🐱 Hack The Box Starting Point: Meow Walkthrough

Welcome to the first walkthrough in our Hack The Box Starting Point series. If you're reading this, you're probably new to penetration testing, or maybe you've done some CTFs but want to understand the methodology better.

Meow is intentionally simple. It's designed to introduce you to the fundamentals of penetration testing: enumeration, port scanning, and understanding the risks of legacy protocols.

By the end of this post, you'll understand:

• How to verify connectivity to a target
• How to scan for open ports and services
• The security risks of telnet
• How weak credentials can lead to complete system compromise
• Basic post-exploitation techniques

Let's get started.

---

🎯 The Objective

Meow is a very easy Linux machine that teaches basic enumeration and the dangers of legacy protocols. Your goal is to:

1. Connect to the HTB network
2. Enumerate the target machine
3. Exploit a misconfigured service
4. Retrieve the flag

What you'll learn:

• Basic network enumeration (ping)
• Port scanning with nmap
• Interacting with telnet services
• The risks of default/weak credentials
• Reading files on Linux systems

Difficulty: Very Easy (Tier 0)

---

🔍 Initial Setup

Understanding Virtual Machines (VMs)

Before we start, let's clarify what we're working with. VM stands for Virtual Machine—a software-based emulation of a computer system. HTB machines are VMs running on HTB's infrastructure. When you "spawn" a machine, you're starting a VM that's been configured with intentional vulnerabilities for you to practice on.

Think of it like this: instead of needing physical hardware, you're accessing a virtual computer over the network. This is safer, cheaper, and allows HTB to reset machines easily after each use.

Using a Terminal

To interact with HTB machines and run commands, you need a terminal (also called a console or shell). A terminal is a text-based interface where you type commands and see text output.

How to get a terminal:

• Linux: Open Terminal (usually Ctrl+Alt+T)
• macOS: Open Terminal (Applications → Utilities → Terminal)
• Windows: Use PowerShell, Command Prompt, or install WSL (Windows Subsystem for Linux)
• HTB Pwnbox: Already has a terminal built-in

The terminal is where you'll run all your penetration testing commands—from connecting to the VPN to scanning ports to exploiting services.

Connecting to HTB Network with OpenVPN

Before you can attack any HTB machine, you need to connect to their network. HTB uses OpenVPN to form a VPN (Virtual Private Network) connection into their labs.

What is OpenVPN? OpenVPN is an open-source VPN protocol that creates a secure, encrypted tunnel between your computer and HTB's network. This allows you to access machines that aren't publicly available on the internet.

How to connect:

1. Download your OpenVPN configuration:

   • Log into HTB
   • Go to "Access" → "OpenVPN"
   • Download your personal .ovpn file (this contains your unique credentials)

2. Connect using OpenVPN:

   • Linux: sudo openvpn yourfile.ovpn
   • macOS: sudo openvpn yourfile.ovpn (install via Homebrew if needed)
   • Windows: Use OpenVPN GUI client
   • HTB Pwnbox: Already connected, skip this step

3. Verify connection:

   • You should see "Initialization Sequence Completed" when connected
   • Your terminal will show a new network interface (usually tun0)

Alternative: HTB also offers Pwnbox—an in-browser Linux environment that's already connected to the HTB network. This is easier for beginners since you don't need to set up OpenVPN yourself.

Spawning the Machine

Once you're connected to the HTB network (via OpenVPN or Pwnbox), you need to start the vulnerable machine:

1. Go to the Starting Point page
2. Find the Meow machine
3. Click "Spawn Machine" — this starts the vulnerable VM
4. Wait a minute or two for it to boot up
5. Note the target IP address — you'll need this for all your commands

Important: HTB machines automatically shut down after a certain period of inactivity. If your machine stops responding, you may need to spawn it again.

---

📡 Step 1: Reconnaissance

Verifying Connectivity with Ping

First, let's make sure we can reach the target machine. The tool we use to test our connection to the target with an ICMP echo request is ping.

What is ping? ping sends ICMP (Internet Control Message Protocol) echo requests to a target and waits for echo replies. If you get replies, the target is reachable and responding. It's the most basic network connectivity test.

ping -c 4 <target_ip>

What this does:

• ping — Sends ICMP echo requests to test network connectivity
• -c 4 — Send 4 packets then stop (Linux/macOS)
• <target_ip> — Replace with the actual IP address from HTB

Expected output:

PING <target_ip> (<target_ip>) 56(84) bytes of data.
64 bytes from <target_ip>: icmp_seq=1 ttl=63 time=XX ms
64 bytes from <target_ip>: icmp_seq=2 ttl=63 time=XX ms
64 bytes from <target_ip>: icmp_seq=3 ttl=63 time=XX ms
64 bytes from <target_ip>: icmp_seq=4 ttl=63 time=XX ms

--- <target_ip> ping statistics ---
4 packets transmitted, 4 received, 0% packet loss

If you see responses, you're connected! If not, check:

• Is the machine spawned?
• Are you connected to the HTB network?
• Did you use the correct IP address?

Pro tip: On Windows, use ping -n 4 <target_ip> instead of -c 4.

---

🔍 Step 2: Port Scanning

Now that we know the machine is alive, let's find out what services are running. The name of the most common tool for finding open ports on a target is nmap (Network Mapper).

What is nmap? nmap is the industry-standard port scanning tool used by penetration testers, network administrators, and security professionals. It can discover open ports, identify services, detect versions, and much more.

Basic Nmap Scan

nmap -sV <target_ip>

What this does:

• nmap — The port scanning tool
• -sV — Version detection (tries to identify service versions)
• <target_ip> — The target machine's IP address

Note: You might need sudo for some scan types, but basic scans usually work without it.

Expected output:

Starting Nmap 7.94 ( https://nmap.org ) at 2026-02-01 12:00 UTC
Nmap scan report for <target_ip>
Host is up (0.XXs latency).
Not shown: 999 closed tcp ports (reset)
PORT   STATE SERVICE VERSION
23/tcp open  telnet   Linux telnetd

What we learned:

• Port 23/tcp is open
• The service is telnet
• It's running Linux telnetd

Understanding the Results

Port 23 is the default port for telnet, an old protocol used for remote terminal access. Telnet is insecure because:

• All data (including passwords) is sent in plain text
• No encryption
• Vulnerable to man-in-the-middle attacks
• Should never be used in production environments

Modern systems use SSH (port 22) instead, which encrypts all communication.

---

🚨 Step 3: Exploitation

Connecting via Telnet

Since telnet is running, let's try to connect to it:

telnet <target_ip> 23

What this does:

• telnet — The telnet client
• <target_ip> — Target machine IP
• 23 — Port number (optional since 23 is the default)

Expected output:

Trying <target_ip>...
Connected to <target_ip>.
Escape character is '^]'.

Meow login:

The machine is asking for a login. This is where we need to think about common misconfigurations.

Trying Default Credentials

In penetration testing, one of the first things you check is default or weak credentials. Many systems are deployed with:

• Default usernames (admin, root, user)
• Blank passwords
• Weak passwords (password, 12345, etc.)

The username that is able to log into the target over telnet with a blank password is root.

When prompted for login, type:

root

Then press Enter. When it asks for a password, press Enter again (blank password—just hit Enter without typing anything).

Expected result:

Meow login: root
Password: 
Welcome to Ubuntu 20.04.3 LTS (GNU/Linux 5.4.0-74-generic x86_64)

 * Documentation:  https://help.ubuntu.com
 * Management:     https://landscape.canonical.com
 * Support:        https://ubuntu.com/advantage

root@Meow:~#

Success! We're logged in as root with no password required.

What happened:

• The machine was configured with a blank root password
• This is a critical security misconfiguration
• We now have full administrative access to the system

---

🏴 Step 4: Post-Exploitation

Finding the Flag

HTB machines always have a flag file that proves you've compromised the system. Let's find it.

Common locations for flags:

• /root/flag.txt
• /root/root.txt
• /home/<user>/user.txt
• /flag.txt

Let's check the most common location first:

cat /root/flag.txt

What this does:

• cat — Display file contents
• /root/flag.txt — The flag file path

Expected output:

<flag_content>

Success! You've found the flag. Copy this and submit it on the HTB platform to mark the machine as complete.

Understanding What We Did

Let's break down what we accomplished:

1. Reconnaissance — Verified the machine was reachable
2. Enumeration — Discovered telnet running on port 23
3. Exploitation — Connected via telnet and logged in with default credentials
4. Post-exploitation — Retrieved the flag

This is the basic penetration testing methodology: recon → enumerate → exploit → post-exploit.

---

✅ HTB Task Answers Summary

If you're working through HTB's questions, here are the answers:

1. What does the acronym VM stand for? → Virtual Machine
2. What tool do we use to interact with the operating system? → terminal (also called console or shell)
3. What service do we use to form our VPN connection into HTB labs? → openvpn
4. What tool do we use to test our connection with an ICMP echo request? → ping
5. What is the most common tool for finding open ports? → nmap
6. What service do we identify on port 23/tcp? → telnet
7. What username logs in over telnet with a blank password? → root

---

💡 Key Takeaways

What You Learned

1. VM (Virtual Machine) — Understanding what VMs are and how HTB uses them
2. Terminal — Using a command-line interface to interact with the operating system
3. OpenVPN — Connecting to HTB's network via VPN
4. ping — Testing connectivity with ICMP echo requests
5. nmap — Finding open ports on a target
6. telnet — Identifying the service on port 23/tcp
7. root — The username that works with a blank password
8. Legacy protocol risks — Why telnet is dangerous
9. Weak credentials — The dangers of default/blank passwords
10. Basic Linux commands — cat for reading files

Why This Matters in Real Penetration Testing

Legacy protocols like telnet are still found in:

• Old industrial control systems
• Legacy network equipment
• Systems that haven't been updated
• Embedded devices

Weak credentials are one of the most common vulnerabilities:

• Default passwords on network devices
• Blank passwords on test systems that made it to production
• Weak passwords that never got changed

What this teaches you:

• Always check for default credentials
• Legacy protocols are security risks
• Proper authentication is critical
• Misconfigurations can lead to complete compromise

---

🔒 Security Lessons

For System Administrators

Never use telnet in production:

• Use SSH instead (encrypted, secure)
• Disable telnet if it's not needed
• If you must use telnet, restrict access with firewalls

Always change default credentials:

• Set strong passwords for all accounts
• Disable default accounts when possible
• Use password policies to enforce complexity

Regular security assessments:

• Scan your network for open services
• Check for default credentials
• Identify legacy protocols that need to be replaced

For Penetration Testers

This machine demonstrates:

• The importance of thorough enumeration
• How simple misconfigurations can lead to compromise
• Why checking default credentials is essential
• The value of understanding service versions

In real assessments:

• Always check for default credentials
• Identify legacy protocols and their risks
• Document misconfigurations clearly
• Explain the business impact of findings

---

🛠 Alternative Approaches

More Thorough Scanning

You could do a more comprehensive scan:

nmap -p- -sV <target_ip>

What this does:

• -p- — Scan all 65,535 ports (takes longer)
• -sV — Version detection

For this machine, it's overkill, but it's good practice for more complex targets.

Using Nmap Scripts

Nmap has scripts that can automate common checks:

nmap --script telnet-brute <target_ip>

This would try to brute force telnet credentials, though for this machine it's unnecessary since blank password works.

---

🚨 Common Issues

"Connection refused" or "Connection timed out"

Problem: Can't connect to the machine.

Solutions:

• Make sure the machine is spawned
• Verify you're connected to HTB network (Pwnbox or OpenVPN)
• Check that you're using the correct IP address
• Wait a minute for the machine to fully boot

"Permission denied" when using nmap

Problem: Nmap needs elevated privileges for some scan types.

Solution: Use sudo:

sudo nmap -sV <target_ip>

Telnet command not found

Problem: Telnet client isn't installed.

Solution: Install it:

• Linux: sudo apt install telnet (Debian/Ubuntu) or sudo yum install telnet (RHEL/CentOS)
• macOS: Usually pre-installed, but can install via Homebrew if needed
• Windows: Enable via "Turn Windows features on or off" → Telnet Client

---

📚 Additional Resources

• Nmap Documentation — Complete guide to port scanning
• HTB Meow Machine Page — Official machine page
• Telnet Security Risks — Why telnet is insecure
• HTB Starting Point Guide — Official HTB documentation

---

🎯 What's Next?

Now that you've completed Meow, you're ready for the next machine in Tier 0: Fawn.

Fawn will teach you:

• FTP enumeration
• Anonymous access
• File transfer protocols
• Directory traversal basics

But first, make sure you:

• ✅ Successfully completed Meow
• ✅ Understand the basic methodology (recon → enumerate → exploit)
• ✅ Know how to use nmap for port scanning
• ✅ Understand why telnet is insecure

---

📊 Completion Proof

I successfully completed Meow on June 11, 2025. You can verify the completion here.

---

Questions about Meow or penetration testing? Reach out directly:

• Email: m1k3@msquarellc.net
• Phone: (559) 670-3159
• Schedule: Book a free consultation

---

M Square LLC
Cybersecurity | Penetration Testing | No-Nonsense Advice