Post cover image
opening the ip add 10.48.146.14

October 28, 2026

Root me — a Tryhackme walkthrough

A ctf for beginners, can you root me?

By der

3 min read

First things first, you need to deploy your Lab Machine. The Lab Machine will serve as the target that you're going to exploit or attack.

None

Up to you if you'll use the Attacker Machine, It's laggy on my end so I used my own virtual attack machine, using a virtual machine.

Reconnaissance

None

There are two ports that are open after the scan, port 22 is for ssh and 80 for http. In my eyes port 80 seems a bit more vulnerable so let's further assess.

Scan the machine, how many ports are open? 2

What version of Apache is running? 2.4.41

What service is running on port 22? SSH

None

So it's some sort of a challenge?

Now we move on to Enumeration

Enumeration

None

the command shown here is used to find something that is hidden within —

What is the hidden directory? /panel/

None

Now you need to upload a web shell in order to access the following page.

Here is what I used from Pentest Monkey.

None

So we need to bypass it in order for it to work.

After downloading the script from Pentest Monkey, change the IP and port to the one that you're specifically will use. Then save as a phtml file.

None None

Now we already have a shell (a lot of shells were made because it was due to trial and error hehe)

Now run the nc -lvnp (port you used) command in order to access the shell in the terminal.

None

Finding the User Flag

None

user.txt? THM{y0u_g0t_a_sh3ll}

Privilege Escalation

$ find / -user root -perm /4000 2>/dev/null
/usr/lib/dbus-1.0/dbus-daemon-launch-helper
/usr/lib/snapd/snap-confine
/usr/lib/x86_64-linux-gnu/lxc/lxc-user-nic
/usr/lib/eject/dmcrypt-get-device
/usr/lib/openssh/ssh-keysign
/usr/lib/policykit-1/polkit-agent-helper-1
/usr/bin/newuidmap
/usr/bin/newgidmap
/usr/bin/chsh
/usr/bin/python2.7
/usr/bin/chfn
/usr/bin/gpasswd
/usr/bin/sudo
/usr/bin/newgrp
/usr/bin/passwd
/usr/bin/pkexec
/snap/core/8268/bin/mount
/snap/core/8268/bin/ping
/snap/core/8268/bin/ping6
/snap/core/8268/bin/su
/snap/core/8268/bin/umount
/snap/core/8268/usr/bin/chfn
/snap/core/8268/usr/bin/chsh
/snap/core/8268/usr/bin/gpasswd
/snap/core/8268/usr/bin/newgrp
/snap/core/8268/usr/bin/passwd
/snap/core/8268/usr/bin/sudo
/snap/core/8268/usr/lib/dbus-1.0/dbus-daemon-launch-helper
/snap/core/8268/usr/lib/openssh/ssh-keysign
/snap/core/8268/usr/lib/snapd/snap-confine
/snap/core/8268/usr/sbin/pppd
/snap/core/9665/bin/mount
/snap/core/9665/bin/ping
/snap/core/9665/bin/ping6
/snap/core/9665/bin/su
/snap/core/9665/bin/umount
/snap/core/9665/usr/bin/chfn
/snap/core/9665/usr/bin/chsh
/snap/core/9665/usr/bin/gpasswd
/snap/core/9665/usr/bin/newgrp
/snap/core/9665/usr/bin/passwd
/snap/core/9665/usr/bin/sudo
/snap/core/9665/usr/lib/dbus-1.0/dbus-daemon-launch-helper
/snap/core/9665/usr/lib/openssh/ssh-keysign
/snap/core/9665/usr/lib/snapd/snap-confine
/snap/core/9665/usr/sbin/pppd
/snap/core20/2599/usr/bin/chfn
/snap/core20/2599/usr/bin/chsh
/snap/core20/2599/usr/bin/gpasswd
/snap/core20/2599/usr/bin/mount
/snap/core20/2599/usr/bin/newgrp
/snap/core20/2599/usr/bin/passwd
/snap/core20/2599/usr/bin/su
/snap/core20/2599/usr/bin/sudo
/snap/core20/2599/usr/bin/umount
/snap/core20/2599/usr/lib/dbus-1.0/dbus-daemon-launch-helper
/snap/core20/2599/usr/lib/openssh/ssh-keysign
/bin/mount
/bin/su
/bin/fusermount
/bin/umount

Now find the file that has an SUID permission set.

Search for files with SUID permission, which file is weird? /usr/bin/python

I see you python2.7 — Python binaries are never SUID by default on a standard Linux install.

None

SUID bit will get you root privileges for a moment, but bash's default safety check would throw them away immediately. -p disables that check so you'll be kept inside the root instead of silently falling back to your normal user.

Now search for the root !

None

root.txt? THM{pr1v1l3g3_3sc4l4t10n}