TryHackMe: RootMe CTF Walkthrough

This beginner-friendly box is an excellent refresher on the basics of web exploitation and Linux privilege escalation. It covers port scanning with Nmap, directory fuzzing with Gobuster, bypassing file upload restrictions to obtain a reverse shell, and exploiting a misconfigured SUID binary to gain root access. Let's dive right into the walkthrough!

1. Reconnaissance & Port Scanning

As always, I started the engagement with Nmap for scanning and recon to get a solid understanding of the target's open ports and running services.

I ran my standard initial scan: nmap -sC -sV -oN nmap.txt <TARGET_IP>

The scan completed quickly and revealed that two ports were open:

• Port 22: SSH (OpenSSH)
• Port 80: HTTP (Apache httpd 2.4.29)

From this scan, I could answer the first few questions in the room:

• Q: Scan the machine, how many ports are open?
• Answer: 2
• Q: What version of Apache is running?
• Answer: 2.4.29
• Q: What service is running on port 22?
• Answer: ssh

2. Web Enumeration with Gobuster

Since port 80 was open, I navigated to the target IP in my web browser. It displayed a simple, static web page. I needed to dig deeper to find hidden content.

I used Gobuster to brute-force the web directories: gobuster dir -u http://<TARGET_IP>/ -w /usr/share/wordlists/dirb/common.txt

Gobuster quickly identified two interesting hidden directories: /uploads and /panel.

• Q: Find directories on the web server using the GoBuster tool.
• (No answer needed, just run the tool)
• Q: What is the hidden directory?
• Answer: /panel/

Navigating to http://<TARGET_IP>/panel/ revealed a web form designed to upload files, and visiting /uploads/ showed an open directory where uploaded files are stored. This was a classic file upload vulnerability waiting to be exploited.

3. Getting a Reverse Shell

To get a shell on the target, I grabbed a standard PHP reverse shell script, modified it with my TryHackMe VPN IP and chosen listening port (e.g., 4444), and tried to upload it.

The web application threw an error, indicating that standard .php files were blocked. However, these filters are often poorly implemented. I tried renaming the file extension to bypass the filter: mv shell.php shell.phtml

I uploaded shell.phtml, and it went through successfully!

Before triggering the exploit, I started a Netcat listener on my local attack machine: nc -lvnp 4444

Then, I navigated to http://<TARGET_IP>/uploads/ and clicked on my shell.php5 file. Checking my terminal, I had successfully caught the reverse shell as the www-data user!

I upgraded the shell to a stable, interactive session using Python: python -c 'import pty; pty.spawn("/bin/bash")'

From there, I searched for the user flag: find / -type f -name user.txt 2>/dev/null I found it and used cat to read it.

• Q: user.txt
• Answer: (ca user.txt)

4. Privilege Escalation to Root

A common vector for privilege escalation in Linux is finding files with the SUID bit set, which execute with the permissions of the file owner (often root). I ran the following command to search for SUID binaries: find / -user root -perm /4000 2>/dev/null

Scanning through the list, one binary immediately stood out as unusual: /usr/bin/python. Python should typically not have the SUID bit set.

• Q: Search for files with SUID permission, which file is weird?
• Answer: /usr/bin/python

Since Python had SUID privileges, I headed over to GTFOBins and searched for Python. I found a one-liner command to abuse this misconfiguration and spawn a root shell.

I executed the following command in my terminal: python -c 'import os; os.execl("/bin/sh", "sh", "-p")'

The -p flag ensures that the shell retains the elevated privileges from the SUID binary. The command dropped me into a root shell! I verified my access with whoami, navigated to the /root directory, and read the final flag: cat /root/root.txt.

• Q: root.txt
• Answer: (cat /root/root.txt)

Conclusion & Takeaways

"RootMe" is a brilliant beginner lab that demonstrates the dangers of inadequate input validation on file upload forms. Bypassing basic .php filters with .phtml is a classic technique every penetration tester should know. Additionally, it highlights why system administrators must be incredibly careful when assigning SUID permissions to powerful binaries like Python.

Thanks for checking out my walkthrough!