TryHackMe-Linux Privilege Escalation: Automation

قال الله تعالى: ﴿فَتَعَالَى اللَّهُ الْمَلِكُ الْحَقُّ وَلَا تَعْجَلْ بِالْقُرْآنِ مِنْ قَبْلِ أَنْ يُقْضَى إِلَيْكَ وَحْيُهُ وَقُلْ رَبِّ زِدْنِي عِلْمًا﴾ [طه: 114]

Task 2-Automated Enumeration Tools

Run Linux Exploit Suggester to enumerate the target host. What CVE is listed as the first Possible Exploit the target is vulnerable to? CVE-2025–32463

Task3-Privilege Escalation :Public Exploits

Exploit the previously identified vulnerability. What is the content of /root/flag.txt?

THM{splo1ts-r-public}

After enumerating the target, we used Linux Exploit Suggester to search for potential privilege escalation vulnerabilities by running ./linux-exploit-suggester.sh. The results identified CVE-2025–32463 as a possible vulnerability. We then downloaded the public exploit to the AttackBox using git clone https://github.com/MohamedKarrab/CVE-2025-32463.git. After that, we transferred the exploit to the target machine using scp -r ~/CVE-2025–32463 john@TARGET_IP:/home/john/ On the target, we navigated to the exploit directory using cd ~/CVE-2025–32463 and executed the exploit with ./get_root.sh. After the exploit successfully ran, we verified the privilege escalation using whoami, which returned root. Finally, we read the root flag using cat /root/flag.txt, confirming that the public exploit successfully escalated privileges to root.

Task4 pspy — Unprivileged Process Monitoring

What is the full path of the script vulnerable to privilege escalation?

/var/local/syslog-backup.sh

What is the flag in /root/flag.txt?

THM{getting-root-with-pspy}

Scheduled Tasks / Cron + pspy

Sometimes a scheduled task or cron job runs with root privileges and executes a script that is writable by a low-

privileged user.

This misconfiguration can lead to privilege escalation.

We used ./pspy64 to monitor running processes in real time and discovered UID=0 | /bin/bash /var/local/syslog-backup.sh, indicating that /var/local/syslog-backup.sh was being executed as root.

We then checked its permissions using ls -la /var/local/syslog-backup.sh and found -rwxrwxrwx, meaning the script was world-writable and could be modified by john.

The script originally contained tar -czf "/var/backup/syslog.tar.gz" "/var/log/syslog".

We exploited this misconfiguration by appending echo 'echo "root:newpass" | chpasswd' >> /var/local/syslog-backup.sh.

When the scheduled task executed the modified script as root, the password for the root account was changed to newpass.

We then used su, entered the new password, and verified the escalation with whoami, which returned root.

Finally, we retrieved the flag using cat /root/flag.txt.

Key takeaway: When a scheduled task runs a script as root, always check whether the script or any files it executes are writable by the current user. A writable root-executed script can lead directly to privilege escalation.

Task5-Challenge

What are the contents of /home/frank/flag.txt?

THM{Frank_Pwned_Privesc}

What are the contents of /root/flag.txt?

THM{Priv_Ch@l_D0ne}

Challenge — John to Frank to Root

The challenge required us to escalate privileges from the low-privileged user john to frank, and finally to root. During enumeration, we discovered that the cron job /etc/cron.d/frank-backup runs /opt/scripts/backup.sh every minute as frank. We checked the script permissions using ls -la /opt/scripts/backup.sh and found that it was world-writable (-rwxrwxrwx), allowing john to modify it. We added commands to the script, such as id > /tmp/frank-id.txt and cat /home/frank/flag.txt > /tmp/frank-flag.txt, and waited for the cron job to execute. This allowed us to execute commands as frank and retrieve the first flag. We then checked Frank's sudo privileges using sudo -l and discovered that frank could run /usr/bin/id as root without a password, while LD_PRELOAD was preserved in the sudo environment. We exploited this misconfiguration by creating a malicious shared library and executing sudo LD_PRELOAD=/tmp/x.so /usr/bin/id. The library executed with root privileges and copied /root/flag.txt to a location accessible to us. Finally, we read the flag and obtained THM{Priv_Ch@l_D0ne}, successfully completing the challenge.

john

↓

/opt/scripts/backup.sh (World-Writable)

↓

Cron → executes as frank

↓

frank

↓

sudo NOPASSWD: /usr/bin/id

LD_PRELOAD allowed

↓

root

↓

/root/flag.txt

Task 6-Conclusion

In this room, you sped up privilege escalation by adding automation to your workflow.

You used automated enumeration tools to quickly surface misconfigurations and vulnerable software, learning that no single tool catches everything.
You then worked with public exploits, following a clear methodology
Finally, with pspy, you covered the blind spot that scanners miss: short-lived processes.

The takeaway: automation is a force multiplier, not a replacement for understanding. The tools show you where to look, but you still have to know what you're looking at.