THM - Jump

A writeup for “Jump” on TryHackMe.

Use privilege escalation knowledge to jump from a normal user to root.

The room involves multiple privilege escalations across different users on a target machine. This is achieved by exploiting misconfigured permissions over cron jobs, system services, and sudo scripts.

https://tryhackme.com/room/jump

Disclaimer

The content of this article is for educational purposes only. Do not use the techniques described here on any system without the explicit consent of the owner.

Footprinting

We can start by doing a scan with nmap.

PORT   STATE SERVICE VERSION
21/tcp open  ftp     vsftpd 3.0.5
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
| drwxrwxrwx    2 115      123          4096 Apr 30 06:00 incoming [NSE: writeable]
|_drwxr-xr-x    4 115      123          4096 Jun 09 08:22 pub
| ftp-syst: 
|   STAT: 
| FTP server status:
|      Connected to ::ffff:10.128.92.254
|      Logged in as ftp
|      TYPE: ASCII
|      No session bandwidth limit
|      Session timeout in seconds is 300
|      Control connection is plain text
|      Data connections will be plain text
|      At session startup, client count was 1
|      vsFTPd 3.0.5 - secure, fast, stable
|_End of status
22/tcp open  ssh     OpenSSH…