TryHackMe: RootMe! Walkthrough using Kali Linux, Reversing a Shell and Privilege Escalation

This is a basic walkthrough of TryHackMe's RootMe! room that tackles reconaissance, obtaining a reverse shell, and escalating privileges to root.

The main objective of this room is to analyze and investigate a Linux machine with vulnerabilities, learn how to identify the security weaknesses, gain access by opening a web application, and escalating its privileges to root.

Phase 1 — Preparing Environment and Configuration

To start the assessment, prepare the necessary tools and establish a connection to the TryHackMe laboratory environment. In this assessment, I have utilized these tools and technologies:

Operating System: Kali Linux Virtualization Environment: Oracle VirtualBox OpenVPN: Secured connection to TryHackMe GoBuster: Web directory enumeration Firefox: Browser for gaining acces to web application Netcat: Reverse shell connection

In this THB room, using AttackBox is recommended to use. However, for non-premium users, there is a maximum limit of tries per person.

As an alternative, non-premium users can download an OpenVPN configuration file from the TryHackMe page and establish a VPN connection using Kali Linux.

Click the 'Start Lab Machine' button, and you will see a 'Target Machine Information' card. In this card, you will see its status, title, the Target IP Address, and the time until it expires.

When the timer finishes, it will provide an additional hour. When it expires again, the activity resets and provides a different target IP address. The key is for the user to be quick enough to finish and keen enough to input the correct IP address.

For further validation that the target machine can be accessed, conduct a connectivity test through ping.

If the connection is successfully established, you are now ready to start.

Phase 2— Reconnaissance and Service Discovery

In order to gain basic information about the target system and its open services, one must perform reconnaissance. I utilized Nmap (Network Mapper) to scan open ports and which services are running on the target.

Scan Results: The scan has identified two open TCP ports — 22/tcp (SSH) and 80/tcp (HTTP) and the running Apache version is 2.4.41.

Analysis: The scan on port 80 provides information that the target was hosting a web application, which gives us an entry point.

Even so, there are still information that are not immediately visible from the main page. Therefore, we can perform web enumeration.

Phase 3 — Web Directory Enumeration

In discovering directories and files that are hosted by the web server, GoBuster can be used. This is useful when trying to identify potentially important resources and web application components.

To run, use this command:

The enumeration has identified an important path: /panel/. This path is important as it exposes a file upload function that could be used to investigate a security weakness.

Phase 4 — Finding the Vulnerability in the File Upload

Using Firefox, /panel/ directory can be accessed.

The outcome displayed a basic file upload with a file section field, browse button, and an upload button. The security risk that can be gained in this result is when a file upload functionality does not give a strict validtion controls throgh the file's extensions, contents, or permissions.

Therefore, it was further investigated through checking if it would accept a PHP script with .phtml as its extension. This is being performed to see if the uploaded file can be executed by the server so that a reverse shell connection can be established.

Phase 5— Preparing the Reverse Shell

I used a PHP reverse shell script that is available in Kali Linux.

1. Locate the PHP reverse shell. Then, copy and rename the script.

2. Identify the Kali Linux VPN address and configure the PHP script.

Phase 6 — Establish the Netcat Listener

Before executing the created PHP script, I used Netcat Listener.

nc -lvnp 5555

nc -lvnp 5555

Phase 7— Upload the Reverse Shell and and Execute

To upload the reverse shell, return to:

http://10.49.132.247/panel/

http://10.49.132.247/panel/

Select browse, select shell.phtml, and upload the file. Afterwards, the application accepted the file.

Next, I visited:

http://10.49.132.247/uploads/

http://10.49.132.247/uploads/

The uploaded shell.phtml file was seen in the directory. After clicking the file, the PHP script will execute and this will establish a communication back to the Netcat listener.

uid=33(www-data) gid=33(www-data) groups=33(www-data)

uid=33(www-data) gid=33(www-data) groups=33(www-data)

This line verifies that the command execution as the www-data user is gained. Furthermore, the account had limited permissions. Which means, there is still a need for privilege escalation.

Phase 8— Finding User Flag

Search for the user flag after gaining access through:

find /var/www -name user.txt 2>/dev/null

find /var/www -name user.txt 2>/dev/null

Then display its contents:

cat /var/www/user.txt

cat /var/www/user.txt

At last, the user flag is finally retrieved.

THM{y0u_g0t_a_sh3ll}

THM{y0u_g0t_a_sh3ll}

Phase 9— Enumerate the SUID Permissions

This privilege escalation-focused phase aims to gain root privileges. Therefore, searching for root-owned executables with enabled SUID permission is done through:

find / -user root -perm /4000 2>/dev/null

find / -user root -perm /4000 2>/dev/null

According from the result, I have identified:

/usr/bin/python2.7

/usr/bin/python2.7

This is suspicious as Python can execute system commands. When SUID permissions are set by root, it can be used to gain higher access to the system.

Phase 10— Escalate the Privilege to Root

As the Python imposes potential vulnerability, I attemoted to use it to put a privileged shell:

To verify the root access, use the command whoami.

Phase 11 — Obtain the Root Flag

As there is already a root access, I can now search for the final flag using:

find / -name root.txt 2>/dev/null

find / -name root.txt 2>/dev/null

The file was located at:

Display the contents:

Root Flag:

THM{pr1v1l3g3_3sc4l4t10n}

THM{pr1v1l3g3_3sc4l4t10n}

Congratulations! The TryHackMe room, RootMe! is now complete.