---
description: >-
  Students will learn how to escalate privileges using a very vulnerable Linux
  VM. SSH is open. Your credentials are TCM:Hacker123
---

# Linux PrivEsc Arena \[WIP]

{% embed url="https://tryhackme.com/room/linuxprivescarena" %}
[https://tryhackme.com/room/linuxprivescarena](https://tryhackme.com/room/linuxprivescarena)
{% endembed %}

| Room Attributes       | Value                                                                   |
| --------------------- | ----------------------------------------------------------------------- |
| Subscription Required |  <mark style="color:green;background-color:green;">False</mark> \[Free] |
| Type                  | Walkthroughs                                                            |
| Difficulty            |  <mark style="color:orange;background-color:yellow;">Medium</mark>      |
| Tags                  | Security, Linux, PrivEsc                                                |

## Task 1 \[Optional] Connecting to the TryHackMe network

### Read the above.

{% hint style="success" %}
No answer needed
{% endhint %}

## Task 2 Deploy the vulnerable machine

### Deploy the machine and log into the user account via SSH (or use the browser-based terminal).

{% hint style="success" %}
No answer needed
{% endhint %}

## Task 3 Privilege Escalation - Kernel Exploits

### Click 'Completed' once you have successfully elevated the machine

{% hint style="success" %}
No answer needed
{% endhint %}

## Task 4 Privilege Escalation - Stored Passwords (Config Files)

### What password did you find?

<details>

<summary>Reveal Flag <span data-gb-custom-inline data-tag="emoji" data-code="1f6a9">🚩</span></summary>

:triangular\_flag\_on\_post:`???`

</details>

### What user's credentials were exposed in the OpenVPN auth file?

<details>

<summary>Reveal Flag <span data-gb-custom-inline data-tag="emoji" data-code="1f6a9">🚩</span></summary>

:triangular\_flag\_on\_post:`???`

</details>

## Task 5 Privilege Escalation - Stored Passwords (History)

### What was TCM trying to log into?

<details>

<summary>Reveal Flag <span data-gb-custom-inline data-tag="emoji" data-code="1f6a9">🚩</span></summary>

:triangular\_flag\_on\_post:`???`

</details>

### Who was TCM trying to log in as?

<details>

<summary>Reveal Flag <span data-gb-custom-inline data-tag="emoji" data-code="1f6a9">🚩</span></summary>

:triangular\_flag\_on\_post:`???`

</details>

### Naughty naughty.  What was the password discovered?

<details>

<summary>Reveal Flag <span data-gb-custom-inline data-tag="emoji" data-code="1f6a9">🚩</span></summary>

:triangular\_flag\_on\_post:`???`

</details>

## Task 6 Privilege Escalation - Weak File Permissions

### What were the file permissions on the /etc/shadow file?

<details>

<summary>Reveal Flag <span data-gb-custom-inline data-tag="emoji" data-code="1f6a9">🚩</span></summary>

:triangular\_flag\_on\_post:`???`

</details>

## Task 7 Privilege Escalation - SSH Keys

### What's the full file path of the sensitive file you discovered?

<details>

<summary>Reveal Flag <span data-gb-custom-inline data-tag="emoji" data-code="1f6a9">🚩</span></summary>

:triangular\_flag\_on\_post:`???`

</details>

## Task 8 Privilege Escalation - Sudo (Shell Escaping)

### Click 'Completed' once you have successfully elevated the machine

{% hint style="success" %}
No answer needed
{% endhint %}

## Task 9 Privilege Escalation - Sudo (Abusing Intended Functionality)

### Click 'Completed' once you have successfully elevated the machine

{% hint style="success" %}
No answer needed
{% endhint %}

## Task 10 Privilege Escalation - Sudo (LD\_PRELOAD)

### Click 'Completed' once you have successfully elevated the machine

{% hint style="success" %}
No answer needed
{% endhint %}

## Task 11 Privilege Escalation - SUID (Shared Object Injection)

### Click 'Completed' once you have successfully elevated the machine

<details>

<summary>Reveal Flag <span data-gb-custom-inline data-tag="emoji" data-code="1f6a9">🚩</span></summary>

:triangular\_flag\_on\_post:`???`

</details>

## Task 12 Privilege Escalation - SUID (Symlinks)

### What CVE is being exploited in this task?

<details>

<summary>Reveal Flag <span data-gb-custom-inline data-tag="emoji" data-code="1f6a9">🚩</span></summary>

:triangular\_flag\_on\_post:`???`

</details>

### What binary is SUID enabled and assists in the attack?

<details>

<summary>Reveal Flag <span data-gb-custom-inline data-tag="emoji" data-code="1f6a9">🚩</span></summary>

:triangular\_flag\_on\_post:`???`

</details>

## Task 13 Privilege Escalation - SUID (Environment Variables #1)

### What is the last line of the "`strings /usr/local/bin/suid-env`" output?

<details>

<summary>Reveal Flag <span data-gb-custom-inline data-tag="emoji" data-code="1f6a9">🚩</span></summary>

:triangular\_flag\_on\_post:`???`

</details>

## Task 14 Privilege Escalation - SUID (Environment Variables #2)

### What is the last line of the "`strings /usr/local/bin/suid-env2`" output?

<details>

<summary>Reveal Flag <span data-gb-custom-inline data-tag="emoji" data-code="1f6a9">🚩</span></summary>

:triangular\_flag\_on\_post:`???`

</details>

## Task 15 Privilege Escalation - Capabilities

### Click 'Completed' once you have successfully elevated the machine

{% hint style="success" %}
No answer needed
{% endhint %}

## Task 16 Privilege Escalation - Cron (Path)

### Click 'Completed' once you have successfully elevated the machine

{% hint style="success" %}
No answer needed
{% endhint %}

## Task 17 Privilege Escalation - Cron (Wildcards)

### Click 'Completed' once you have successfully elevated the machine

{% hint style="success" %}
No answer needed
{% endhint %}

## Task 18 Privilege Escalation - Cron (File Overwrite)

### Click 'Completed' once you have successfully elevated the machine

{% hint style="success" %}
No answer needed
{% endhint %}

## Task 19 Privilege Escalation - NFS Root Squashing

### Click 'Completed' once you have successfully elevated the machine

{% hint style="success" %}
No answer needed
{% endhint %}

