# TryHackme Bounty Hacker room Walkthrough

Hi! This is Bounty hacker room CTF challenge walkthrough. I am Adbin Magar the researcher behind TheGreyLens. Join me as I tackle the 'Bounty Hacker' CTF room on TryHackMe.

**Question 1:** Deploy the machine  
**Answer: No Answer Needed**

**Question 2:** Find open ports on the machine

Here, I used my go-to tools Nmap to scan the target with also intention to find the open ports.

![](https://cdn.hashnode.com/uploads/covers/6914271866fe9f4d18f8b8c2/03757f9a-b555-48c0-a068-1eaa0b7594e2.png align="center")

**Answer: No Answer Needed**

**Question 3:** Who wrote the task list?

In Nmap there was FTP service open so putting in mind that first always check default I try FTP anonymous login which was successful. After using `ls` command it show me two file `locks.txt` and `task.txt` which i downloaded in my attacker machine.

![](https://cdn.hashnode.com/uploads/covers/6914271866fe9f4d18f8b8c2/e1b28e80-62e3-4450-855a-a811dec91c1c.png align="center")

After downloading both file I use `cat` command in task.txt file in where `lin` was the author name.

![](https://cdn.hashnode.com/uploads/covers/6914271866fe9f4d18f8b8c2/c60813bb-caf8-48f4-b0fa-ce5cb3ce32c2.png align="center")

**Answer: lin**

**Question 4:** What service can you bruteforce with the text file found?

**Answer: SSH**

**Question 5:** What is the users password?

I already downloaded locks.txt file . So, when reading the file I get to know that it is wordlist of the password so having lin as user I use hydra tool to bruteforce lin password.

`hydra -l lin -P locks.txt ssh://10.48.186.52 -t 4 -V`

![](https://cdn.hashnode.com/uploads/covers/6914271866fe9f4d18f8b8c2/165dba0b-8e6e-4105-ab86-2e272a2810ca.png align="center")

**Answer: RedDr4gonSynd1cat3**

**Question 6:** user.txt

Lets recall from our Nmap scan that the target had an SSH service running. So, using the credentials discovered during the brute-force attack, I successfully authenticated as the user `lin`. Once logged in, I ran the `ls` command which shows that there is `user.txt` file. I then read its contents to retrieve the flag.

![](https://cdn.hashnode.com/uploads/covers/6914271866fe9f4d18f8b8c2/82e4e68b-8e48-48a6-9239-ff98ab0772b6.png align="center")

**Answer: THM{CR1M3\_SyNd1C4T3}**

**Question 7:** root.txt

To obtain the `root.txt` flag, I began by checking the current user's sudo capabilities with `sudo -l`. This revealed that the user `lin` has permission to run `/bin/tar` as the root user, which is a clear vector for privilege escalation.

![](https://cdn.hashnode.com/uploads/covers/6914271866fe9f4d18f8b8c2/ab6bedf6-d1b0-4970-9155-addeb09e9bbb.png align="center")

Referencing the **GTFOBins** which is my goto site for privelege escalation.

`https://gtfobins.org/gtfobins/tar/#shell`

![](https://cdn.hashnode.com/uploads/covers/6914271866fe9f4d18f8b8c2/a576566e-c336-4d19-8d16-2c2e475f1e4b.png align="center")

I followed the instructions found in the **GTFOBins** `tar` shell section to construct a command that escalates privileges to root as following:

`sudo /bin/tar cf /dev/null /dev/null --checkpoint=1 --checkpoint-action=exec=/bin/sh`

![](https://cdn.hashnode.com/uploads/covers/6914271866fe9f4d18f8b8c2/56e0bf2c-6d36-4819-a373-47f78877b683.png align="center")

**Answer: THM{80UN7Y\_h4cK3r}**

### **🎯 Day 2 Mission Accomplished**

Flag captured! That concludes Bounty Hacker room CTF challenge. Today was a great learning experience. I hope you learned something too. See you on next blog.

Happy hacking! :)