
301      GET        7l       12w      185c http://192.168.1.147/secret/home => http://192.168.1.147/secret/home/
200      GET        1l        8w       44c http://192.168.1.147/secret/index.html
200      GET        2l       13w       62c http://192.168.1.147/secret/home/index.html

❰curtain❙~/workspace/shooting/hmvm/alzheimer❱✔≻ curl -L http://192.168.1.147/home
Maybe my pass is at home!
-medusa

❰curtain❙~/workspace/shooting/hmvm/alzheimer❱✔≻ curl -L http://192.168.1.147/secret
Maybe my password is in this secret folder?

❰curtain❙~/workspace/shooting/hmvm/alzheimer❱✔≻ curl -L http://192.168.1.147/secret/home
Im trying a lot. Im sure that i will recover my pass!
-medusa

Seems like there is no password leaks by web service. Then I goto FTP service again, since it may be changed after port_knocking. Fortunately, I am right, the hidden file leaks by it include the password of user medusa.

❰curtain❙~/workspace/shooting/hmvm/alzheimer❱✔≻ cat .secretnote.txt
I need to knock this ports and
one door will be open!
1000
2000
3000
Iha*******************