Write-up: TryHackMe Room “Anonymous”

Welcome to this comprehensive technical article where we will walk through the step-by-step process of solving the popular Anonymous room on TryHackMe. This room serves as a practical exercise to enhance ethical hacking skills and focus on offensive security concepts in an organized manner.

1. Reconnaissance The journey always begins with gathering information about the target using standard enumeration tools. We performed a comprehensive scan using Nmap to identify open ports and running services on the target machine:

nmap -sC -sV
The scan results revealed several key ports and services:

Port 21 (FTP): vsftpd service allowing anonymous login (Anonymous FTP login allowed), along with a writable directory named scripts.
Port 22 (SSH): Secure shell service OpenSSH.
Ports 139 / 445 (SMB): Samba file sharing protocol.

1. FTP Exploitation and Anonymous Login Since the FTP server allowed access via the anonymous account, we logged in directly without a password:

ftp

Exploring the directories led us to the scripts folder, which contained the following files:
clean.sh
removed_files.log
to_do.txt
We noticed that the clean.sh script runs periodically (via a Cron Job), which creates an ideal opportunity for command injection or Cron Job Hijacking.

Before moving to initial access, we downloaded the original clean.sh file from the server to our local machine to analyze and edit it using the following command:

ftp> get clean.sh

1. Initial Access We edited the local clean.sh file using nano to add our reverse shell payload:

nano clean.sh

After modifying the script, we uploaded the updated file back to the scripts directory via FTP:

ftp> put clean.sh

Simultaneously, we set up a Netcat listener on our Kali machine:

nc -lvnp 4444

Once the script executed automatically on the target system, we successfully received the connection and obtained a shell as the regular user namelessone. From there, we were able to read the first user flag:

User Flag: ………………………………………….

1. Privilege Escalation to Root To search for potential vectors to escalate our privileges to root, we looked for files with the SUID permission bit set using the following command:

find / -perm -4000 -type f 2>/dev/null

The results highlighted an unexpected binary — specifically, the use of /usr/bin/env combined with the shell (/bin/sh -p). Following the guidance from the well-known GTFOBins platform for privilege escalation:

/usr/bin/env /bin/sh -p
Executing this command instantly dropped us into a root shell! We then navigated to the root directory to read the final flag:

Root Flag: …………………………………………