Cyborg — TryHackMe Walktrough

Machine Info:

• Platform: TryHackMe
• Room Name: Cyborg
• OS: Linux
• Difficulty: Easy

What's up, guys! As part of my journey to document everything I learn in public, today I'm breaking down Cyborg on TryHackMe. It's tagged as an Easy Linux box — perfect for practicing our methodology without getting stuck in endless rabbit holes.

Here is the full breakdown of how I cracked it, what worked, check this out!

STEP 1: NMAP SCAN📡

nmap -sS -p- IP_ADDRESS

nmap -sS -p- IP_ADDRESS

nmap -sS -sV -p21,22,80 IP_ADDRESS

nmap -sS -sV -p21,22,80 IP_ADDRESS

STEP 2: GOBUSTER SCAN 🪓

gobuster dir --no-error -x php,html,txt -w /path/to/wordlists -u IP_ADDRESS

gobuster dir --no-error -x php,html,txt -w /path/to/wordlists -u IP_ADDRESS

Found /etc dir and /admin dir.

STEP 3: WEB ENUMERATION 🌐

/etc/squid:

Hmm, interesting. I wanna crack the hash later.

Let's see the admin dir now.

josh, adam and alex is potential user here. I can download a file here.

Extract the file.

Before continue for the next step. Crack the hash. I use hashcat here.

hashcat name_file /usr/share/wordlists/rockyou.txt

hashcat name_file /usr/share/wordlists/rockyou.txt

hash: squidward

hash: squidward

STEP 4: BORG TIME 💾

What is Borg? Borg (or BorgBackup) is a deduplicating, authenticated, and encrypted backup program designed to provide an efficient and secure way to back up daily data. Unlike traditional archiving tools.

Because it was protected with a passphrase, extracting the backed-up contents required us to recover the key from exposed hash artifacts and mount or extract the repository using the native borg utility.

Let's try it!

mkdir name_dir
borg list /path/extract/file/home/field/dev/final_archive

mkdir name_dir
borg list /path/extract/file/home/field/dev/final_archive

music_archive is the name of backup. Let's open it!

cd name_dir
borg extract /path/extract/file/home/field/dev/final_archive::music_archive

cd name_dir
borg extract /path/extract/file/home/field/dev/final_archive::music_archive

The reason I created a new dir was to avoid having duplicate home folders in the same directory.

Go to the home

This is alex's backup.

STEP 5: PRIVILEGE ESCALATION 👑

sudo -l:

Let's check for the permission:

It's owned by alex, and I can change the permission to chmod 644 then I write the reverse shell script.

sudo /etc/mp3backups/backup.sh

sudo /etc/mp3backups/backup.sh

Remediation: The Flaws & The Fixes 🛡️

The compromise of the Cyborg machine highlights how easily a system falls when multiple security layers are neglected: exposing sensitive administrative artifacts, securing backup repositories with dictionary-weak passphrases, leaving plaintext credentials inside archives, and granting root execution rights to user-writable scripts.

Here is an analysis of each vulnerability and the recommended mitigations:

1. Exposure of Sensitive Web Endpoints & Hash Artifacts (/admin & /etc)

The Flaw: The web server hosted accessible administrative routes without authentication. The /admin directory leaked internal chat logs exposing user context, while the /etc path exposed a password hash (music_archive). An attacker could discover these sensitive files via directory fuzzing tools like Gobuster.

The Fix:

• Restrict Internal Endpoints: Block public web access to administrative and configuration paths at the web server level (e.g., using Require all denied in Apache or deny all; in Nginx).
• Disable Directory Indexing: Turn off directory browsing (Options -Indexes in Apache) to ensure visitors cannot list folder contents when an index file is absent.
• Keep Internal Assets Outside the Webroot: Never store server configs, password hashes, or backup files within the public document root (/var/www/html/).

2. Weak Passphrase on Backup Repositories (Offline Dictionary Attack)

The Flaw: The Borg backup repository was protected by a weak single-word passphrase (squidward). Once the exposed hash was captured from the web directory, it was cracked offline via standard wordlists (rockyou.txt) in seconds.

The Fix:

• Enforce High-Entropy Passphrases: Encrypted backup repositories should be protected by long, randomly generated passphrases or multi-word passphrases with sufficient entropy to resist dictionary attacks.
• Implement Memory-Hard KDFs: Utilize modern, computationally intensive key derivation functions (such as Argon2id or scrypt) with appropriate time and memory costs to significantly slow down offline GPU-based hash cracking.

3. Plaintext Credentials Left Inside Backup Archives

• The Flaw: Upon extracting user alex's Borg backup archive, plaintext system credentials were found stored in an unencrypted text file. Recovering the archive immediately yielded valid SSH credentials for the host.

The Fix:

• Sanitize Data Prior to Archiving: Audit and exclude sensitive items such as plaintext credential logs, unencrypted private keys, and shell history files (.bash_history) before creating system or home directory backups.
• Centralize Secrets Management: Prohibit storing plaintext credentials on the filesystem. Use dedicated credential managers, enterprise vaults, or key-based authentication.

4. Sudo Execution Rights on a Mutable Script (/etc/mp3backups/backup.sh)

• The Flaw: The /etc/sudoers configuration allowed user alex to execute /etc/mp3backups/backup.sh as root with NOPASSWD. However, the script file was owned by alex. This allowed the unprivileged user to modify the script, replace its logic with a reverse shell payload, and trigger root execution.

The Fix:

• Enforce Strict File Ownership: Any binary or script granted execution privileges in /etc/sudoers must be owned exclusively by root (chown root:root).
• Lock Down Permissions: Restrict sudo script permissions using chmod 700 (or chmod 755 strictly owned by root). Ensure non-root users have no write access to the script or its containing parent directory (/etc/mp3backups/).

Key Takeaways & Lessons Learned 💡

Reconnaissance Beyond the Surface: Finding unconventional directories like /admin and /etc proves why thorough directory brute-forcing is crucial. A single misplaced configuration or archive can unravel the entire perimeter.

The Golden Rule of Sudoers: Never grant elevated privileges to a file that an unprivileged user can edit, overwrite, or replace. In privilege escalation, mutable code execution is functionally equivalent to handing over the root password.