U.A. High School TryHackMe Walkthrough | Writeup | Beginner Friendly | THM | — SuNnY

INTRODUCTION
The “U.A. High School” room on TryHackMe is inspired by the popular anime “My Hero Academia” . The room typically involves a combination of challenges related to cybersecurity, themed around the fictional U.A. High School, where students train to become heroes.
It includes tasks like network scanning, exploiting vulnerabilities, or finding hidden flags within a network simulation that fits the anime’s theme.
The room is likely designed to be engaging for fans of the series, offering a mix of technical cybersecurity skills while also referencing elements from the show and none-the-less for aspiring ethical hackers and red teamers
ROOM OBJECTIVES -
Finding the User and Root Flags
( Recon>Enum>Gaining Foothold > user.txt || Privilege Escalation > root.txt )

DIFFICULTY
Easy Room [ Linux Based Operating System ]
In my personal opinion , this room should be ranked to Medium
Due to image deciphering and base64 encryption
Just a Personal Heads up
** ( This Writeup | Walkthrough is Beginner Friendly ) **
KUDOS TO THE CREATORS
Special Thanks to the Creators of this room

LET’S START THE PARTY !
Firing up the Machine →

Let’s begin with adding the ip address to the Hosts file
and give it a domain name — school.thm
echo "IP-ADDRESS-OF-YOUR-MACHINE school.thm" | sudo tee -a /etc/hosts
Other Way :
nano /etc/hosts
IP-ADDRESS school.thm
( Control + X and Y for saving the file )
Dont forget to add your machine’s ip address instead of —
“IP-ADDRESS-OF-YOUR-MACHINE”
Let’s Start { Refer to Cyber Kill Chain }
Reconnaissance

Found 2 Open Ports : Port 80 ( HTTP ) & Port 22 ( SSH )
Directory Enumeration Using GoBuster
gobuster dir -w /home/kali/Seclist/raft-medium-words.txt -u http://school.thm -s 200,301 -b ""
with the flag -s , we are filtering the return status codes to 200 and 301 for faster scan results — you may skip this one and continue with the normal scan rates

We Found a Directory → /assets

Let’s Enumerate the Sub-Directory → /assets

PHP detected which may lead us to index.php
AARGH Sorry Sorry … wrong MEME ! yikes 🤣🤣
PHP > Command Injection ? Now the Right one -

We found a Base64 on the main index php page using ls command

From the Base64 We found → images , index.php and styles.css
wow now it’s confirmed that we have a index.php while using index.php , Great ! DeJaVu activated !!
Command Injection Check ✅
Let’s Try with the cat passwd .. yeah cat !


Found Base64 again .. Let’s repeat the same
Base64 found →
cm9vdDp4OjA6MDpyb290Oi9yb290Oi9iaW4vYmFzaApkYWVtb246eDoxOjE6ZGFlbW9uOi91c3Ivc2JpbjovdXNyL3NiaW4vbm9sb2dpbgpiaW46eDoyOjI6YmluOi9iaW46L3Vzci9zYmluL25vbG9naW4Kc3lzOng6MzozOnN5czovZGV2Oi91c3Ivc2Jpbi9ub2xvZ2luCnN5bmM6eDo0OjY1NTM0OnN5bmM6L2JpbjovYmluL3N5bmMKZ2FtZXM6eDo1OjYwOmdhbWVzOi91c3IvZ2FtZXM6L3Vzci9zYmluL25vbG9naW4KbWFuOng6NjoxMjptYW46L3Zhci9jYWNoZS9tYW46L3Vzci9zYmluL25vbG9naW4KbHA6eDo3Ojc6bHA6L3Zhci9zcG9vbC9scGQ6L3Vzci9zYmluL25vbG9naW4KbWFpbDp4Ojg6ODptYWlsOi92YXIvbWFpbDovdXNyL3NiaW4vbm9sb2dpbgpuZXdzOng6OTo5Om5ld3M6L3Zhci9zcG9vbC9uZXdzOi91c3Ivc2Jpbi9ub2xvZ2luCnV1Y3A6eDoxMDoxMDp1dWNwOi92YXIvc3Bvb2wvdXVjcDovdXNyL3NiaW4vbm9sb2dpbgpwcm94eTp4OjEzOjEzOnByb3h5Oi9iaW46L3Vzci9zYmluL25vbG9naW4Kd3d3LWRhdGE6eDozMzozMzp3d3ctZGF0YTovdmFyL3d3dzovdXNyL3NiaW4vbm9sb2dpbgpiYWNrdXA6eDozNDozNDpiYWNrdXA6L3Zhci9iYWNrdXBzOi91c3Ivc2Jpbi9ub2xvZ2luCmxpc3Q6eDozODozODpNYWlsaW5nIExpc3QgTWFuYWdlcjovdmFyL2xpc3Q6L3Vzci9zYmluL25vbG9naW4KaXJjOng6Mzk6Mzk6aXJjZDovdmFyL3J1bi9pcmNkOi91c3Ivc2Jpbi9ub2xvZ2luCmduYXRzOng6NDE6NDE6R25hdHMgQnVnLVJlcG9ydGluZyBTeXN0ZW0gKGFkbWluKTovdmFyL2xpYi9nbmF0czovdXNyL3NiaW4vbm9sb2dpbgpub2JvZHk6eDo2NTUzNDo2NTUzNDpub2JvZHk6L25vbmV4aXN0ZW50Oi91c3Ivc2Jpbi9ub2xvZ2luCnN5c3RlbWQtbmV0d29yazp4OjEwMDoxMDI6c3lzdGVtZCBOZXR3b3JrIE1hbmFnZW1lbnQsLCw6L3J1bi9zeXN0ZW1kOi91c3Ivc2Jpbi9ub2xvZ2luCnN5c3RlbWQtcmVzb2x2ZTp4OjEwMToxMDM6c3lzdGVtZCBSZXNvbHZlciwsLDovcnVuL3N5c3RlbWQ6L3Vzci9zYmluL25vbG9naW4Kc3lzdGVtZC10aW1lc3luYzp4OjEwMjoxMDQ6c3lzdGVtZCBUaW1lIFN5bmNocm9uaXphdGlvbiwsLDovcnVuL3N5c3RlbWQ6L3Vzci9zYmluL25vbG9naW4KbWVzc2FnZWJ1czp4OjEwMzoxMDY6Oi9ub25leGlzdGVudDovdXNyL3NiaW4vbm9sb2dpbgpzeXNsb2c6eDoxMDQ6MTEwOjovaG9tZS9zeXNsb2c6L3Vzci9zYmluL25vbG9naW4KX2FwdDp4OjEwNTo2NTUzNDo6L25vbmV4aXN0ZW50Oi91c3Ivc2Jpbi9ub2xvZ2luCnRzczp4OjEwNjoxMTE6VFBNIHNvZnR3YXJlIHN0YWNrLCwsOi92YXIvbGliL3RwbTovYmluL2ZhbHNlCnV1aWRkOng6MTA3OjExMjo6L3J1bi91dWlkZDovdXNyL3NiaW4vbm9sb2dpbgp0Y3BkdW1wOng6MTA4OjExMzo6L25vbmV4aXN0ZW50Oi91c3Ivc2Jpbi9ub2xvZ2luCmxhbmRzY2FwZTp4OjEwOToxMTU6Oi92YXIvbGliL2xhbmRzY2FwZTovdXNyL3NiaW4vbm9sb2dpbgpwb2xsaW5hdGU6eDoxMTA6MTo6L3Zhci9jYWNoZS9wb2xsaW5hdGU6L2Jpbi9mYWxzZQpmd3VwZC1yZWZyZXNoOng6MTExOjExNjpmd3VwZC1yZWZyZXNoIHVzZXIsLCw6L3J1bi9zeXN0ZW1kOi91c3Ivc2Jpbi9ub2xvZ2luCnVzYm11eDp4OjExMjo0Njp1c2JtdXggZGFlbW9uLCwsOi92YXIvbGliL3VzYm11eDovdXNyL3NiaW4vbm9sb2dpbgpzc2hkOng6MTEzOjY1NTM0OjovcnVuL3NzaGQ6L3Vzci9zYmluL25vbG9naW4Kc3lzdGVtZC1jb3JlZHVtcDp4Ojk5OTo5OTk6c3lzdGVtZCBDb3JlIER1bXBlcjovOi91c3Ivc2Jpbi9ub2xvZ2luCmRla3U6eDoxMDAwOjEwMDA6ZGVrdTovaG9tZS9kZWt1Oi9iaW4vYmFzaAoKbHhkOng6OTk4OjEwMDo6L3Zhci9zbmFwL2x4ZC9jb21tb24vbHhkOi9iaW4vZmFsc2UK
echo "base64-above" | base64 -d
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
irc:x:39:39:ircd:/var/run/ircd:/usr/sbin/nologin
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
systemd-network:x:100:102:systemd Network Management,,,:/run/systemd:/usr/sbin/nologin
systemd-resolve:x:101:103:systemd Resolver,,,:/run/systemd:/usr/sbin/nologin
systemd-timesync:x:102:104:systemd Time Synchronization,,,:/run/systemd:/usr/sbin/nologin
messagebus:x:103:106::/nonexistent:/usr/sbin/nologin
syslog:x:104:110::/home/syslog:/usr/sbin/nologin
_apt:x:105:65534::/nonexistent:/usr/sbin/nologin
tss:x:106:111:TPM software stack,,,:/var/lib/tpm:/bin/false
uuidd:x:107:112::/run/uuidd:/usr/sbin/nologin
tcpdump:x:108:113::/nonexistent:/usr/sbin/nologin
landscape:x:109:115::/var/lib/landscape:/usr/sbin/nologin
pollinate:x:110:1::/var/cache/pollinate:/bin/false
fwupd-refresh:x:111:116:fwupd-refresh user,,,:/run/systemd:/usr/sbin/nologin
usbmux:x:112:46:usbmux daemon,,,:/var/lib/usbmux:/usr/sbin/nologin
sshd:x:113:65534::/run/sshd:/usr/sbin/nologin
systemd-coredump:x:999:999:systemd Core Dumper:/:/usr/sbin/nologin
deku:x:1000:1000:deku:/home/deku:/bin/bash <<------
Deku 1000:1000 → Well Hello There ! We know our user now
Now Let’s get to the User
Using Command injection Lets get a reverse connection using Netcat
Let’s Setup our Netcat first @ 1337 port

Getting a Reverse Shell using PHP exec

Got the Reverse Shell !!

Voila ! We Got the www-data connection via the PHP exec code
We Found 2 Files , Let’s Transfer these files from the Victim’s machine to the attacker’s system using Netcat .


Got the File oneforall.jpg to the attacker Machine and upon further inspection found that the file uses the extension .jpg but is in data format
Which means the data is corrupted or the jpg file format is set incorrectly
This has to be the latter , so lets first try to check the format of this file and compare the same with the jpg file format and fix the discrepancy
Part Where we are going to Change the incorrect jpg file headers
Opening the file using Hexedit
If Hexedit is not installed on your Linux (Kali/Parrot) -
apt install hexedit -y
hexedit oneforall.jpg
We need to change intial headers of the file



After changing the header of the file we get this →

The format for the correct Raw JPG can be found easily
Now using this file we can use stegnography to check file contents
Using steghide to extract the files inside the file

After doing a lot of exploring , a HIDDEN_CONTENT was discovered using command → ls -la
pwd = /var/www/Hidden_Content
We find the passphrase for the jpg file →

Another Base64 , now you know what to do

Let’s try using this passphrase with the jpg file we just fixed

We have now got the creds for Deku , our user !!
Let’s try to login using the creds we extracted from a jpg file →
ssh deku@school.thm
Enter the password :

We found our User Flag
Privilege Escalation
First things first
sudo -l

Let’s try to check the contents of feedback.sh

By changing the pwd and launching the feedback.sh with sudo

We have added user deku to sudoers files
Let’s check again by using sudo -l

Voila ! we have set NOPASSWD to ALL
lets grant sudo access to our /bin/bash to escalate privileges

We have pwned U.A. High School room

Hope you liked this TryHackMe Walkthrough ,
Let’s Connect on Linkedin → https://linkedin.com/in/sunnysinghverma
if you did you can add a clap to this article to let me know .
You can also follow me on medium to get more articles about CTFs and Cybersecurity in the near Future
Thank you !
SuNnY