# TryHackme [rrootme] room Walkthrough

Hello there I'm Adbin Magar a person behind the TheGreyLens. I decide to do challenge where I will do TryHackme CTF challenge with writing walkthrough of it. Now, I am doing \[rrootme\] room CTF challenge and as a friend I give you advice to do this challenge also. Now lets Start:

## Phase 1: Reconnaissance (Information Gathering)

First, I use nmap tool to map my target. Now lets understand the option that i used so that you can know why I used okay.

*   `-sV`: It stand for service version so basically to see service version.
    
*   `-vV`: It stand for very verbose so basically it does is that it gives me high level detail of information in real time without missing anything.
    
*   `-T5`: It stands for Timing Template 5. Think of it as having 5 workers (threads) doing the job at once, which makes the scan run very fast. But, keep in mind that Nmap’s default speed is -T4. In real-world professional environments, we usually stick to -T4 or lower to avoid being detected or crashing the target server, but for learning labs like TryHackMe, -T5 is great for getting results quickly.
    
*   `-p-`: It stands for port which allows to send request in specific port only if we mention but using `-p-` means to scan in all port.
    

![](https://cdn.hashnode.com/uploads/covers/6914271866fe9f4d18f8b8c2/2b6363b9-d607-49ce-a31f-a7f80f76f93a.png align="center")

## Phase 2: Enumeration

After identifying SSH and HTTP services, I used **Gobuster** with `common.txt` to brute-force directories. This revealed a `/panel` directory for file uploads and an `/uploads` directory where uploaded files are stored. Gobuster output there i found `/panel` directory where we can upload file and there is `/uploads` directory where we can see the uploaded file.

![](https://cdn.hashnode.com/uploads/covers/6914271866fe9f4d18f8b8c2/71476a8c-7f02-40ae-8a05-721b2c705782.png align="center")

## Phase 3: Exploitation (Upload & Execute)

Since, the target has upload feature, I performed Upload and Execute Attack using pre written script from github so lets do first git clone:

`git clone` [`https://github.com/pentestmonkey/php-reverse-shell`](https://github.com/pentestmonkey/php-reverse-shell)

Also, we can used this tools `https://www.revshells.com/` where we can just type IP and port then it will automatically generate the one liner command for almost every language. Using this also we can get reverse shell okay save it in bookmarks.

After that i open php file where i update my attacker ip and port. Also, In here I find that PHP extension file is restricted so that to bypass it I renamed the file to `.phtml` which is a php html embedded file.

![](https://cdn.hashnode.com/uploads/covers/6914271866fe9f4d18f8b8c2/2d92809e-585c-4a8a-9b95-75f9464604bb.png align="center")

After that i upload a php-reverse-shell.phtml file in `/panel` directory form which now it show success.

![](https://cdn.hashnode.com/uploads/covers/6914271866fe9f4d18f8b8c2/c1221b54-d25d-44a6-98f7-e344ffdc089e.png align="center")

After that I used netcat which is a networking tool used here to listen for the incoming connection from the target. Lets remember earlier in pre written script we update port as 1234 here also I wil listen in 1234:

![](https://cdn.hashnode.com/uploads/covers/6914271866fe9f4d18f8b8c2/cfff90c4-690e-4050-99ba-998859e661a2.png align="center")

In `uploads/` directory we can see that our script was uploaded which i click and it instanlty give me access in my attacker machine terminal .

![]( align="center")

![](https://cdn.hashnode.com/uploads/covers/6914271866fe9f4d18f8b8c2/3f7dd3fb-fad0-4db4-8648-e5d409292755.png align="center")

Boom we did the reverse shell as you can see i can view the target folder by dong now just `ls` command which means i am inside in the target.

![](https://cdn.hashnode.com/uploads/covers/6914271866fe9f4d18f8b8c2/9b98a77d-22ee-4e36-8d87-e001faf5c3c3.png align="center")

![]( align="center")

Now I need to find user.txt so lets not waste time and use our command find command to loacate user.txt:

`find / -type f -name user.txt`

![](https://cdn.hashnode.com/uploads/covers/6914271866fe9f4d18f8b8c2/0a4d03d7-9caa-4195-9286-f6a46f226af2.png align="center")

Okay from our find output we can see there is user.txt file in `/var/www/` folder. Then using cat command to read user.txt there we got the flag. Mission complete getting user.txt file flag.

![](https://cdn.hashnode.com/uploads/covers/6914271866fe9f4d18f8b8c2/34c4b2f8-ae99-48ad-b138-8466fe6ddfcf.png align="center")

Next, I searched for SUID binaries files that allow a normal user to execute them with the privileges of the file owner (root) even though I am normal user. Think of this as a 'VIP badge' left on a table that grants temporary root access. I used:

`find / -name root -perm /400 - type f 2>/dev/null`

okay I discovered the weird file is `/usr/bin/python2.7` because this file is often used in privelege escalation.

![](https://cdn.hashnode.com/uploads/covers/6914271866fe9f4d18f8b8c2/e1352011-0d15-44fd-8d5c-65d0cc413197.png align="center")

After, that for privilege escalation I go to the [https://gtfobins.org/gtfobins/python/](https://gtfobins.org/gtfobins/python/) Since `/usr/bin/python2.7` had the SUID bit set, I navigated to the 'SUID' section on the site. There, I found the specific command needed to leverage the SUID permission and elevate my privileges to root.

![](https://cdn.hashnode.com/uploads/covers/6914271866fe9f4d18f8b8c2/db38edfa-f3ca-4b71-9a62-33cc2466a0e5.png align="center")

Boom We successfully escalate from normal user to root. Now, My goal was to find `root.txt` file. So, I first did is `ls` and from its output i feel like flag will be in root folder but I decide to search the root.txt file directly before hand which eventually tell me that there is root.txt file in root folder.

![](https://cdn.hashnode.com/uploads/covers/6914271866fe9f4d18f8b8c2/34d648d2-eb23-425e-800e-7f404feb18c8.png align="center")

After finding that the `root.txt` file is in root folder. I use cat command to read root.txt file which get me the root.txt file flag easily.

### 🎯 Day 1 Mission Accomplished

Flag Captured ! That concludes my \[rrootme\] room CTF Challenge. Today was a great learning hope you learn some also now lets meet in another blog bye.

Happy Hacking :)