Post cover image

October 28, 2026

TryHackMe: RootMe Room Documentation

Technical documentation and walkthrough for the TryHackMe RootMe lab covering reconnaissance, , file upload bypass, and SUID priv escalation

By KYLE ENZO CARNATE

3 min read

TryHackMe: RootMe Room Walkthrough & Solution

An end-to-end operational walkthrough detailing reconnaissance, web application exploitation via file upload restriction bypass, and privilege escalation using misconfigured SUID binaries on Linux.

Overview

Target Machine: TryHackMe — RootMe

Focus Areas: Port Scanning, Directory Enumeration, File Extension Filter Bypass, Reverse Shell Execution, SUID Binary Exploitation

Step 1: Target Reconnaissance & Service Discovery

To establish initial visibility into the target system, I launched an Nmap service scan to discover active ports, running services, and underlying software versions.

nmap -sC -sV 10.48.167.175

Key Discoveries:

  • Port 22/tcp (SSH): Open running OpenSSH on Ubuntu.
  • Port 80/tcp (HTTP): Open running Apache web server (Apache httpd 2.4.41).

The initial scan confirmed that the target operates an active HTTP web application while offering SSH administrative access.

None

Step 2: Web Directory Enumeration

With the web server active on port 80, I conducted directory fuzzing using gobuster to reveal hidden paths and unlinked application endpoints.

gobuster dir -u http://10.48.167.175/ -w /usr/share/wordlists/dirb/common.txt

Discovered Directories:

  • /panel/ (Status: 301) – Web interface containing an active file upload control panel.
  • /uploads/ (Status: 301) – Storage directory where uploaded resources are served.

The /panel/ endpoint immediately stood out as a high-priority attack vector for arbitrary file uploads.

None

Step 3: Web Application Assessment & Upload Filter Bypass

Navigating to http://10.48.167.175/panel/ presented a simple web interface allowing users to submit files to the server.

Bypassing File Extension Restrictions:

  • Attempting to upload a standard PHP script (.php) resulted in an instant rejection error
  • PHP não é permitido! (PHP is not permitted!)
  • The web application implements a basic extension blacklist blocking .php files.
  • To bypass the client/server-side validation, I renamed the payload to use an alternative PHP extension, .phtml.
  • Uploading shell.phtml succeeded, and checking http://10.48.167.175/uploads/ confirmed the file was successfully stored and accessible.
None None None

Step 4: Initial Access via Reverse Shell

To gain an interactive command shell on the remote host, I configured a PentestMonkey PHP reverse shell script.

  • Modified the script's configuration to specify my local OpenVPN interface IP (tun0) and designated listening port (8687).
  • In a local terminal session on my Kali machine, I initiated a Netcat listener:
nc -lvnp 8687
  • Accessing http://10.48.167.175/uploads/shell.phtml through the browser executed the script, triggering an incoming connection back to my terminal.
None None

Step 5: Locating the User Flag

With access granted as www-data, I queried the filesystem to locate user.txt:

find / -type f -name "user.txt" 2>/dev/null

Location: /var/www/user.txt

Reading the file via cat /var/www/user.txt yielded the first flag.

None

Step 6: Privilege Escalation Enumeration (SUID Binaries)

To elevate privileges from www-data to root, I enumerated binaries configured with the SUID (Set User ID) permission bit, allowing executables to run under the context of the file owner (root).

Bash

find / -user root -perm /4000 2>/dev/null

Notable Findings:

Among standard binaries (passwd, su, ping), the scan identified an anomalous administrative tool:

/usr/bin/python2.7
None

Step 7: Executing Root Escalation & Flag Capture

Utilizing known techniques from GTFOBins for SUID Python binaries, I executed a system command through Python to spawn a subshell while maintaining elevated privileges:

/usr/bin/python -c 'import os; os.execl("/bin/sh", "sh", "-p")'

Running whoami verified current session privileges:

root
None

Locating the Final Root Flag:

find / -type f -name "root.txt" 2>/dev/null
cat /root/root.txt

Root access was successfully achieved, completing the full compromise of the target machine.

None None

Conclusion & Key Takeaways

  • Relying solely on extension blacklists (e.g., blocking .php while allowing .phtml) leaves applications vulnerable to simple extension bypasses.
  • Assigning SUID permissions to scripting interpreters like Python allows low-privilege users to execute arbitrary commands as root. Proper principle of least privilege should always be strictly enforced.