GoldenEye

A CTF challenge inspired by 90s spycraft, misconfigured mail services, and a trail of base64 breadcrumbs.

April 2025
Introduction

You’re staring at yet another terminal window, surrounded by usernames, random ports, encrypted strings, and a suspicious obsession with 90s spy movie references. You’ve already tried 007 as a password more times than you’d care to admit—and still, no root flag.

If you’re working through the GoldenEye box on TryHackMe, chances are you’re feeling the weight of classic CTF chaos: too much info, not enough direction. There’s base64 where it shouldn’t be, hints buried in forgotten image metadata, and a login portal that practically screams, “Try harder.”

This writeup cuts through the noise. You’ll get a step-by-step walkthrough on which creds matter, how to exploit obscure mail services, and a privilege escalation path using kernel exploits.

Enumeration

Initial Nmap Scan:

25/tcp    open  smtp     Postfix smtpd
                80/tcp    open  http     Apache httpd 2.4.7 ((Ubuntu))
                55006/tcp open  ssl/pop3 Dovecot pop3d
                55007/tcp open  pop3     Dovecot pop3d

HTTP and unusual POP3 services immediately stood out. POP3 running on 55007? Not default.

Web Recon:

  • /sev-home/ – Main login interface, hinted at POP3 service being on a “very high port”.
  • /terminal.js – Contained an encoded password:
    //I encoded you p@ssword below...
                    //InvincibleHack3r
    Decodes to: InvincibleHack3r
  • /gnocertdir/ – Doak's welcome message & hints. Revealed usernames like dr_doak and the path to:/dir007key/for-007.jpg
Gaining Access

The image at /dir007key/for-007.jpg contained base64-encoded content. Decoding it revealed a critical credential:xWinter1995x! (admin).

Messages via POP3 on port 55007 confirmed valid creds for users:xenia:RCP90rulez! and dr_doak:4England!. These were used to log in and explore further.

A cleartext hint revealed the path to Moodle:Moodle Enumeration (HackTricks)

Privilege Escalation

A kernel exploit was used for privilege escalation, found via HackTricks:Kernel Exploits (HackTricks)

Note: Required switching gcc calls to cc for compilation due to system environment.

Flags & Takeaways
  • Initial access required decoding obfuscated JS strings.
  • Unusual POP3 ports carried crucial email-based hints and passwords.
  • File inspection and metadata led to valid admin credentials.
  • Privilege escalation was achieved through a straightforward kernel exploit.

This box was a fun mix of spycraft, real-world misconfigurations, and CTF-style breadcrumbs. The biggest takeaway? Trust your gut during enumeration—and don’t ignore encoded text buried in JS files.