> For the complete documentation index, see [llms.txt](https://viperone.gitbook.io/pentest-everything/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://viperone.gitbook.io/pentest-everything/writeups/tryhackme/linux/cyberheroes.md).

# CyberHeroes

## Nmap

```
nmap 10.10.150.136 -p- -sS -sV

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.4 (Ubuntu Linux; protocol 2.0)
80/tcp open  http    Apache httpd 2.4.48 ((Ubuntu))
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
```

With only port 80 open we browse to the root page for CyberHeros.

![](/files/as5qa1xvYUoW4da8uwzO)

Running the web site through ZAP proxy with attack mode enabled reveals several pages. Viewing the response results for /login.html reveals a potential user name and password. We see the password is assigned the value [#undefined](#undefined "mention")[#undefined](#undefined "mention")RevereString".

![](/files/1arGcNK0F6uJhpaXvru2)

Using the command line we are able to reverse the string.

```bash
echo "<Password>" | rev
```

![](/files/92UUuBDvrbQGuC4jUhBu)

To reveal the correct password for the user h3ck3rBoi where, we can then grab the room flag.

![](/files/74mWdlEVghWXhuV1jZWi)