TryHackMe — Inferno Box Writeup

Welcome to my walkthrough of the Inferno box from TryHackMe! This beginner-friendly CTF challenge takes you on a thematic journey through Dante’s Inferno while testing fundamental penetration testing skills. We’ll explore web enumeration, password brute-forcing, exploit research, file upload vulnerabilities, and privilege escalation.

Difficulty: Medium
Skills Tested: Port scanning, web enumeration, credential attacks, file upload exploitation, privilege escalation.

Tools & Resources Used

• Nmap: Network scanning and enumeration
• Gobuster: Directory brute-forcing
• Hydra: Credential brute-forcing
• SearchSploit: Exploit database searching
• CyberChef : Data encoding/decoding
• GTFOBins: Unix binary exploitation reference
• PentestMonkey PHP Reverse Shell: Initial access payload

Prerequisites: Connecting to TryHackMe

Before we begin, we need to establish a VPN connection to the TryHackMe network to access the target machine.

Establishing VPN Connection

Download your OpenVPN configuration file from TryHackMe’s Access page and connect using:

What to look for:

• Wait for the “Initialization Sequence Completed” message
• You’ll be assigned a TryHackMe network IP (typically 10.x.x.x range)
• Keep this terminal window open throughout your session

Verify connectivity

This should display your TryHackMe VPN interface with an assigned IP address.

My assigned IP: 192.168.177.251
Target IP: 10.49.150.45

Now we’re ready to begin our reconnaissance!

Initial Reconnaissance: Mapping the Attack Surface

Every penetration test begins with reconnaissance. Our goal is to identify all entry points into the target system.

Tools used: ping

Objective: Verify target connectivity.

Explanation: Before performing extensive scans, we verify the target is reachable using ICMP ping requests. This confirms network connectivity and that the host is online.

Comprehensive Port Scan

Tools used: Nmap — Network scanning and enumeration

Explanation: This performs a full TCP port scan:

• -p-: Scans all 65535 ports (not just the top 1000)
• -T4: Aggressive timing template for faster scanning

Analysis: The large number of open ports suggests this is a comprehensive CTF environment. The presence of HTTP (80) and HTTPS (443) makes web application testing a priority.

Web Enumeration: Discovering Hidden Paths

With HTTP services confirmed, I moved to directory brute-forcing using Gobuster:

Tools Used: Gobuster

Explanation: Gobuster performs directory brute-forcing to discover hidden content:

• -u: Specifies the target URL
• -w: Wordlist path for directory names to test
• The tool sends GET requests for each word in the wordlist and identifies valid directories based on HTTP response codes

Key Findings:

• /inferno directory discovered (Status: 401 — Unauthorized)
• This directory requires authentication to access

Why This Matters: Protected directories often contain sensitive applications or administrative interfaces. The 401-status code indicates HTTP Basic Authentication is in place.

Breaking In: Credential Attack

After discovering /inferno requires credentials, we need to identify valid usernames.

Based on the box theme and common patterns, I created a username list:

• admin:default administrative account
• inferno:matches the box theme and directory name

Brute Force Attack with Hydra🐉

Tools Used: Hydra — Credential brute-forcing

How this works:
HTTP Basic Authentication encodes credentials in base64 and sends them in the Authorization header. Hydra automates testing username/password combinations until finding valid credentials.

Success! Credentials discovered:

• Username: admin
• Password: dante1

Initial Access: Exploiting Codiad Web IDE

After authenticating with admin:dante1, I gained access to Codiad. A web-based code editor with known vulnerabilities.

Vulnerability Research

Tools Used: SearchSploit — Exploit database searching

Critical finding: Codiad 2.8.4 has authenticated Remote Code Execution vulnerabilities.

Manual Exploitation Approach

Instead of using automated exploit scripts, I manually exploited Codiad’s file upload functionality:

Step 1: Navigate to the file upload location through Codiad’s interface:

Get Rupak raj pandey’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

/themes/default/filemanager/images/codiad/manifest/files/codiad/example/INF/

Step 2: Prepare a PHP reverse shell
I used the standard PentestMonkey PHP reverse shell, modified with my attacker IP (192.168.177.251) and port (4444).

Step 3: Upload revshell.php through Codiad's file manager

• PentestMonkey PHP Reverse Shell — Initial access payload

Step 4: Set up a netcat listener:

Step 5: Trigger the shell by accessing:

Explanation:

nc: Netcat — networking utility for reading/writing network connections

-n: No DNS lookup (faster)

-v: Verbose output

-l: Listen mode

-p 4444: Listen on port 4444

Result: Reverse shell received as www-data user!

Shell Stabilization: Getting a Proper TTY

Basic reverse shells are unstable and lack features like tab completion and command history. Here’s how to upgrade:

This uses Python’s PTY (pseudo-terminal) module to spawn a fully interactive bash shell.

Post-Exploitation: Finding the User Flag

Exploring the filesystem, I discovered:

The user flag was unreadable due to permissive file permissions, so I wanted full access to dante’s account for proper lateral movement.

Lateral Movement: Decoding Hidden Credentials

While exploring dante’s home directory, I found a hidden file in the Downloads folder: .download.txt

The file contained hexadecimal-encoded data. Using CyberChef to decode the hex, I discovered:

• Italian poetry from Dante’s Inferno (fitting the theme!)
• SSH credentials at the end

Tool Used: CyberChef Data encoding/decoding

Credentials found:

• Username: dante
• Password: Virg1ll10h3lpm3

The password references Virgil, Dante’s guide through Hell in the Divine Comedy a thematically appropriate touch!

Success! Full interactive shell as the dante user.

Here, I got a user flag.

Privilege Escalation: The Path to Root

Sudo Enumeration

First, I checked what commands dante could run with elevated privileges:

Critical finding:
Dante can run /usr/bin/tee as root WITHOUT a password!

GTFOBins Research

The tee command reads from standard input and writes to both standard output and files simultaneously. According to GTFOBins, this can be exploited for privilege escalation when run with sudo.

GTFOBins: Unix binary exploitation reference.

Why is this dangerous?

• tee can write to ANY file on the system when run as root
• We can overwrite sensitive system files
• Most critically: we can modify /etc/sudoers

Exploitation: Modifying Sudoers

What this does:

• Appends a new rule to /etc/sudoers
• Grants dante permission to run ALL commands as root
• No password required (NOPASSWD)

Getting Root Shell

⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢀⣠⣤⠶⠶⠶⠶⢦⣄⡀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⣠⡾⠛⠁⠀⠀⠀⠀⠀⠀⠈⠙⢷⣄⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢀⣼⠏⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠙⢷⡀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢀⡾⠁⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠈⢿⡄⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢀⡾⠁⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠈⢿⡀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⣼⠃⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠈⣷⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢸⡇⠀⠀⠀⠀⠀⠀⠀⣀⣀⣀⣀⣀⣀⠀⠀⠀⠀⠀⠀⠀⠸⣇⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⣿⠀⠀⠀⠀⣠⡴⠞⠛⠉⠉⣩⣍⠉⠉⠛⠳⢦⣄⠀⠀⠀⠀⣿⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⣿⡀⠀⣴⡿⣧⣀⠀⢀⣠⡴⠋⠙⢷⣄⡀⠀⣀⣼⢿⣦⠀⠀⣿⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠸⣧⡾⠋⣷⠈⠉⠉⠉⠉⠀⠀⠀⠀⠉⠉⠋⠉⠁⣼⠙⢷⣼⡇⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢻⣇⠀⢻⡆⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢠⡟⠀⣸⡟⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢀⣹⣆⠀⢻⣄⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⣠⡟⠀⣰⣏⣀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⣠⣴⠞⠋⠁⠙⢷⣄⠙⢷⣀⠀⠀⠀⠀⠀⠀⢀⡴⠋⢀⡾⠋⠈⠙⠻⢦⣄⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⣠⡾⠋⠀⠀⠀⠀⠀⠀⠹⢦⡀⠙⠳⠶⢤⡤⠶⠞⠋⢀⡴⠟⠀⠀⠀⠀⠀⠀⠙⠻⣆⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⣼⠋⠀⠀⢀⣤⣤⣤⣤⣤⣤⣤⣿⣦⣤⣤⣤⣤⣤⣤⣴⣿⣤⣤⣤⣤⣤⣤⣤⡀⠀⠀⠙⣧⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⣸⠏⠀⠀⠀⢸⡇⠀⠀⠀⠀⠀⠀⠀⢠⣴⠞⠛⠛⠻⢦⡄⠀⠀⠀⠀⠀⠀⠀⢸⡇⠀⠀⠀⠸⣇⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⢠⡟⠀⠀⠀⠀⢸⡇⠀⠀⠀⠀⠀⠀⠀⣿⣿⢶⣄⣠⡶⣦⣿⠀⠀⠀⠀⠀⠀⠀⢸⡇⠀⠀⠀⠀⢻⡄⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⣾⠁⠀⠀⠀⠀⠘⣇⠀⠀⠀⠀⠀⠀⠀⢻⣿⠶⠟⠻⠶⢿⡿⠀⠀⠀⠀⠀⠀⠀⢸⡇⠀⠀⠀⠀⠈⣿⠀⠀⠀⠀
⠀⠀⠀⠀⠀⢰⡏⠀⠀⠀⠀⠀⠀⣿⠀⠀⠀⠀⠀⠀⢾⣄⣹⣦⣀⣀⣴⢟⣠⡶⠀⠀⠀⠀⠀⠀⣼⠀⠀⠀⠀⠀⠀⢸⡇⠀⠀⠀
⠀⠀⠀⠀⠀⢸⡇⠀⠀⠀⠀⠀⠀⣿⠀⠀⠀⠀⠀⠀⠀⠈⠛⠿⣭⣭⡿⠛⠁⠀⠀⠀⠀⠀⠀⠀⣿⠀⠀⠀⠀⠀⠀⠘⣧⠀⠀⠀⠀
⠀⠀⠀⠀⠀⢸⡇⠀⠀⠀⠀⠀⠀⢿⡀⠀⠀⠀⠀⠀⠀⣀⡴⠞⠋⠙⠳⢦⣀⠀⠀⠀⠀⠀⠀⠀⣿⠀⠀⠀⠀⠀⠀⢰⡏⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠈⢿⣄⣀⠀⠀⢀⣤⣼⣧⣤⣤⣤⣤⣤⣿⣭⣤⣤⣤⣤⣤⣤⣭⣿⣤⣤⣤⣤⣤⣼⣿⣤⣄⠀⠀⣀⣠⡾⠀
⠀⠀⠀⠀⠀⠀⠀⠈⠉⠛⠛⠻⢧⠤⠤⠤⠤⠤⠤⠤⠤⠤⠤⠤⠤⠤⠤⠤⠤⠤⠤⠤⠤⠤⠤⠤⠤⠼⠟⠛⠛⠉⠁⠀
⠀⠀⠀⠀⠀
⣷⣶⣶⣶⣶⣶⣶⣿⣷⣶⣿⣿⣾⣿⣶⣶⣿⣿⣷⣿⣿⣿⣿⣿⣿⣾⣿⣿⣿⣿⣷⣷⣿⣷⣶⣶⣶⣶⣶⣶⣶⣶⣶⣶⣶⣶⣶⣶⣶⣶
⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣷⣷⣶⣿⣿

Game over. Full system compromise achieved!

Flags Captured

User flag: /home/dante/local.txt
Root flag: /root/root.txt

Final Thoughts: The Journey Through Digital Hell

Like Dante’s descent through the nine circles of Hell, this box took us through multiple layers of security each requiring different skills and persistence. We started at the gates with basic reconnaissance, navigated through the circles of web exploitation and credential attacks, and finally emerged at the center where root access awaited.

The Inferno box perfectly encapsulates what makes CTF challenges so valuable: they’re puzzles that mirror real-world security issues. Every misconfigured sudo permission, every default credential, and every unpatched application we exploited here exists in production environments somewhere. The difference is that here, we’re learning in a safe, legal environment.

Thank you for reading! If this writeup helped you, consider challenging yourself with more TryHackMe rooms. Try boxes slightly above your comfort level that’s where real growth happens. Document your process, share your knowledge, and contribute to the community. The more we share, the stronger we all become.

Got questions? Stuck on a particular step? The cybersecurity community is incredibly supportive don’t hesitate to reach out. And if you’ve completed Inferno using a different approach, I’d love to hear about it in the comments!

Stay curious. Stay ethical. Stay hungry for knowledge.

Until the next box… Happy Hacking! 🔥