Linux Agency Tryhackme Writeup (Part1)

Link:https://tryhackme.com/room/linuxagency

We were given ssh username and password for login to the machine via ssh.

As soon as we ssh to the machine , we get the First flag (mission1 flag)

Now , after this i did cd .. (to go back a directory) and found all the missions 1–30 and i tried cd into mission 2 but there was permission denied . so i su(switch user) to mission1 (using the flag we found earlier as password) and cd into mission1 and found the flag (mission2)

Now, i su to mission2 using the flag we found and cd into mission2 and there was file flag.txt

Command : Cat flag.txt

Cat command is used for seeing the contents of a file.

Now, we have mission3 flag as well and so su to mission3 using the flag we found now as password.Inside mission3 we found flag.txt but…

Now, i checked the hint and it was “your are too feline”

Feline means relating to cats ( i was using cat command)

Now , i thought maybe i should check for strings inside the file and ..

Now let’s su to mission4 and cd into mission4.

Inside mission4 , there was a directory called flag and i cd into that and found flag.txt and le’s cat that flag out.

Now, su to mission5 and cd into it and i found .flag.txt file inside and you don't have to do anything , just cat out the file .

Now , su to mission6 and cd into that and i did ls and found nothing , so i thought maybe it’s hidden so i did (command: ls -la) and found a hidden directory .flag and cd into that and found flag.txt

Now , su to mission7 and cd into that.

Now, su to mission8 and cd into that and found nothing . Did ls -la , found nothing and then i thought about that find command and used it.

Command: find / -type f -name flag.txt 2>/dev/null

Now let me explain this command .

• type f= it is a file
• -name = name of the file
• 2>/dev/null = without error.

Now, su to mission 9 and i found a wordlist (rockyou.txt) and if u cat out that file and try to get the flag that way , it would be like finding a needle in a haystack but thanks to Tony Stark as he explained how to find a needle in a haystack ( using a magnet ) 😂.
Command: grep ‘mission10*’ /home/mission9/rockyou.txt

Now , su to mission10 and cd into it. and again find command is our saviour.

Command:find /home/mission10/folder -type f -name flag.txt 2>/dev/null

Now , su to mission11 and cd into it and found nothing and then i starting seeing the contents of all and when i cat out .bashrc , i found

It is base64 encoded , go to cyberchef .

It is the flag but in reverse order .

Now , let’s su to mission12 and permission denied . I couldn’t cat out the file , no strings , not even transfer the file …nothing. Then after a while, i thought maybe i can grant the file permission.

Command : chmod 777 flag.txt ( only read permission is required but i like it this way, providing all three permissions( read, write,execute).

Now , su to mission13 and cat out flag.txt and we found a string(bWlzc2lvbjE0e2Q1OThkZTk1NjM5NTE0Yjk5NDE1MDc2MTdiOWU1NGQyfQo=) .It looks like base64 and it was base64

Hail cyberchef!!!!!

Now , su to mission14 and cat out flag.txt and we found a string (01101101011010010111001101110011011010010110111101101110001100010011010101111011011001100110001100110100001110010011000100110101011001000011100000110001001110000110001001100110011000010110010101100110011001100011000000110001001100010011100000110101011000110011001100110101001101000011011101100110001100100011010100110101001110010011011001111101) . it looks like binary.

Hail cyberchef!!!!

Now , su to mission15 and cat out the flag.txt and found a string (6D697373696F6E31367B38383434313764343030333363346332303931623434643763323661393038657D) . It looks like hex.

Hail cyberchef!!!!!

Now, su to mission16 and cd into it and i found a file called flag and i used {command : file flag }for knowing what it is and it looked like a executable but it was read only so i granted it permission (chmod +x flag).

Now , su to mission17 and we see a flag.java file.

Now , compile that java file using command: javac flag.java

and then run it (command: java flag)

Now , su to mission18 and i found a ruby script (flag.rb)

Command: ruby flag.rb

Now, su to mission19 and found a C program (flag.c) and compiled it .

Command: gcc flag.c -o flag

and then i got flag (program) and i ran it.

Now , su to mission20 and cd into it and found a python script (flag.py)

and ran it using python but it was not installed on it but there was python3 , so i ran it with python3

Command: python3 flag.py

Now , su to mission21 and cd into it and i got this ( see the below image) and i thought let’s get a interactive shell.

Command: python3 -c ‘import pty;pty.spawn(“/bin/bash”)’

Now , su to mission22 and this took me a while . I didn’t know how to escape that python console and after a hour , i asked for a hint from discord and someone(helpme was his name) told me that we can run system commands .

Command: import os

Command: os.system(“whoami”)

i see that i m mission22 and now see it we can get a shell

Command: os.system(“bash”)

Oh man ! Finally

Now, su to mission23 and there was a message ( The hosts will help u )

Now, i thought let’s cat out hosts

Command: cat /etc/hosts

and Now, let’s curl our flag

Now su to mission24 and there was executable bribe

and i noticed that there was a file .viminfo and i thought let’s see it’s content.

Now su to mission25 and no command was working (ls, ls -la, cat Etc.)

Now , i thought to see it it has a path or not .

Command:echo $PATH

And let’s now add a path

Command:export PATH=/bin

Now, su to mission26 and inside it was a image(flag.jpg) Now i used strings to see it’s content.

Command: strings flag.jpg | grep ‘mission27*’

Now su to mission27 and there was a file with multiple extensions and i thought to decompress it .

Command : gzip -d flag.mp3.mp4………………tar.jpg.png.gz

Now , su to mission28 and i got irb( interactive ruby ) and i searched on google to find out how to run system commands in it and it was very simple.

Command: system(“whoami”)

Now , we got the flag ( in reverse order ).

Now, su to mission29 and this one was a bit simple ( see the image and u will know what to do ).

Now , su to mission30 and there was a python script called sources.py and it displayed “Hey I have learn’t python”.

Now there is another directory .git and let’s cd into it. and after looking at the contents of files and roaming around for a while i found viktor’s flag.

Now , we have completed part 1 and passed all the missions and i will do the writeup for it’s second part(privilege escalation part )tomorrow.

Thankyou for reading my writeup and have a nice day.