# JUMP — TryHackMe External Penetration Testing Assessment

* * *

## Introduction

As part of my hands-on penetration testing practice, I performed an external security assessment against the **JUMP** machine in the TryHackMe laboratory environment.

The objective was to approach the target from the perspective of an **unauthenticated external attacker**, identify exposed services and security weaknesses, validate exploitable vulnerabilities, and determine whether those weaknesses could ultimately lead to administrative compromise.

The assessment resulted in **complete compromise of the Linux target**, achieved by chaining multiple security misconfigurations across different privilege levels.

> **Environment:** TryHackMe — JUMP **Assessment Type:** External Penetration Test **Target:** Linux Host **Testing Period:** August 5–7, 2026 **Assessment Status:** Full system compromise achieved

* * *

## Assessment Approach

The assessment followed a structured penetration-testing methodology consisting of:

1.  Reconnaissance
    
2.  Service discovery
    
3.  Enumeration
    
4.  Vulnerability identification
    
5.  Controlled exploitation
    
6.  Privilege escalation
    
7.  Validation of root-level access
    
8.  Risk assessment and remediation
    

The assessment was performed against the authorized TryHackMe laboratory environment.

* * *

# Initial Reconnaissance

The first stage focused on identifying externally accessible services and understanding the target's attack surface.

The assessment identified **FTP and SSH** as externally accessible services. While the exposed attack surface was relatively small, the FTP service presented a significant security weakness because it allowed **anonymous authentication**.

Anonymous FTP access provided an opportunity to enumerate accessible directories and retrieve information about the target's internal workflow.

Further investigation revealed an automated file-processing mechanism associated with an FTP-accessible directory.

This became the initial attack vector.

* * *

# Initial Access Through Insecure File Processing

The FTP service allowed anonymous users to interact with a directory that was monitored by an automated processing mechanism.

The critical issue was that **user-controlled files were processed without sufficient validation or security controls**.

This allowed a malicious payload to be introduced into the processing workflow and ultimately resulted in **arbitrary command execution** on the target.

The initial shell was obtained as:

```text
recon_user
```

This finding was classified as **Critical** because an unauthenticated external attacker could obtain an initial foothold and continue toward full system compromise.

### Finding

**EPT-001 — Anonymous FTP Authentication with Insecure Automated File Processing**

**Severity:** Critical

**Impact:** Successful exploitation allowed arbitrary command execution and provided the initial foothold required for subsequent privilege escalation.

### Recommended Remediation

*   Disable anonymous FTP authentication.
    
*   Restrict write access to upload directories.
    
*   Validate uploaded files before processing.
    
*   Execute automated processing using dedicated least-privileged accounts.
    

* * *

# Local Enumeration & Privilege Escalation

After obtaining the initial shell, the assessment moved into local enumeration.

The objective was to identify:

*   Running processes
    
*   Scheduled tasks
    
*   File permissions
    
*   Service configurations
    
*   Writable scripts
    
*   Privileged execution paths
    
*   Sudo permissions
    

This revealed several weaknesses that could be chained to progressively increase privileges.

* * *

# Privilege Escalation Path 1 — Scheduled Backup Process

A scheduled backup process was identified running under the `dev_user` account.

The backup mechanism interacted with files controlled by a lower-privileged user without sufficient permission restrictions.

This allowed the lower-privileged account to influence a privileged process and resulted in escalation from:

```text
recon_user
      ↓
dev_user
```

The finding was rated **High** due to the ability to elevate privileges and continue progressing toward full system compromise.

**Finding:** EPT-002 **Severity:** High

The recommended remediation includes reviewing scheduled tasks, enforcing proper ownership and permissions, and ensuring privileged automation cannot be influenced by lower-privileged accounts.

* * *

# Privilege Escalation Path 2 — Systemd Execution Path Hijacking

Further enumeration identified a systemd health-check service executing a binary through a writable execution path.

Because a lower-privileged user could influence the execution environment, the service could be manipulated to execute attacker-controlled code.

This resulted in:

```text
dev_user
    ↓
monitor_user
```

The vulnerability was classified as **High**.

**Finding:** EPT-003 — Insecure System Service Leading to Privilege Escalation

The report maps this weakness to **CWE-427: Uncontrolled Search Path Element** and **MITRE ATT&CK T1574: Hijack Execution Flow**.

### Recommended Remediation

*   Use absolute paths for trusted executables.
    
*   Ensure service-related directories are not writable by unprivileged users.
    
*   Apply least privilege to service accounts.
    
*   Monitor the integrity of service binaries.
    
*   Regularly review systemd services and timers.
    

* * *

# Privilege Escalation Path 3 — Writable Deployment Script

The next stage involved a deployment helper script that was writable by a lower-privileged account but executed within a higher-privileged context.

This created another opportunity for arbitrary command execution.

The resulting privilege transition was:

```text
monitor_user
      ↓
ops_user
```

**Finding:** EPT-004 **Severity:** High

The core issue was improper file permissions on a script trusted by a privileged deployment process.

This demonstrates an important security principle:

> **A privileged process must never trust files that can be modified by a lower-privileged user.**

* * *

# Final Privilege Escalation — Sudo Misconfiguration

The final stage of the attack involved examining the sudo permissions assigned to `ops_user`.

The account was permitted to execute the `less` binary as root without authentication through a `NOPASSWD` sudo rule.

Because `less` can provide an interactive shell, this configuration could be abused to obtain unrestricted root-level access.

The final privilege transition was:

```text
ops_user
    ↓
root
```

**Finding:** EPT-005 **Severity:** Critical

The report identifies the issue as an abuse of elevated privileges and maps it to **MITRE ATT&CK T1548 — Abuse Elevation Control Mechanism**.

At this point, complete administrative control of the target was achieved.

* * *

# Complete Attack Chain

The entire compromise can be summarized as:

```text
Unauthenticated External Attacker
            │
            ▼
     Anonymous FTP Access
            │
            ▼
 Insecure Automated File Processing
            │
            ▼
    Arbitrary Command Execution
            │
            ▼
        recon_user
            │
            ▼
  Insecure Scheduled Backup
            │
            ▼
         dev_user
            │
            ▼
 Systemd Execution Path Hijacking
            │
            ▼
       monitor_user
            │
            ▼
 Writable Deployment Script
            │
            ▼
         ops_user
            │
            ▼
 Misconfigured sudo (less)
            │
            ▼
           ROOT
```

This attack path required chaining several weaknesses rather than relying on a single vulnerability. The assessment therefore demonstrated the importance of **defense in depth and least-privilege controls**.

* * *

# Findings Summary

The assessment identified **five confirmed vulnerabilities**:

| ID | Finding | Severity |
| --- | --- | --- |
| EPT-001 | Anonymous FTP & Insecure Automated File Processing | 🔴 Critical |
| EPT-002 | Insecure Scheduled Backup Process | 🟠 High |
| EPT-003 | Insecure System Service / Execution Path | 🟠 High |
| EPT-004 | Writable Deployment Helper Script | 🟠 High |
| EPT-005 | Misconfigured sudo Permissions (`less NOPASSWD`) | 🔴 Critical |

Overall, the report classified the findings as **2 Critical, 3 High, 0 Moderate, 0 Low, and 1 Informational**.

* * *

# Key Security Lessons

This assessment reinforced several important penetration-testing and defensive-security concepts:

### 1\. Small attack surfaces can still be dangerous

Only a limited number of services were externally accessible, but one misconfigured service was sufficient to establish the initial foothold.

### 2\. Privilege escalation is often about chaining weaknesses

The target did not expose root access immediately. Instead, multiple configuration weaknesses had to be identified and chained together.

### 3\. File permissions matter

Several escalation paths depended on lower-privileged users being able to modify files or directories trusted by privileged processes.

### 4\. Automation requires security controls

Scheduled tasks, deployment systems, and service processes can become privilege-escalation mechanisms when they execute attacker-influenced content.

### 5\. Least privilege is critical

The final compromise demonstrated how excessive sudo permissions can turn a limited account compromise into complete operating-system compromise.

* * *

# Remediation Priorities

Based on the assessment, the highest-priority remediation actions are:

1.  **Disable anonymous FTP access.**
    
2.  **Secure automated file-processing workflows.**
    
3.  **Review scheduled tasks and backup processes.**
    
4.  **Remove writable paths from privileged execution contexts.**
    
5.  **Restrict permissions on deployment scripts and helper files.**
    
6.  **Review and minimize sudo privileges.**
    
7.  **Remove unnecessary** `NOPASSWD` **configurations.**
    
8.  **Regularly audit privileged services, scripts, and scheduled tasks.**
    

These recommendations are consistent with the remediation guidance documented for the individual findings in the assessment report.

* * *

# Conclusion

The JUMP assessment demonstrated how multiple seemingly isolated security weaknesses can be chained into a complete system compromise.

The attack progressed from **unauthenticated external access → initial command execution → multiple privilege-escalation stages → root-level access**.

The most important takeaway from this assessment is that security should not be evaluated only by looking at individual vulnerabilities in isolation. Attackers can combine weaknesses across authentication, file permissions, automation, services, and privilege management to create a significantly more serious attack path.

The assessment ultimately achieved **full administrative control of the target Linux system**, demonstrating the importance of secure automation, strict permission management, least privilege, and continuous security assessment.

* * *

## 📄 Professional Assessment Report

I documented the assessment separately as a **professional penetration testing report**, including the assessment overview, scope, executive summary, vulnerability report card, technical findings, evidence, risk ratings, remediation recommendations, and overall risk assessment.

**Full PDF Report:** 👉 [**View the JUMP Professional Penetration Test Report**](https://github.com/ShadowSensei-Sec/pentest-engagement-reports/blob/main/THM/JUMP-Pentest-Report.pdf)

**GitHub Repository:** 👉 [**ShadowSensei — Professional Penetration Testing Reports**](https://github.com/ShadowSensei-Sec/pentest-engagement-reports)

* * *

## Disclaimer

This assessment was performed against the **TryHackMe JUMP laboratory environment** as an authorized cybersecurity training exercise.

The report and this article represent my **independent work, analysis, testing methodology, and documentation**. They are not official security assessments, confidential reports, or security findings belonging to any external company or organization.

All testing described here was performed within an authorized training environment.

* * *

### 🥷 ShadowSensei

**PJPT Certified Penetration Tester | Offensive Security | VAPT | Red Teaming**

**Learn by testing. Understand by breaking. Improve by securing.**

* * *