🚩 Just rooted “RootMe” on TryHackMe! Write-up

A ctf for beginners, can you root me?

I. Reconnaissance

Scanning the Target

The first thing I always do with any target is run an Nmap scan. You can't attack what you don't understand, so before anything else I want to know what ports are open and what services are sitting behind them.

So I used Nmap scan to see what the target was running, using nmap -sC -sV 10.48.168.118; -sV to pull service versions and -sC to run the default scripts for any extra detail.

The scan revealed two open ports. Port 22 was running OpenSSH 8.2p1 on Ubuntu, but with no credentials in hand there wasn't much to do with it yet. Port 80 was the interesting one: Apache 2.4.41 serving a site titled "HackIT — Home," with the scripts also flagging a PHPSESSID cookie missing the httponly flag — a hint that the site runs on PHP.

• Scan the machine, how many ports are open? 2
• What version of Apache is running? 2.4.41
• What service is running on port 22? SSH

Visiting the website only display the text above with no forms or anything to interact with.

Enumeration time ^_^

II. Enumeration

Finding Hidden Directories

Since the homepage of the website has nothing to interact with, I ran Gobuster to brute force hidden directories. The /panel/ stood out immediately, it looks like it might host some kind of admin or upload interface.

• What is the hidden directory? /panel/

So I opened the /panel/ and it revealed a file upload from, where I could drop a web shell and gain a command execution to the server!

I used the web shell of the Pentest Monkey.

Then I tried to upload the my php file:

Which says that uploading php file is not allowed.

To bypass this restriction, I changed the file extension to "phtml" . Before uploading the phtml file I started my netcat listener first if ever it is successful.

I have successfully uploaded the shell :)) Now let us click our phtml file then check if we have the shell.

Woah! Now we have the shell.

III. Finding the User Flag

• user.txt? THM{y0u_g0t_a_sh3ll}

IV. Privilege Escalation

Abusing SUID for Root — I'm almost there root :))

Now let's hunt for the files with the SUID bit set — these run with the privileges of the file's owner rather than the user executing them, so a SUID binary owned by root can be abused to run commands as root.

The results included the usual system binaries, but one stood out for me the python file! and it looks like it is misconfigured that will leads us straight to the root!

• Search for files with SUID permission, which file is weird? /usr/bin/python2.7

A quick check on GTFOBins confirmed the technique. Since Python was running with root's privileges, I used it to spawn a shell that preserved those privileges:

Finally, we are now ROOT! :3

• root.txt? THM{pr1v1l3g3_3sc4l4t10n}

Thank you for reading! This is my first time creating a write-up, so bear with me!

This room tied together recon, enumeration, exploitation, and privilege escalation into one satisfying path to root. Feedback is always welcome — see you in the next writeup. 🚩-Scyph3r