Bounty Hacker TryHackMe

Today we will be becoming the bounty hacker we were meant to be. Lets dive into this room (which you can find here), and get the work done!

Doing a simple nmap scan first:

ftp, ssh, http are open, and the hint asks us to check ftp first:

I tried checking the home directory to see username, other users present etc. but wasnt allowed to do so.

Get eXpl017’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

Anyways, we found two files, and got them on my local comp. Lets check them out:

We know that there is a user named lin.

Looks like random words thrown in, could be wordlist. The hint tells us to use hydra for getting the password, lets use this list to get it:

Easy, we found the password for sshing to lin. Lets do that then:

There’s the sweet sweet flag we need. Now is the time to escalate. So let’s check a few things out:

We can run /bin/tar as root, now lets see GTFOBins for help:

This gives us the root shell we want, and now we can simply read the root.txt file:

Congratulations bud! You are the BOUNTY HUNTER!

Thats all for today. THANKYOU!!