Library CTF Walkthrough (TryHackMe)

A Beginner Friendly Guide to solving the Library Room on TryHackMe

Introduction

Library CTF is a beginner Friendly CTF . It focuses on how to enumerate and get a shell using the protocols HTTP and SSH.

Room Information

• Platform: TryHackMe
• Room Name: Library
• Difficulty: Easy
• Category: Web /Enumeration
• Objective: Capture the Flag (CTF)

LIBRARY ROOM

Now lets take a look of the **lab **on TryHackMe.

Time to start the machine

Initial setup

After starting the machine, go to your own machine and start the TryHackMe VPN connection.

Enumeration

Let’s use Nmap to discover the open ports and identify the services running on the target machine.

nmap -sC -sV <ip> -T4 -oN Initial

Open Ports Identified:

• SSH -22
• HTTP -80

Exploring

After the Nmap scan, I opened port 80 in the browser to see if I could find anything useful. At first glance, it didn’t seem like there was anything interesting.

Next, I ran a Gobuster scan to look for hidden directories and web pages. During the scan, I discovered an interesting file: robots.txt

gobuster dir -u http://<ip>:80 -w /usr/share/wordlists/dirb/common.txt

I opened the robots.txt file and found a useful hint: rockyou.

I went back to the web page to look for anything I might have missed and found a username: “meliodas”

The next step was to use Hydra with the rockyou.txt wordlist to brute-force the password for the user meliodas .

hydra -l meliodas -P /usr/share/wordlists/rockyou.txt ssh://<IP>

We found password.

Now, let’s use ssh to log in to the remote server using the credentials we obtained.

After gaining shell access, I found two files: **bak.py and `user.txt**. I first read the contents ofuser.txt` and captured the user flag.

Next, I shifted my focus to privilege escalation. I examined the contents of **bak.py**, which turned out to be a Python script. I tried to execute it, but I didn't have the necessary permissions.

To check if the user **meliodas could run any commands with sudo **I used sudo -l

The sudo -l output showed that we could execute **bak.py** with elevated privileges.

To get a root shell, I replaced the original bak.py with a simple Python script:

import os
os.system("/bin/bash")

After saving the file and making it executable, I ran it using:

sudo /usr/bin/python /home/meliodas/bak.py

This spawned a root shell, giving me full access to the machine.

sudo /usr/bin/python /home/meliodas/bak.py

This spawned a root shell, giving me full access to the machine.

With root access, I navigated to the **/root directory and read the `root.txt`** file to capture the root flag.

ROOM COMPLETED SUCCESSFULLY.

Thank you for reading this walkthrough.