---
description: >-
  Detailed analysis for technical teams, covering methodologies, tools, and
  findings.
---

# Technical Report

## <mark style="color:purple;">Technical Security Report: "RootMe" System</mark>

### <mark style="color:purple;">Purpose of the Report</mark>

This report documents a simulated security assessment conducted on the "Rootme" system from TryHackMe. The objective was to perform reconnaissance, obtain a remote shell, and escalate privileges to root, thereby demonstrating the potential attack vectors and highlighting key areas for security improvement.

***

### <mark style="color:purple;">Methodology</mark>

The assessment was executed in three primary phases:

1. **Reconnaissance:** Identification of open ports and services using Nmap, directory enumeration via Dirbuster, and analysis of public files (e.g., robots.txt).
2. **Shell Acquisition:** Exploiting a file upload vulnerability to bypass restrictions and deliver a PHP reverse shell.
3. **Privilege Escalation:** Locating misconfigured SUID binaries and leveraging them (using GTFOBins) to escalate privileges to root.

***

### <mark style="color:purple;">Detailed Findings</mark>

#### 1. Reconnaissance

* **Tool Used:** Nmap
*   **Command Executed:**

    ```bash
    nmap -F -T5 -sVC <ip_target>
    ```

    * **-F:** Scans the top 100 common ports.
    * **-T5:** Uses aggressive timing for faster results.
    * **-sVC:** Executes default scripts for service and version detection.
* **Results:** Two open ports were identified:
  * **Port 22:** SSH service.
  * **Port 80:** HTTP service.
* **Additional Enumeration:**
  * **Web Analysis:** The HTTP service was examined by visiting `http://<`ip\_target`>:80`. The source code and robots.txt file were inspected, yielding no significant details.
  * **Directory Discovery:**
    * **Tool Used:** Dirbuster
    * **Outcome:** The `/panel/` directory was discovered, indicating the presence of a file upload interface.

#### 2. Obtaining a Remote Shell

* **Vulnerability Exploited:**
  * The `/panel/` directory featured a file upload form. Attempts to upload a PHP reverse shell script were initially blocked due to extension restrictions.
* **Bypass Technique:**
  * Modified the file extension to `.php5` (and other variants such as `.png.php` and `.pHp` were attempted), with `.php5` successfully bypassing the restrictions.
* **Reverse Shell Deployment:**
  * **Preparation:**
    * A PHP reverse shell script (with customized connection details) was prepared.
    *   The attacker set up a listener using Netcat:

        ```bash
        nc -lnvp 8888
        ```
  * **Execution:**
    * The crafted file was uploaded via the panel, and upon triggering, an interactive shell connection was established.
* **Post-Exploitation Check:**
  * Running `whoami` confirmed the shell was operating as the **www-data** user.

#### 3. Privilege Escalation

* **Objective:** Escalate from www-data to root.
* **Initial Check:**
  * **Command Executed:** `sudo -l`
  * **Result:** No direct sudo privileges were granted.
* **SUID Enumeration:**
  *   **Command Executed:**

      ```bash
      find / -type f -perm -04000 -ls 2>/dev/null
      ```
  * **Observation:** The binary `/usr/bin/python` was identified as a potential candidate for exploitation.
* **Exploitation via GTFOBins:**
  *   **Technique:** Leveraged the SUID bit on Python by executing:

      ```bash
      python -c 'import os; os.execl("/bin/sh", "sh", "-p")'
      ```
  * **Outcome:** The command spawned a shell with elevated privileges, effectively granting root access.
* **Verification:**
  *   The final step involved locating and reading the `root.txt` file to confirm complete system compromise:

      ```bash
      find / -type f -name "*root.txt*" 2>/dev/null
      ```

***

### <mark style="color:purple;">Conclusion</mark>

The "Rootme" system was successfully compromised by following a structured approach. Initial reconnaissance revealed basic services and a vulnerable file upload interface. Exploiting this vulnerability allowed the deployment of a PHP reverse shell, providing a foothold as the www-data user. Finally, leveraging a misconfigured SUID binary facilitated privilege escalation to root. This assessment underscores the importance of properly securing file upload functionalities, restricting SUID binaries, and continuously monitoring for misconfigurations to mitigate similar attacks in a production environment.
