{
  "id": 17629657,
  "title": "sudo vim Was All It Took to Go From User to Root — Simple CTF (TryHackMe)",
  "url": "https://urgent.news/2026/11/01/sudo-vim-was-all-it-took-to-go-from-user-to-root-simple-ctf-tryhackme",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-11-01T15:57:23.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/cyberfarhan/sudo-vim-was-all-it-took-to-go-from-user-to-root-simple-ctf-tryhackme-1a4"
  },
  "original_language": "en",
  "account": "Attention-grabbing opening: In a straightforward Capture The Flag challenge, a single command, sudo vim, elevated a user to root status across three services on an anonymous FTP server. This simple CMS-based attempt illustrates the vulnerabilities present in web applications.\n\nInitial reconnaissance: Three distinct ports were identified via Nmap - FTP, HTTP, and SSH. The anonymous FTP login allowed immediate access to the system, while the SSH service operating on port 2222 appeared to be a security measure rather than an added layer of protection. The robots.txt file on the HTTP server revealed a medical records software installation at /simple/, which proved to be a red herring.\n\nExploiting the CMS: After discovering the true target CMS at /simple/ during directory enumeration, attackers uploaded a PHP reverse shell. The CMS Made Simple version was outdated, and contained a blind SQL injection vulnerability in the News module, which allowed attackers to extract usernames, email addresses, password hashes, and salts directly from the CMS database. Using this information, the hash was cracked using Hashcat mode 20 with a rockyou.txt dictionary attack, revealing the password \"secret\".\n\nAccess and exploitation: With the cracked credentials, the attackers gained access to the CMS admin panel, logging in successfully with mitch:secret. After confirming the credentials using Hydra brute-force tool, the CMS admin panel was used to upload a PHP reverse shell. Although the application attempted to prevent malicious file uploads, it failed to account for alternative PHP execution extensions like .phtml, allowing the reverse shell to be uploaded successfully. Finally, by navigating to the uploaded file, the shell was triggered, granting the attackers complete control over the system.",
  "summary": "Platform: TryHackMe · Difficulty: Easy · Category: CMS SQLi / Upload Filter Bypass / GTFOBins Introduction Simple CTF tells you exactly how complicated things are going to get right there in the name. Three services, one username left in a plaintext note on an anonymous FTP server, a CMS running a publicly known SQL injection vulnerability, and a sudo rule so generous it might as well be a signed…",
  "key_points": [
    "Single command 'sudo vim' elevated user to root on three services",
    "Anonymous FTP login provided immediate system access",
    "Outdated CMS Made Simple had blind SQL injection vulnerability"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}