u/Yukon_07

I loved sharing this simple Mr. Robot style design

Did the whole room from Termux on my phone, only used a free GitHub Codespace for hashcat. Chain was wild - AS-REP roasting into a WinRM shell, found a password literally sitting in an LDAP description field, then SeBackupPrivilege to grab the admin flag.

Honestly wild how the entire domain fell just because someone wrote a password in a description box and added a user to Backup Operators. Feels way too realistic.

Finally rooted TryHackMe's "Watcher" box — 100% from my phone via Termux 📱🔥

After a solid grind, I just finished the Watcher room on TryHackMe (made by @rushisec) — and the wild part is I did the entire thing from Termux on Android, no laptop involved.

The chain, start to finish

This box was a great lesson in multi-hop privilege escalation. Rough path I followed:

Recon — nmap scan revealed FTP, SSH, and a web server.

robots.txt led to a hidden file that hinted at the next step.

FTP creds were exposed through a Local File Inclusion (LFI) bug in a PHP parameter.

Used the FTP access to upload a reverse shell and popped a low-priv web shell.

Abused a passwordless sudo rule to pivot to a second user.

Found a cron job running a script as another user — since I had write access to it, I swapped in my own reverse shell payload and caught a shell as that user.

That user had sudo rights to run a whitelisted Python script as yet another user — the script had a function I could hijack to break out of the "whitelist" and get a shell.

Final step: found a group-writable backup directory (adm group) containing a base64-encoded SSH private key. Decoded it, chmod 600'd it, and used it to SSH straight into root@localhost. 🎉

Every single flag captured, room complete.

Doing this on Termux — the annoying parts

Running the whole workflow from a phone terminal came with its own quirks worth mentioning for anyone else attempting mobile pentesting:

Input lag over the browser-based AttackBox terminal caused commands to occasionally get concatenated together (e.g. typing a second command before the first one's output finished rendering merged them into one broken command). Lesson learned: always wait for the prompt to return before typing the next command.

Small screen + no physical keyboard made it easy to fat-finger commands (whomai instead of whoami 😅) — a Bluetooth keyboard or a terminal app with a persistent extra-keys row (Termux has this built in) saves a lot of pain.

Copy-pasting long base64 blobs (like the SSH key) is finicky on mobile — Termux's long-press select + system clipboard worked, but double-check for line-wrap issues before decoding.

Termux itself needed openssh installed (pkg install openssh) to get ssh, chmod, and friends working for the final key-based login step.

Takeaways

Passwordless sudo rules, writable cron scripts, and group-writable backup files are still incredibly common privilege escalation vectors in real environments — not just CTFs.

Mobile pentesting is 100% viable with Termux, just budget extra patience for input lag and typos.

Solid room, would recommend to anyone practicing LFI → FTP → sudo chains → cron abuse → group permissions. 10/10.

(Flag values blurred/omitted per TryHackMe rules — don't want to spoil it for others!)