Bounty Hacker — TryHackMe Walkthrough
Introduction
Bounty Hacker is a beginner-friendly CTF on TryHackMe that walks you through key concepts in Linux privilege escalation. I learned a lot while working through it, so here’s a detailed walkthrough for anyone else looking to solving this room!
Step 1 — Recon and Enumerate
Let’s begin with a Nmap scan to see what services are exposed and for open ports.
nmap -Pn -sV 
We’ve got FTP, SSH, and a web server running on port 21,22. Let’s explore them one by one.
Step 2 — Login Via ftp Service
FTP servers are sometimes configured to allow anonymous login. Depending on what the FTP server has been configured to allow an anonymous user to access, this can sometimes be helpful.
ftp 10.48.186.62
We have access to two files on the FTP server: ‘locks.txt’ and ‘task.txt’, which sounds like it might contain the task list that TryHackMe mentioned.
Get Utsav Thakur’s stories in your inbox
Join Medium for free to get updates from this writer.
We can download these files from the FTP server using get command:
Now we can read the contents of task.txt using cat:
Boom — username found: lin
Step 3 — Brute-forcing SSH using Hydra
So now we have a potential username (lin) and what looks suspiciously like a list of passwords in locks.txt. I decided to use hydra against SSH using the username ‘lin’ and password list ‘locks.txt’:.
hydra -l lin -P locks.txt ssh://10.48.186.62 -t 4
Now that we have a username and password, we can login using ssh:
ssh lin@10.48.186.62
We’re in!
ls
cat user.txtStep 4 — Privilege Escalation
At this point, we want to escalate privileges — ideally to the root user. Next I check which commands can be run by the lin user as sudo, using the sudo command.
sudo -l
It looks like lin is allowed to run tar with sudo privileges. This means that it might be possible to use sudo tar to escalate our privileges!
Next I cross-checked tar with GTFOBins, which tells us if a command can be used to bypass security privileges.
We want to use GTFOBins to determine if tar is exploitable using sudo:
sudo tar -cf /dev/null /dev/null --checkpoint=1 --checkpoint-action=exec=/bin/sh
The fact that the web server was basically a red herring made this one a little interesting. I did think that there were a couple of things making this box artificially easy, but Bounty Hacker is rated as an easy box. This actually makes it a great box for people just getting started.
