TryHackMe Theseus Walkthrough

TryHackMe Theseus Walkthrough

Original Bugflare writeup of the Theseus room. Myth-flavored multi-stage box: Minos → Labyrinth → Minotaur → Athens. You bounce from a Flask SSTI foothold into a container overflow, a sudo helper, and finally a broken JPEG that hides the last hop.

Flags below are THM{xxx}. Passwords and invite-style secrets are left as xxx — pull them from your own run.

First look

Deploy, give it a minute, scan:

nmap -sC -sV -Pn MACHINE_IP

The early win sits on 8080 — a Flask app. Other ports matter later once you are inside. Treat this less like a single Linux privesc and more like a chain of themed stages that hand you the next door.

Minos — Jinja SSTI on ?key=

The Flask service on :8080 reflects a key query parameter through Jinja. Classic blind-ish / reflected SSTI territory. Confirm with arithmetic first, then escalate to RCE payloads you trust in your lab:

curl -s "http://MACHINE_IP:8080/?key={{7*7}}"
# once confirmed, move to a reverse shell / file read suited to Jinja

From that shell (or file read) you land the Minos flag and the Crete_Shores / entrance material that opens the next stage. Verified live via SSTI on our run.

THM{xxx}

Do not overthink fancy AV here. The bug is template injection. Prove it, get a shell, loot.

Labyrinth — entrance, container, buffer overflow

Next door wants credentials in the form entrance:xxx (password redacted — find it from Minos loot). That drops you into the Labyrinth container / service.

Inside, the interesting binary is a buffer overflow target. Standard rhythm:

1. Crash it, note offset / EIP or RIP control.
2. Map protections (checksec) — no-PIE / partial RELRO / executable stack change the payload shape.
3. Build a working overflow (ret2libc, ROP, or whatever the binary allows on that deploy).
4. Catch a shell inside the Labyrinth context and grab the flag.

THM{xxx}

If your first payload dies, check bad chars and whether you are overflowing the right interface (local binary vs network service). The room is named Labyrinth for a reason — the overflow is the thread through it.

Minotaur — sudo as ariadne

From the Labyrinth foothold you get (or pivot to) user ariadne. sudo -l matters. There is a thread-style (or similarly named) helper she can run elevated.

Abuse that sudo rule — command injection, writable script the helper calls, or whatever the binary actually does when you pass it a path — and elevate far enough to read the Minotaur flag.

THM{xxx}

I always re-run sudo -l after each hop on this box. Privileges change between stages more than on a flat Linux CTF.

Athens — repair the JPEG, then stego

Last stage is quieter. You find a damaged JPEG (broken header / truncated / wrong magic — classic repair job). Fix it with a hex editor or jpeg repair tooling until it opens.

Then dig stego:

# examples — use what fits the file you recovered
binwalk -e repaired.jpg
steghide extract -sf repaired.jpg
zsteg repaired.jpg
exiftool repaired.jpg

Hidden content yields the shore@Athens hop (password xxx — from the stego, not from this page). Land on Athens and take the final flag:

THM{xxx}

If the image "opens" but stego tools find nothing, your repair is still wrong — truncated EOI, bad DHT, or a fake JFIF that fools a viewer but not the embedded payload.

Chain at a glance

:8080 Flask Jinja SSTI (?key=)
  → Minos flag + Crete_Shores / entrance material
  → entrance:xxx → Labyrinth container
  → BOF → Labyrinth flag
  → sudo as ariadne → Minotaur flag
  → repair JPEG + stego → shore@Athens
  → Athens flag

Room answers (redacted)

| Stage | Flag | |-------|------| | Minos | THM{xxx} | | Labyrinth | THM{xxx} | | Minotaur | THM{xxx} | | Athens | THM{xxx} |

What stuck

SSTI on a query param is still free RCE when the template is trusted blindly — prove with {{7*7}} before you fire a shell. The Labyrinth BOF is the real skill check; do not skip checksec. Sudo helpers named like story props (thread, etc.) are usually the Minotaur door. And a "broken" JPEG is not flavor text — repair it properly or the stego never shows up.

Swap MACHINE_IP for your lab. Path only — credentials and flags stay on the machine.