𝗕𝗼𝘂𝗻𝘁𝘆 𝗛𝗮𝗰𝗸𝗲𝗿 𝘄𝗿𝗶𝘁𝗲𝘂𝗽 — 𝗧𝗿𝘆𝗛𝗮𝗰𝗸𝗠𝗲

From nmap to root.
Here is my writeUp for the Bounty Hacker CTF on TryHackMe. It’s a great, quick room that covers the trifecta of pentesting: Network Scanning, Brute-Forcing, and Privilege Escalation. Perfect for beginners looking to put it all together.

#ENJOY WITH PH1X0R17

1/-Reconnaissance phase:

we will do ports scan with “NMAP” command

nmap @ip_target

Ports Scan 1

The initial scan revealed that ports 21 (FTP), 22 (SSH), and 80 (HTTP) were open. With this information, I conducted a more detailed service version and default script scan using -sV and -sC flags.

Ports scan 2

we Know the versions of all services :

• Port 21: FTP service running vsftpd 3.0.5 (with Anonymous Login !!!!!!!!)
• Port 22: SSH service running OpenSSH 8.2p1
• Port 80: HTTP service running Apache 2.4.41

2/ — Enumeration :

Who wrote the task list?

Great job so far, Bounty Hacker. Let’s try logging in on the ftp service:

ftp @ip_target

ftp _ ls (So we have two files)

Note:

if ftp commad do not work , switch to “passive” mode and ASCII transfer mode. then used mgetto download both files to my local machine

download files on our machine

locks.txt

task.txt

Analyzing the downloaded files revealed:

• locks.txt: Appeared to be a password list containing potential credentials
• task.txt: Contained a task list signed by a user named “lin”’

We can see that lin has written the note.

Answer: lin

we have also http port open so we will check it

we see Users

So, I think I will put all the usernames in a file named “user.txt”. I’m doing this because we need to find the username and password. The syntax for SSH is like this:

ssh user@ip_target

users test

3/-Exploitation Phase:

What service can you bruteforce with the text file found?

Get Fethallah Abdelkader GHELLAIMI’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

This looks to be like some kind of wordlist that we can use to gain access to a server. Since we have a protected SSH access to the server I am going to guess we can bruteforce it.

Answer: SSH

What is the users password?

To bruteforce lin’s password we can use hydra

Cracking the code with hydra

Answer: RedDr4gonSynd1cat3

I established an SSH connection using these credentials and successfully retrieved the first flag (user.txt)

Logging into the SSH service and finding the flag

Answer: THM{CR1M3_SyNd1C4T3}

4/-Privilege Escalation:

For privilege escalation, I began enumerating the system. Using sudo -l, I discovered that the user "lin" could execute /bin/tar with sudo privileges without requiring a password as the root user.

SUDO -L

I checked GTFOBins and quickly found a tar payload that worked perfectly for privilege escalation.

sudo tar -cf /dev/null /dev/null --checkpoint=1 --checkpoint-action=exec=/bin/sh

privilege escalation

root.txt flag

Answer: THM{80UN7Y_h4cK3r}

Conclusion

And that’s a wrap! I hope this walkthrough was clear and helpful. Bounty Hacker was definitely on the easier side, but I’ll admit — the final step took a little extra thought to figure out. It’s a good reminder that proper enumeration can make all the difference. Thanks for reading ❤

— ph1x0r17