TryHackMe - Anonymous - Walkthrough | ctf

Let's root this, TryHackMe Anonymous machine in this walkthrough. This will help us get an understanding of the basics of penetration testing, this is a great beginner level linux server to pentest.

TryHackMe Room:
https://tryhackme.com/room/anonymous

My TryHackMe Profile:
https://tryhacme.com/p/leo5o5


First we run a standard NMAP scan to enumerate the ports and services, finding 4 ports open:
21: FTP
22: SSH
139: SMB
445: SMB

Let's take a look at the FTP server, we first try to do an anonymous login...and it actually works. Once we're in let's enumerate the directories and move into the scripts folder, we find 3 files:
clean.sh
removed_files.log
to_do.txt

The log file on this tryhackme anonymous box contains what looks like the output from a cron job, we check the shell script and it appears to be a script that does some cleanup. Our FTP user doesn't have execute permissions obviously so we need to abuse this shell script to do start a reverse shell, we hit DuckDuckGo and we find suitable reverse shell script we can paste in, in this case it's a Bash reverse shell. Let's overwrite clean.sh with our own bash script which executes the Bash reverse shell.

Once that's setup, let's start our netcat listener, and boom the cron job executes and we get a shell. Once we bounce into the user's home folder we find the user.txt flag, great. Next up we need to privelage escalate, we're going to start by searching for SUID binaries, which are binaries that execute with elevated permissions even when executed by regular users.

We notice the "/usr/bin/env" binary can be abused, so we hit gtfobins and figure out how to use it. Once we run the correct command we can call "whoami" and we are indeed root. So let's peruse the directories and what do we find? /root/root.txt! Boom we got our root flag. I hope you enjoyed this TryHackme Anonymous walkthrough.

My Blogsite : https://www.dailycyberinfo1.blogspot.com

Follow me on Facebook : https://facebook.com/debajyoti.h
Follow me on Twitter : https://twitter.com/Debajyoti077
Follow me on GitHub : https://github.com/Debajyoti0-0
Follow me on LinkedIn : https://linkedin.com/in/debajyoti-haldar-86ba62153
Follow me on Instagram : https://instagram.com/debajyoti0_0