Introduction

As part of my hands-on penetration testing practice, I performed an external security assessment against the JUMP machine in the TryHackMe laboratory environment.

The objective was to approach the target from the perspective of an unauthenticated external attacker, identify exposed services and security weaknesses, validate exploitable vulnerabilities, and determine whether those weaknesses could ultimately lead to administrative compromise.

The assessment resulted in complete compromise of the Linux target, achieved by chaining multiple security misconfigurations across different privilege levels.

Environment: TryHackMe — JUMP Assessment Type: External Penetration Test Target: Linux Host Testing Period: August 5–7, 2026 Assessment Status: Full system compromise achieved

Assessment Approach

The assessment followed a structured penetration-testing methodology consisting of:

1. Reconnaissance

2. Service discovery

3. Enumeration

4. Vulnerability identification

5. Controlled exploitation

6. Privilege escalation

7. Validation of root-level access

8. Risk assessment and remediation

The assessment was performed against the authorized TryHackMe laboratory environment.

Initial Reconnaissance

The first stage focused on identifying externally accessible services and understanding the target's attack surface.

The assessment identified FTP and SSH as externally accessible services. While the exposed attack surface was relatively small, the FTP service presented a significant security weakness because it allowed anonymous authentication.

Anonymous FTP access provided an opportunity to enumerate accessible directories and retrieve information about the target's internal workflow.

Further investigation revealed an automated file-processing mechanism associated with an FTP-accessible directory.

This became the initial attack vector.

Initial Access Through Insecure File Processing

The FTP service allowed anonymous users to interact with a directory that was monitored by an automated processing mechanism.

The critical issue was that user-controlled files were processed without sufficient validation or security controls.

This allowed a malicious payload to be introduced into the processing workflow and ultimately resulted in arbitrary command execution on the target.

The initial shell was obtained as:

recon_user

This finding was classified as Critical because an unauthenticated external attacker could obtain an initial foothold and continue toward full system compromise.

Finding

EPT-001 — Anonymous FTP Authentication with Insecure Automated File Processing

Severity: Critical

Impact: Successful exploitation allowed arbitrary command execution and provided the initial foothold required for subsequent privilege escalation.

Recommended Remediation

• Disable anonymous FTP authentication.

• Restrict write access to upload directories.

• Validate uploaded files before processing.

• Execute automated processing using dedicated least-privileged accounts.

Local Enumeration & Privilege Escalation

After obtaining the initial shell, the assessment moved into local enumeration.

The objective was to identify:

• Running processes

• Scheduled tasks

• File permissions

• Service configurations

• Writable scripts

• Privileged execution paths

• Sudo permissions

This revealed several weaknesses that could be chained to progressively increase privileges.

Privilege Escalation Path 1 — Scheduled Backup Process

A scheduled backup process was identified running under the dev_user account.

The backup mechanism interacted with files controlled by a lower-privileged user without sufficient permission restrictions.

This allowed the lower-privileged account to influence a privileged process and resulted in escalation from:

recon_user
      ↓
dev_user

The finding was rated High due to the ability to elevate privileges and continue progressing toward full system compromise.

Finding: EPT-002 Severity: High

The recommended remediation includes reviewing scheduled tasks, enforcing proper ownership and permissions, and ensuring privileged automation cannot be influenced by lower-privileged accounts.

Privilege Escalation Path 2 — Systemd Execution Path Hijacking

Further enumeration identified a systemd health-check service executing a binary through a writable execution path.

Because a lower-privileged user could influence the execution environment, the service could be manipulated to execute attacker-controlled code.

This resulted in:

dev_user
    ↓
monitor_user

The vulnerability was classified as High.

Finding: EPT-003 — Insecure System Service Leading to Privilege Escalation

The report maps this weakness to CWE-427: Uncontrolled Search Path Element and MITRE ATT&CK T1574: Hijack Execution Flow.

Recommended Remediation

• Use absolute paths for trusted executables.

• Ensure service-related directories are not writable by unprivileged users.

• Apply least privilege to service accounts.

• Monitor the integrity of service binaries.

• Regularly review systemd services and timers.

Privilege Escalation Path 3 — Writable Deployment Script

The next stage involved a deployment helper script that was writable by a lower-privileged account but executed within a higher-privileged context.

This created another opportunity for arbitrary command execution.

The resulting privilege transition was:

monitor_user
      ↓
ops_user

Finding: EPT-004 Severity: High

The core issue was improper file permissions on a script trusted by a privileged deployment process.

This demonstrates an important security principle:

A privileged process must never trust files that can be modified by a lower-privileged user.

Final Privilege Escalation — Sudo Misconfiguration

The final stage of the attack involved examining the sudo permissions assigned to ops_user.

The account was permitted to execute the less binary as root without authentication through a NOPASSWD sudo rule.

Because less can provide an interactive shell, this configuration could be abused to obtain unrestricted root-level access.

The final privilege transition was:

ops_user
    ↓
root

Finding: EPT-005 Severity: Critical

The report identifies the issue as an abuse of elevated privileges and maps it to MITRE ATT&CK T1548 — Abuse Elevation Control Mechanism.

At this point, complete administrative control of the target was achieved.

Complete Attack Chain

The entire compromise can be summarized as:

Unauthenticated External Attacker
            │
            ▼
     Anonymous FTP Access
            │
            ▼
 Insecure Automated File Processing
            │
            ▼
    Arbitrary Command Execution
            │
            ▼
        recon_user
            │
            ▼
  Insecure Scheduled Backup
            │
            ▼
         dev_user
            │
            ▼
 Systemd Execution Path Hijacking
            │
            ▼
       monitor_user
            │
            ▼
 Writable Deployment Script
            │
            ▼
         ops_user
            │
            ▼
 Misconfigured sudo (less)
            │
            ▼
           ROOT

This attack path required chaining several weaknesses rather than relying on a single vulnerability. The assessment therefore demonstrated the importance of defense in depth and least-privilege controls.

Findings Summary

The assessment identified five confirmed vulnerabilities:

Overall, the report classified the findings as 2 Critical, 3 High, 0 Moderate, 0 Low, and 1 Informational.

Key Security Lessons

This assessment reinforced several important penetration-testing and defensive-security concepts:

1. Small attack surfaces can still be dangerous

Only a limited number of services were externally accessible, but one misconfigured service was sufficient to establish the initial foothold.

2. Privilege escalation is often about chaining weaknesses

The target did not expose root access immediately. Instead, multiple configuration weaknesses had to be identified and chained together.

3. File permissions matter

Several escalation paths depended on lower-privileged users being able to modify files or directories trusted by privileged processes.

4. Automation requires security controls

Scheduled tasks, deployment systems, and service processes can become privilege-escalation mechanisms when they execute attacker-influenced content.

5. Least privilege is critical

The final compromise demonstrated how excessive sudo permissions can turn a limited account compromise into complete operating-system compromise.

Remediation Priorities

Based on the assessment, the highest-priority remediation actions are:

1. Disable anonymous FTP access.

2. Secure automated file-processing workflows.

3. Review scheduled tasks and backup processes.

4. Remove writable paths from privileged execution contexts.

5. Restrict permissions on deployment scripts and helper files.

6. Review and minimize sudo privileges.

7. Remove unnecessary NOPASSWD configurations.

8. Regularly audit privileged services, scripts, and scheduled tasks.

These recommendations are consistent with the remediation guidance documented for the individual findings in the assessment report.

Conclusion

The JUMP assessment demonstrated how multiple seemingly isolated security weaknesses can be chained into a complete system compromise.

The attack progressed from unauthenticated external access → initial command execution → multiple privilege-escalation stages → root-level access.

The most important takeaway from this assessment is that security should not be evaluated only by looking at individual vulnerabilities in isolation. Attackers can combine weaknesses across authentication, file permissions, automation, services, and privilege management to create a significantly more serious attack path.

The assessment ultimately achieved full administrative control of the target Linux system, demonstrating the importance of secure automation, strict permission management, least privilege, and continuous security assessment.

📄 Professional Assessment Report

I documented the assessment separately as a professional penetration testing report, including the assessment overview, scope, executive summary, vulnerability report card, technical findings, evidence, risk ratings, remediation recommendations, and overall risk assessment.

Full PDF Report: 👉 View the JUMP Professional Penetration Test Report

GitHub Repository: 👉 ShadowSensei — Professional Penetration Testing Reports

Disclaimer

This assessment was performed against the TryHackMe JUMP laboratory environment as an authorized cybersecurity training exercise.

The report and this article represent my independent work, analysis, testing methodology, and documentation. They are not official security assessments, confidential reports, or security findings belonging to any external company or organization.

All testing described here was performed within an authorized training environment.

🥷 ShadowSensei

PJPT Certified Penetration Tester | Offensive Security | VAPT | Red Teaming

Learn by testing. Understand by breaking. Improve by securing.