Challenge

The raw TCP service on 9009 handed out a private key and certificate on request. Port 54321 wanted mutual TLS.

openssl s_client -connect target:54321 -cert cert -key privkey

That shell led to barney. sudo certutil leaked server.js with fred:YabbaDabbaD0000!. sudo base64 /root/pass.txt through base64, base32, base64, then CrackStation, gave root:flinstonesvitamins.

Flags

  • THM{f05780f08f0eb1de65023069d0e4c90c}
  • THM{de4043c009214b56279982bf10a661b7}