THM RootMe Walkthrough

Welcome back geeks (a term of endearment I assure you).

Today we are going to do a quick guided walkthrough of the RootMe box by TryHackMe. Without further ado, start your engines and get ready for the nmap scan.

This answers the first two questions:

Scan the machine, how many ports are open?

What version of Apache is running?

It then tells us to perform a directory list scan on the box, and find the hidden directory. Easy enough!

Browsing to our secret directory, we find a landing page with what looks to be an upload form. Im going to go straight for gold and see if it will take a php reverse shell. The one we are going to be using is the PentestMonkey PHP-Reverse-Shell. Make sure to edit the shell to contain your IP and listening port before uploading.

Nope. Not sure what language that is, but I'm pretty certain it translates as "Nice try, not going to happen". I'm guessing it's a file extension filter, we can try and bypass that by changing our shell to php5.

Green and "sucesso!". This looks more promising. We can see from our earlier gobuster scan that there was an /uploads directory. Running a quick check shows us that our shell has landed on the server as expepcted.

Before we open the shell we uploaded, we need to start netcat on our machines specified listening port (1337 of course!) in order to catch the reverse shell. Then go ahead and click on the file we uploaded to the server.

We got a low-level shell as user www-data. Still probably enough to get the user flag, so let's go ahead and grab that.

Time for root. The box instructions give us a big hint here, and suggest looking for files with SUID permission, so that's what we will do!

Python.... Ok! As usual GTFOBins gives us a helping hand here in escalating privileges using this binary.

Just like that. We are root.

Thanks for following along, I find that writing these things down helps to cement my learning. And hopefully you learnt something new yourself!