# The Great Disappearing Act - Escape! ### Overview --- **Room URL:** **Difficulty:** Hard **Category:** SCADA, Enumeration, Privilege Escalation **Date Completed:** 12/21/2025 ### Objectives 1. Unlock Hopper’s Cell - Your escape begins in the Cells and Storage area. Hopper is locked inside, and the door is secured with a digital lock. Your first task is to access the cell controls and unlock his door. Once Hopper is free, you can begin moving toward the lobby. 2. Move Through the Lobby - With the cell unlocked, head straight ahead into the lobby. This area connects the different blocks of the facility. Cameras are active, so stay alert. Your objective is to reach the Psych Ward entrance on the east side of the lobby. 3. Bypass the Psych Ward Keypad - The Psych Ward is protected by a keypad system. You must identify the correct code or exploit the keypad to continue. Once the keypad is bypassed, you will gain access to the Psych Ward Exit hallway. 4. Reach the Main Corridor - From the Psych Ward Exit you can move south and loop around into the Main Corridor. This is the final section of the escape route. The last challenge awaits here, and completing it will open the final exit door. 5. Escape the Facility - Solve the final challenge in the Main Corridor and make your way toward the exit marked on the map. Once the door opens, Hopper is free, and the escape is complete. --- ### Table of Contents [Introduction](#bkmrk-introduction) [Walk Through](#bkmrk-walk-through) [Lessons Learned](#bkmrk-lessons-learned) [Resources](#bkmrk-resources) --- ### Introduction Once upon a time, there was a red-teaming mastermind turned court jester... > Once upon a time, there was a red-teaming mastermind turned court jester… our story begins with Hopper. Once feared as the ruthless Head of the Red Team Bunny Battalion, Hopper rose to the rank of Colonel with dizzying speed. The promotion filled him with such exhilaration and such hunger for more that it consumed his every thought. His soldiers mistook his growing twitch for stress and began calling him “Colonel Panic”, but the truth was far more dangerous: the twitch came from his obsession with power, not fear. > > In those days, Hopper had already played a crucial, though conveniently forgotten, role in the earliest whispers of the Wareville siege. Buried beneath secrecy and denied by the crown, those first experiments in breaching new digital frontiers were Hopper’s design. But when the King began distancing himself from the truth, Hopper’s contributions were quietly erased from history, and his fall from grace accelerated. We now find Hopper in his prison cell at HopSec Asylum... #### Map [![AOCSQ1-Map.png](https://bookstack-images.rizzoit.com/uploads/images/gallery/2026-01/scaled-1680-/aocsq1-map.png)](https://bookstack-images.rizzoit.com/uploads/images/gallery/2026-01/aocsq1-map.png) #### Key Information & Technical Deep-Dive ##### Core Vulnerability: IDOR in Camera Access Control The primary exploit vector centered on an **Insecure Direct Object Reference (IDOR)** vulnerability in the camera streaming API. The system implemented authorization checks against request body parameters but failed to validate URL query parameters, allowing tier escalation from `guard` to `admin` access. **Vulnerable Endpoint:** http ```http POST /v1/streams/request?tier=admin Body: {"camera_id":"cam-admin","tier":"guard"} ``` The server validated the `tier` field in the request body (`guard`) but honored the `tier` parameter in the URL (`admin`), granting elevated access despite submitting lower-privileged credentials. This created an effective privilege escalation pathway to administrative camera feeds. ##### Tools & Techniques **Reconnaissance:** - **Nmap**: Full port scan revealed 11 open ports including SSH (22), multiple HTTP services (80, 8000, 8080), SCADA (9001), and several diagnostic ports (13400-13404, 21337) - **Burp Suite / Postman**: API endpoint enumeration and parameter manipulation for IDOR exploitation - **Netcat**: Direct socket connection to console port (13404) and SCADA terminal (9001) **Privilege Escalation:** - **SUID Binary Exploitation**: The `/usr/local/bin/diag_shell` binary had setuid permissions and executed as `dockermgr` user - **Docker Socket Abuse**: Leveraged `docker exec` with root privileges to access containerized SCADA system - **Linux Enumeration**: Standard privilege escalation reconnaissance (`find / -perm -4000`, `groups`, `docker ps`) --- ### Walk Through This challenge begins by with a note. > This challenge is unlocked by finding the Side Quest key in [Advent of Cyber Day 1](https://tryhackme.com/jr/linuxcli-aoc2025-o1fpqkvxti). If you have been savvy enough to find it, you can unlock the machine by visiting `MACHINE_IP:21337` and entering your key. Happy Side Questing! Upon starting the machine and connecting to the VPN, I then went to `http://:21337` Where I was prompted to enter the key I found from Day 1. **KEY:** `now_you_see_me` Upon entering this key a confirmation message appears, but that is it. It appeared that this key did nothing. I then restated the target machine to set it to default state. I then attempted to enumerate the machine before and after entering the key. This key activates a script that deactivates the firewall on the target machine. Recon before key is blank. ``` # Nmap 7.94SVN scan initiated Thu Dec 11 13:41:29 2025 as: nmap -p- -oN initalscan.txt 10.81.183.133 # Nmap done at Thu Dec 11 13:41:32 2025 -- 1 IP address (0 hosts up) scanned in 3.03 seconds ``` #### Nmap Results `map -p- -oN portscan.txt ` ``` # Nmap 7.94SVN scan initiated Thu Dec 11 13:45:18 2025 as: nmap -p- -oN portscan.txt 10.81.183.133 Nmap scan report for 10.81.183.133 Host is up (0.026s latency). Not shown: 65524 closed tcp ports (conn-refused) PORT STATE SERVICE 22/tcp open ssh 80/tcp open http 8000/tcp open http-alt 8080/tcp open http-proxy 9001/tcp open tor-orport 13400/tcp open doip-data 13401/tcp open unknown 13402/tcp open unknown 13403/tcp open unknown 13404/tcp open unknown 21337/tcp open unknown # Nmap done at Thu Dec 11 13:45:41 2025 -- 1 IP address (1 host up) scanned in 23.45 seconds ``` This revealed another web-server on port `80`, `8000`, and `8080` #### Port 80 ``` # Nmap 7.94SVN scan initiated Thu Dec 11 13:48:34 2025 as: nmap -sCV -p 80 -oN port-80.txt 10.81.183.133 Nmap scan report for 10.81.183.133 Host is up (0.027s latency). PORT STATE SERVICE VERSION 80/tcp open http nginx 1.24.0 (Ubuntu) |_http-title: HopSec Asylum - Security Console |_http-server-header: nginx/1.24.0 (Ubuntu) Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . # Nmap done at Thu Dec 11 13:48:41 2025 -- 1 IP address (1 host up) scanned in 7.10 seconds ``` #### Port 8000 ``` # Nmap 7.94SVN scan initiated Thu Dec 11 13:48:55 2025 as: nmap -sCV -p 8000 -oN port-8000.txt 10.81.183.133 Nmap scan report for 10.81.183.133 Host is up (0.026s latency). PORT STATE SERVICE VERSION 8000/tcp open http-alt | fingerprint-strings: | FourOhFourRequest: | HTTP/1.0 404 Not Found | Content-Type: text/html | X-Frame-Options: DENY | Content-Length: 179 | Vary: Accept-Language | Content-Language: en | X-Content-Type-Options: nosniff | | | | Not Found | | |

Not Found

The requested resource was not found on this server.

| | | GenericLines, Help, RTSPRequest, SIPOptions, Socks5, TerminalServerCookie: | HTTP/1.1 400 Bad Request | GetRequest, HTTPOptions: | HTTP/1.0 302 Found | Content-Type: text/html; charset=utf-8 | Location: /posts/ | X-Frame-Options: DENY | Content-Length: 0 | Vary: Accept-Language | Content-Language: en |_ X-Content-Type-Options: nosniff | http-title: Fakebook - Sign In |_Requested resource was /accounts/login/?next=/posts/ Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . # Nmap done at Thu Dec 11 13:51:08 2025 -- 1 IP address (1 host up) scanned in 133.06 seconds ``` #### Port 8080 ``` # Nmap 7.94SVN scan initiated Thu Dec 11 13:52:32 2025 as: nmap -sCV -p 8080 -oN port-8080.txt 10.81.183.133 Nmap scan report for 10.81.183.133 Host is up (0.026s latency). PORT STATE SERVICE VERSION 8080/tcp open http SimpleHTTPServer 0.6 (Python 3.12.3) |_http-title: HopSec Asylum - Security Console |_http-server-header: SimpleHTTP/0.6 Python/3.12.3 Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . # Nmap done at Thu Dec 11 13:52:40 2025 -- 1 IP address (1 host up) scanned in 7.13 seconds ``` #### Port 9001 ``` # Nmap 7.94SVN scan initiated Thu Dec 11 13:53:35 2025 as: nmap -sCV -p 9001 -oN port-9001.txt 10.81.183.133 Nmap scan report for 10.81.183.133 Host is up (0.026s latency). PORT STATE SERVICE VERSION 9001/tcp open tor-orport? | fingerprint-strings: | NULL: | ASYLUM GATE CONTROL SYSTEM - SCADA TERMINAL v2.1 | [AUTHORIZED PERSONNEL ONLY] | WARNING: This system controls critical infrastructure | access attempts are logged and monitored | Unauthorized access will result in immediate termination | Authentication required to access SCADA terminal | Provide authorization token from Part 1 to proceed |_ [AUTH] Enter authorization token: Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . # Nmap done at Thu Dec 11 13:55:21 2025 -- 1 IP address (1 host up) scanned in 106.38 seconds ``` #### Port 13400 ``` # Nmap 7.94SVN scan initiated Thu Dec 11 13:55:40 2025 as: nmap -sCV -p 13400 -oN port-13400.txt 10.81.183.133 Nmap scan report for 10.81.183.133 Host is up (0.026s latency). PORT STATE SERVICE VERSION 13400/tcp open hadoop-tasktracker Apache Hadoop 1.24.0 (Ubuntu) | hadoop-datanode-info: |_ Logs: loginBtn |_http-title: HopSec Asylum \xE2\x80\x93 Facility Video Portal | hadoop-tasktracker-info: |_ Logs: loginBtn Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . # Nmap done at Thu Dec 11 13:55:53 2025 -- 1 IP address (1 host up) scanned in 12.56 seconds ``` #### Port 13401 ``` # Nmap 7.94SVN scan initiated Thu Dec 11 13:56:10 2025 as: nmap -sCV -p 13401 -oN port-13401.txt 10.81.183.133 Nmap scan report for 10.81.183.133 Host is up (0.026s latency). PORT STATE SERVICE VERSION 13401/tcp open unknown | fingerprint-strings: | GetRequest, HTTPOptions: | HTTP/1.1 404 NOT FOUND | Server: Werkzeug/3.1.3 Python/3.12.3 | Date: Thu, 11 Dec 2025 18:56:16 GMT | Content-Type: text/html; charset=utf-8 | Content-Length: 207 | Access-Control-Allow-Headers: Authorization,Content-Type,Range | Access-Control-Allow-Methods: GET,POST,OPTIONS | Access-Control-Expose-Headers: Content-Range,Accept-Ranges | Connection: close | | | 404 Not Found |

Not Found

|

The requested URL was not found on the server. If you entered the URL manually please check your spelling and try again.

| RTSPRequest: | | | | | Error response | | |

Error response

|

Error code: 400

|

Message: Bad request version ('RTSP/1.0').

|

Error code explanation: 400 - Bad request syntax or unsupported method.

| |_ Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . # Nmap done at Thu Dec 11 13:57:40 2025 -- 1 IP address (1 host up) scanned in 89.74 seconds ``` #### Port 13402 ``` # Nmap 7.94SVN scan initiated Thu Dec 11 13:57:57 2025 as: nmap -sCV -p 13402 -oN port-13402.txt 10.81.183.133 Nmap scan report for 10.81.183.133 Host is up (0.026s latency). PORT STATE SERVICE VERSION 13402/tcp open http nginx 1.24.0 (Ubuntu) |_http-cors: HEAD GET OPTIONS |_http-title: Welcome to nginx! |_http-server-header: nginx/1.24.0 (Ubuntu) Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . # Nmap done at Thu Dec 11 13:58:09 2025 -- 1 IP address (1 host up) scanned in 12.20 seconds ``` #### Port 13403 ``` # Nmap 7.94SVN scan initiated Thu Dec 11 13:58:48 2025 as: nmap -sCV -p 13403 -oN port-13403.txt 10.81.183.133 Nmap scan report for 10.81.183.133 Host is up (0.026s latency). PORT STATE SERVICE VERSION 13403/tcp open unknown | fingerprint-strings: | DNSStatusRequestTCP, DNSVersionBindReqTCP, Help, Kerberos, LANDesk-RC, LDAPBindReq, LDAPSearchReq, LPDString, NCP, RPCCheck, SIPOptions, SMBProgNeg, SSLSessionReq, TLSSessionReq, TerminalServer, TerminalServerCookie, X11Probe: | HTTP/1.1 400 Bad Request | Connection: close | FourOhFourRequest: | HTTP/1.1 404 Not Found | Date: Thu, 11 Dec 2025 18:59:00 GMT | Connection: close | GetRequest, HTTPOptions, RTSPRequest: | HTTP/1.1 404 Not Found | Date: Thu, 11 Dec 2025 18:58:59 GMT |_ Connection: close Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . # Nmap done at Thu Dec 11 13:59:01 2025 -- 1 IP address (1 host up) scanned in 13.31 seconds ``` #### Port 13404 ``` # Nmap 7.94SVN scan initiated Thu Dec 11 13:59:28 2025 as: nmap -sCV -p 13404 -oN port-13404.txt 10.81.183.133 Nmap scan report for 10.81.183.133 Host is up (0.026s latency). PORT STATE SERVICE VERSION 13404/tcp open unknown | fingerprint-strings: | FourOhFourRequest, GenericLines, GetRequest, HTTPOptions, Help, Kerberos, LDAPSearchReq, LPDString, RTSPRequest, SIPOptions, SSLSessionReq, TLSSessionReq, TerminalServerCookie: |_ unauthorized Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . # Nmap done at Thu Dec 11 14:00:57 2025 -- 1 IP address (1 host up) scanned in 88.82 seconds ``` #### Port 21337 ``` # Nmap 7.94SVN scan initiated Thu Dec 11 14:01:57 2025 as: nmap -sCV -p 21337 -oN port-21337.txt 10.81.183.133 Nmap scan report for 10.81.183.133 Host is up (0.026s latency). PORT STATE SERVICE VERSION 21337/tcp open unknown | fingerprint-strings: | GetRequest: | HTTP/1.1 200 OK | Server: Werkzeug/3.0.1 Python/3.12.3 | Date: Thu, 11 Dec 2025 19:02:03 GMT | Content-Type: text/html; charset=utf-8 | Content-Length: 15547 | Connection: close | | | | | | | Unlock Hopper's Memories |