RootMe — TryHackMe Write-up

Reconnaissance

I started by scanning the target using Nmap to check for open ports and running services.

I started with:

nmap -sC -sV 10.48.131.113

nmap -sC -sV 10.48.131.113

The scan showed two open ports, 22 and 80. Port 22 was running SSH, while port 80 was running HTTP. The Apache version was 2.4.41.

• Open ports: 2
• Apache version: 2.4.41
• Port 22 service: SSH

Enumeration

I visited the website but did not find anything useful on the homepage, so I used Gobuster to look for hidden directories.

I ran this:

gobuster dir -u http://10.48.131.113 -w /usr/share/wordlists/dirb/common.txt

gobuster dir -u http://10.48.131.113 -w /usr/share/wordlists/dirb/common.txt

The scan revealed /panel/ and /uploads/, among other directories. I checked /panel/ and found a file upload form. I tested it using a text file and confirmed that the uploaded file appeared in /uploads/.

Hidden directory: /panel/

Getting a Shell

The upload form became my next point of investigation. I looked into the file restrictions and prepared a PHP reverse shell configured to connect back to my attacking machine. I also set up a Netcat listener to receive the connection.

Finding the User Flag

After obtaining a shell, I searched for the user.txt file using this:

find / -type f -name user.txt 2>/dev/null

find / -type f -name user.txt 2>/dev/null

I located the file, read its contents, and submitted the flag to TryHackMe.

User flag: THM{y0u_g0t_a_sh3ll}

Privilege Escalation

I searched for files with SUID permissions to look for possible privilege escalation methods.

find / -user root -perm /4000 2>/dev/null

find / -user root -perm /4000 2>/dev/null

I noticed that /usr/bin/python2.7 had SUID permissions, which seemed unusual. I checked GTFOBins for a way to use it for privilege escalation and tested the technique in the lab.

I verified that the privilege escalation was successful by running whoami, which returned root.

I then searched for the root.txt file using:

find / -type f -name root.txt 2>/dev/null

find / -type f -name root.txt 2>/dev/null

After locating the file, I checked its contents using cat and submitted the root flag to TryHackMe.

Root flag: THM{pr1v1l3g3_3sc4l4t10n}

And with that, we're done! Room completed!

Conclusion

Overall, this activity helped me understand the basic process of penetration testing, from scanning open ports and finding hidden directories to gaining access and escalating privileges. It also showed me how insecure file uploads and misconfigured SUID permissions can create security risks.