> For the complete documentation index, see [llms.txt](https://maurvan.gitbook.io/ctf-writeups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://maurvan.gitbook.io/ctf-writeups/various-challenges/index/brooklyn-nine-nine-room.md). # Brooklyn Nine-Nine (room) ## Challenge > This room is aimed for beginner level hackers but anyone can try to hack this box. There are two main intended ways to root the box. ## Solution We only receive an IP address, so we will use [nmap](https://nmap.org/) on it to check what is running.

We can see there are 3 services open. The SSH will probably be interesting but later since we don't have credentials yet. But the HTTP service shows there is a website hosted. We open the page in a browser.

There is something interesting in the code source when we inspect the page.

I then downloaded the picture so I could try some of my steganography tools on it. The only one that gave me something was [stegseek](https://github.com/RickdeJager/stegseek) which was able to extract a txt file.

Great! Now we've got a password to work with! Time to try to connect.

And we're in!

We have found the first flag.

Now we have to find a way to escalate our privilege and become root. When checking sudo configuration I found something interesting. User holt can run nano as root!

Using [GTFOBins](https://gtfobins.github.io/) we can just copy/paste their way to gain privileges. So, first type "sudo nano" which will open the nano editor. Then do CTRL+R and CTRL+X. You should see this at the bottom of your nano editor.

Type this: ``` reset; sh 1>&0 2>&0 ``` And you should have root access!

Now you only need to move to the root folder and read the root.txt file that is hidden there.

And we have the 2nd flag! Well done.