--- title: Publisher: TryHackMe CTF Walkthrough | daily.dev description: A step-by-step walkthrough of the TryHackMe 'Publisher' CTF room, covering the full attack chain from initial reconnaissance to root access. The process... canonical: https://daily.dev/posts/publisher-tryhackme-ctf-walkthrough-ksu6i6grg twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Publisher: TryHackMe CTF Walkthrough | daily.dev og:description: A step-by-step walkthrough of the TryHackMe 'Publisher' CTF room, covering the full attack chain from initial reconnaissance to root access. The process... og:url: https://daily.dev/posts/publisher-tryhackme-ctf-walkthrough-ksu6i6grg og:image: https://api.daily.dev/og/posts/KSu6I6Grg.png og:image:alt: Publisher: TryHackMe CTF Walkthrough og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Publisher: TryHackMe CTF Walkthrough **[InfoSec Write-ups](https://daily.dev/sources/infosecwriteups)** · 7 min read · 0 upvotes · 0 comments ## Summary A step-by-step walkthrough of the TryHackMe 'Publisher' CTF room, covering the full attack chain from initial reconnaissance to root access. The process involves nmap scanning, directory fuzzing with Gobuster, identifying a vulnerable SPIP CMS version, exploiting CVE-2023-27372 for unauthenticated RCE to upload a webshell, obtaining a reverse shell, pivoting to the 'think' user via an exposed SSH private key, and finally escalating to root by bypassing an AppArmor profile restriction. The AppArmor bypass involves copying bash to /var/tmp to escape the confined ash shell profile, then injecting commands into a world-writable SUID-called script. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [SPIP RCE \+ Docker SUID Escape \| THM Publisher](https://daily.dev/posts/spip-rce-docker-suid-escape-thm-publisher-vua1c6m1l) · InfoSec Write-ups · 0 upvotes · 0 comments - [TryHackMe — Blog CTF \| Full Write-Up](https://daily.dev/posts/tryhackme-blog-ctf-full-write-up-clubifl5s) · InfoSec Write-ups · 0 upvotes · 0 comments - [TryHackMe — Simple CTF: The Note That Gave Everything Away](https://daily.dev/posts/tryhackme-simple-ctf-the-note-that-gave-everything-away-8aiksehw2) · InfoSec Write-ups · 0 upvotes · 0 comments - [HTB: Store](https://daily.dev/posts/htb-store-nivt8i99r) · 0xdf hacks stuff · 2 upvotes · 0 comments - [Mr Robot CTF Walkthrough -TryHackMe Detailed](https://daily.dev/posts/mr-robot-ctf-walkthrough--tryhackme-detailed-oli3c98dz) · InfoSec Write-ups · 0 upvotes · 0 comments --- [View this post on daily.dev](https://daily.dev/posts/publisher-tryhackme-ctf-walkthrough-ksu6i6grg) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Publisher: TryHackMe CTF Walkthrough","url":"https://daily.dev/posts/publisher-tryhackme-ctf-walkthrough-ksu6i6grg","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/publisher-tryhackme-ctf-walkthrough-ksu6i6grg"},"datePublished":"2026-08-05T07:18:39.718Z","dateModified":"2026-08-05T07:19:04.934Z","description":"A step-by-step walkthrough of the TryHackMe 'Publisher' CTF room, covering the full attack chain from initial reconnaissance to root access. The process...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/0bf6f91a4a633f34dfad39771adf56fd?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/0bf6f91a4a633f34dfad39771adf56fd?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"InfoSec Write-ups","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"InfoSec Write-ups","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/f0dc21b5bbfd46fda36f7b4b53dd1705","url":"https://daily.dev/sources/infosecwriteups"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/publisher-tryhackme-ctf-walkthrough-ksu6i6grg","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"","timeRequired":"PT7M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"InfoSec Write-ups","item":"https://daily.dev/sources/infosecwriteups"},{"@type":"ListItem","position":3,"name":"Publisher: TryHackMe CTF Walkthrough"}]} ```