> For the complete documentation index, see [llms.txt](https://cybersec.th4ntis.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cybersec.th4ntis.com/hackthebox/starting-point/tier-1/funnel.md).

# Funnel

## Initial Scan

```nmap
sudo nmap -T4 -Pn -sV -sC -v 10.129.246.65 -oA Funnel
```

<figure><img src="https://667808901-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTdW22AGCceN8oUXfdlKI%2Fuploads%2FbzFe7QF4OVAZN8qvTMwF%2Fimage.png?alt=media&amp;token=4db9ef92-aa4c-4823-93aa-2ff37d8e8a98" alt=""><figcaption></figcaption></figure>

## Task 1

How many TCP ports are open?

Answer: 2

## Task 2

What is the name of the directory that is available on the FTP server?

<figure><img src="https://667808901-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTdW22AGCceN8oUXfdlKI%2Fuploads%2F4ZR2Ut1HBoc9CmbRx98B%2Fimage.png?alt=media&amp;token=dc9b28c6-58ee-4d55-b105-2b4aa5c86467" alt=""><figcaption></figcaption></figure>

Answer: mail\_backup

## Task 3

What is the default account password that every new member on the "Funnel" team should change as soon as possible? - Look in the .pdf file from the FTP server.

<figure><img src="https://667808901-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTdW22AGCceN8oUXfdlKI%2Fuploads%2F1dUz4N2545RkEozpYFeX%2Fimage.png?alt=media&amp;token=6274a70b-952b-434e-85a2-5f073de354ce" alt=""><figcaption></figcaption></figure>

Answer: funnel123#!#

## Task 4

Which user has not changed their default password yet?

<figure><img src="https://667808901-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTdW22AGCceN8oUXfdlKI%2Fuploads%2FeDiZuSNEczuDIcSEPhA2%2Fimage.png?alt=media&amp;token=e46007c0-f247-4279-a941-d3fbbd344a7c" alt=""><figcaption></figcaption></figure>

<figure><img src="https://667808901-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTdW22AGCceN8oUXfdlKI%2Fuploads%2FzPqlQJnOw5F8ujkQl30Y%2Fimage.png?alt=media&amp;token=cf94d985-642c-49a0-8f47-29eb8cdafe01" alt=""><figcaption></figcaption></figure>

Answer: christine

## Task 5

Which service is running on TCP port 5432 and listens only on localhost?

<figure><img src="https://667808901-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTdW22AGCceN8oUXfdlKI%2Fuploads%2FW8tY7QfxIgfvIXYGJdA1%2Fimage.png?alt=media&amp;token=e7274c90-9427-4954-a9bc-e0bfb85cdabe" alt=""><figcaption></figcaption></figure>

Answer: postgresql

## Task 6

Since you can't access the previously mentioned service from the local machine, you will have to create a tunnel and connect to it from your machine. What is the correct type of tunneling to use? remote port forwarding or local port forwarding?

Answer: local port tunneling

## Task 7

What is the name of the database that holds the flag?

<figure><img src="https://667808901-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTdW22AGCceN8oUXfdlKI%2Fuploads%2FLkyZnh8KIdoQC2JRZfmO%2Fimage.png?alt=media&amp;token=5b4ffa57-4399-49c5-a5b7-56036ccc728d" alt=""><figcaption></figcaption></figure>

<figure><img src="https://667808901-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTdW22AGCceN8oUXfdlKI%2Fuploads%2FNRlXwMjlM74JUdLEu7v6%2Fimage.png?alt=media&amp;token=675da219-07d9-49c0-9b76-70ae88ac30c3" alt=""><figcaption></figcaption></figure>

<figure><img src="https://667808901-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTdW22AGCceN8oUXfdlKI%2Fuploads%2FWC66mmPkwkoGL3RzXeGG%2Fimage.png?alt=media&amp;token=7b014fe6-9b92-4851-93d6-5b30844a84d1" alt=""><figcaption></figcaption></figure>

Answer: Secrets

## Task 8

Could you use a dynamic tunnel instead of local port forwarding? Yes or No.

Answer: Yes

## Task 9

Submit Root Flag

<figure><img src="https://667808901-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTdW22AGCceN8oUXfdlKI%2Fuploads%2FaTfgydNTAuAcMBYwZcsC%2Fimage.png?alt=media&amp;token=bb646694-c813-4c41-93ca-102fc402cdcf" alt=""><figcaption></figcaption></figure>

Answer: cf277664b1771217d7006acdea006db1