Nebula level06

“(…) account credentials came from a legacy unix system” mhm:

$ cat /etc/passwd

(...)

flag06:ueqwOCnSGdsuM:993:993::/home/flag06:/bin/sh

(...)

Ah, good old DES:

$ echo ueqwOCnSGdsuM > flag06.des
$ ./john flag06.des

Loaded 1 password hash (Traditional DES [128/128 BS AVX-16])
hello            (?)

?:hello

thus:

$ su flag06
sh-4.2$ getflag
You have successfully executed getflag on a target account

Nice one.