DEV Community: Swetha Jagannathan

Can you get the root access? THM ROOTME ROOM

Swetha Jagannathan — Mon, 25 Aug 2025 14:41:28 +0000

There’s nothing like the thrill of a challenge that whispers, “try me.” Today, I dove into the RootMe CTF room and walked away with root access—all while sharpening my hands-on skills in web security and pentesting.

Here’s how it went down:

Recon Like a Pro

Started with Nmap, scanning the target:

nmap -sC -sV -p-

Two ports were wide open. Curious, I ran an aggressive scan to pull service versions and get the Apache fingerprint. Knowing what you’re up against is half the battle.

Hunting for Hidden Paths

Time to map the terrain. Enter Gobuster:

gobuster dir -u http:// -w /usr/share/wordlists/dirb/common.txt

Two juicy paths popped up:

/uploads/ → seemed standard

/panel/ → the real playground

It was /panel/ that caught my eye. File upload functionality? Oh yes, vulnerabilities waiting to be discovered.

The Upload Trick

Classic move: I prepared a PHP reverse shell. But the site didn’t allow .php files. So… I went stealth mode: changed the extension to .phtml.

BANG! Uploaded!

Getting the Shell

Set up Netcat to listen:

nc -lvnp 1234

Ping… connection established. Boom! I was inside the server.

Privilege Escalation

Shell in hand, the target’s crown jewels were within reach. Using enumeration scripts and careful analysis, I escalated privileges and grabbed root access.

Lessons:

Recon is everything. Know the target before touching anything.

File upload vulnerabilities? Still a real threat today.

Small tweaks (like .phtml instead of .php) make the difference between “blocked” and “owned.”

Hands-on practice in CTFs = real-world skills. This is how you bridge the gap between theory and impact.

Takeaway:
Whether it’s CTFs or pentesting, the thrill isn’t just in “getting root”—it’s in learning, improvising, and leaving nothing unchecked. And yes… vibes means doing it with style.

       ~Swetha Jagannathan

From Enumeration to Escalation — Basic Pentesting room on TryHackMe

Swetha Jagannathan — Mon, 11 Aug 2025 14:05:16 +0000

Every exploit leaves a scar.
The Basic Pentesting room on TryHackMe wasn’t just a challenge — it was a battlefield.
I walked in with curiosity, and walked out with root… and a few lessons carved deep.

Let me tell you how I have survived the battle

Reconnaissance — The First Glance at the Enemy
Like any battle, I started with reconnaissance. A full Nmap scan revealed the battlefield:
_
22/tcp open ssh
80/tcp open http
139/tcp open netbios-ssn
445/tcp open microsoft-ds
8009/tcp open ajp13_

Each open port is like a wound in the armor. Some small. Some lethal.
SSH for remote access. HTTP for web content. Samba (139 & 445) for file sharing. And AJP13 — a rare find, often linked to Apache Tomcat.

Web Probing — The First Clues
The port 80 web service looked too plain on the surface, but I wasn’t fooled. I deployed Gobuster to enumerate hidden directories:

gobuster dir -u http://target_ip -w /usr/share/wordlists/dirb/common.txt

It didn’t take long before the loot dropped:

/development/

Inside, a few HTML comments whispered secrets — two names: K and J.
The hunt now had faces.

Samba Enumeration — Into the Shadows
With ports 139 and 445 open, Samba was the next step. I fired up enum4linux:

enum4linux -a target_ip

The scan confirmed anonymous SMB access — no password required. Using smbclient, I connected:

smbclient //target_ip/anonymous

Inside, I found staff.txt. Opening it revealed the players:

_Jan

Kay_

Two usernames. Two potential doors.

Password Hunting — Cracking the Gate
With a name like Jan, it was time for brute force. Hydra was my weapon of choice:

hydra -l jan -P /usr/share/wordlists/rockyou.txt ssh://target_ip

After a few tense minutes, the password emerged from the digital fog:

armando

One key down. One lock to pick.

Foothold — Becoming Jan
SSH gave me a way in:

ssh jan@target_ip
password: armando

Now, I had a shell inside enemy territory. But Jan wasn’t root — and I wasn’t leaving without the crown.

Privilege Escalation — Climbing the Ladder
Time to hunt for privilege escalation paths. I searched for SUID binaries — files that run with elevated permissions:

find / -perm -4000 2>/dev/null

Every unusual binary was a potential weapon.
One led me deeper into the system until I found it — the path to Kay’s files. Kay’s home directory was locked, but persistence pays. Eventually, I cracked it open and found the final password.

Victory — Claiming the Flag
With Kay’s credentials, I escalated to root.
The final flag was mine — the proof that the system had fallen.

Lessons from the Field
This wasn’t just a challenge; it was a blueprint for real-world pentesting:

Enumeration is king — every detail counts.

Brute force is noisy but effective when paired with good intel.

Privilege escalation requires patience and a sharp eye for misconfigurations.

The flag was just proof.
The real win? Leaving that machine broken

Onto the next hunt!
~ Swetha Jagannathan

Cracking TryHackMe’s “Simple CTF”: SQLi & CVE-2019-9053 in the Wild

Swetha Jagannathan — Sun, 03 Aug 2025 13:26:14 +0000

"You don’t need permission to test the lock — only the courage to pick it."

I recently tackled the Simple CTF room on TryHackMe — an entry-level but deeply satisfying box that reminded me how simplicity often hides sharp vulnerabilities.

Phase 1: Reconnaissance
Started with the usual:

nmap -sC -sV -oN simplectf.nmap

Dropped a scan. Ports 80 and 2222 welcomed me.

Ran Gobuster to enumerate directories:

gobuster dir -u http:// -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt

Discovered /login.php and /robots.txt, which hinted at hidden admin or CMS content.

Phase 2: Exploiting SQL Injection
Manual testing of the login form revealed it was vulnerable to SQL Injection.
bypassed authentication — a red flag in any real-world app.

Phase 3: CVE-2019-9053 – CuteNews CMS Exploit
Digging deeper into the /CuteNews directory, I identified the CMS as CuteNews v2.1.2, vulnerable to a well-known Remote Code Execution (RCE) flaw — CVE-2019-9053.

Exploited it using a Python script to upload a malicious PHP shell, then escalated privileges from there.

Payload Delivered. Root Access Secured.
Enumerated.
Escalated.
Exfiltrated.

Both user and root flags were claimed.
But more than that — control was mine.

What They Forgot:
[@] Input fields aren’t boxes. They’re entry points.

[@] A CMS is only “Cute” until it leaks.

[@] Security is a myth when curiosity is weaponized.

If you're reading this and building something — ask yourself:
Would it survive the hackers?
Because we won’t knock.

           ~Swetha Jagannathan

catch the trial: https://www.linkedin.com/in/swetha-jagannathan-97b101333/