--- title: SPIP RCE + Docker SUID Escape | THM Publisher | daily.dev description: A walkthrough of the TryHackMe 'Publisher' CTF challenge covering full exploitation from reconnaissance to root. The attack chain includes Nmap scanning, FFUF... canonical: https://daily.dev/posts/spip-rce-docker-suid-escape-thm-publisher-vua1c6m1l twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: SPIP RCE + Docker SUID Escape | THM Publisher | daily.dev og:description: A walkthrough of the TryHackMe 'Publisher' CTF challenge covering full exploitation from reconnaissance to root. The attack chain includes Nmap scanning, FFUF... og:url: https://daily.dev/posts/spip-rce-docker-suid-escape-thm-publisher-vua1c6m1l og:image: https://api.daily.dev/og/posts/vuA1c6m1L.png og:image:alt: SPIP RCE + Docker SUID Escape | THM Publisher og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # SPIP RCE + Docker SUID Escape | THM Publisher **[InfoSec Write-ups](https://daily.dev/sources/infosecwriteups)** · 3 min read · 0 upvotes · 0 comments ## Summary A walkthrough of the TryHackMe 'Publisher' CTF challenge covering full exploitation from reconnaissance to root. The attack chain includes Nmap scanning, FFUF directory fuzzing, WhatWeb version fingerprinting to identify SPIP 4.2.0, exploitation of CVE-2023-27372 (unauthenticated RCE via the password reset form), SSH key extraction via LFI, and finally privilege escalation to root by abusing a custom SUID binary that calls a writable shell script, bypassing AppArmor using the dynamic linker. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Publisher: TryHackMe CTF Walkthrough](https://daily.dev/posts/publisher-tryhackme-ctf-walkthrough-ksu6i6grg) · InfoSec Write-ups · 0 upvotes · 0 comments - [TryHackMe — Blog CTF \| Full Write-Up](https://daily.dev/posts/tryhackme-blog-ctf-full-write-up-clubifl5s) · InfoSec Write-ups · 0 upvotes · 0 comments - [\[HS\] Dark Writeup](https://daily.dev/posts/hs-dark-writeup-roulrgb8j) · InfoSec Write-ups · 0 upvotes · 0 comments - [ContainMe — Command Injection, a SUID Binary, and Pivoting Through Two LXD Containers to Root \| TryHackMe](https://daily.dev/posts/containme-command-injection-a-suid-binary-and-pivoting-through-two-lxd-containers-to-root-tryh-8hescpwsj) · InfoSec Write-ups · 0 upvotes · 0 comments --- Tags: [#docker](https://daily.dev/tags/docker) [View this post on daily.dev](https://daily.dev/posts/spip-rce-docker-suid-escape-thm-publisher-vua1c6m1l) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"SPIP RCE + Docker SUID Escape | THM Publisher","url":"https://daily.dev/posts/spip-rce-docker-suid-escape-thm-publisher-vua1c6m1l","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/spip-rce-docker-suid-escape-thm-publisher-vua1c6m1l"},"datePublished":"2026-06-07T15:43:41.272Z","dateModified":"2026-06-07T15:44:08.671Z","description":"A walkthrough of the TryHackMe 'Publisher' CTF challenge covering full exploitation from reconnaissance to root. The attack chain includes Nmap scanning, FFUF...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/ddc60411cb1272c4433bd19ca715aaa9?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/ddc60411cb1272c4433bd19ca715aaa9?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"InfoSec Write-ups","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"InfoSec Write-ups","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/f0dc21b5bbfd46fda36f7b4b53dd1705","url":"https://daily.dev/sources/infosecwriteups"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/spip-rce-docker-suid-escape-thm-publisher-vua1c6m1l","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"docker","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"InfoSec Write-ups","item":"https://daily.dev/sources/infosecwriteups"},{"@type":"ListItem","position":3,"name":"SPIP RCE + Docker SUID Escape | THM Publisher"}]} ```