SysAdmins
Challenge Lab (Medium) - by 0liverFlow
The following post by 0xb0b is licensed under CC BY 4.0
Scenario
Objective
You have been hired to perform a penetration test against a sensitive Linux server in the client's internal network. Your task is to thoroughly enumerate the machine, identify all vulnerabilities, and (if possible) elevate your privileges to root to demonstrate impact.
Initial Access
The client has provided you with VPN access but no other information.
Summary
Summary
In SysAdmins, we begin by scanning the target, discovering FTP (vsftpd 3.0.5) on port 21 with anonymous login enabled, SSH (OpenSSH 9.6p1) on port 22, and nginx 1.24.0 on port 80 serving a website titled "Sysadmins." A UDP scan additionally reveals SNMPv3, which requires valid credentials to query. Anonymous FTP access yields a data_breach_notification.txt file referencing a recent breach and linking to a Pastebin repository of exposed credentials, providing an ideal wordlist for credential spraying.
Enumeration of the web application with Feroxbuster uncovers a /team page listing three employees: waserby, helena, and peter. Spraying these usernames against the leaked password list targeting SNMPv3 with Legba, yields valid credentials for waserby. Walking the SNMP tree with snmpwalk using these credentials reveals helena's SSH password in the SNMP data, granting an initial foothold via SSH and the user flag from /home/helena/user.txt.
Privilege escalation is achieved by identifying that the installed sudo 1.9.16p2 falls within the vulnerable range for CVE-2025-32463, which affects all versions from 1.9.14 through 1.9.17 and was patched in 1.9.17p1. This local privilege escalation vulnerability allows abusing sudo's --chroot option to load an attacker-controlled /etc/nsswitch.conf and malicious NSS libraries as root. Leveraging a public PoC grants a root shell and the root flag from /root/root.txt.
Recon
We use rustscan -b 500 -a 10.1.71.170 --top -- -sC -sV -Pn to enumerate all TCP ports on the target machine, piping the discovered results into Nmap, which runs default NSE scripts -sC, service and version detection -sV, and treats the host as online without ICMP echo -Pn.
A batch size of 500 trades speed for stability, the default 1500 balances both, while much larger sizes increase throughput but risk missed responses and instability.
The target 10.1.71.170 is a Linux host running nginx 1.24.0 on port 80 serving a website titled "Sysadmins - System Administration Services." FTP is exposed on port 21 via vsftpd 3.0.5 with anonymous login enabled, revealing a data_breach_notification.txt file in the root directory. SSH is available on port 22 running OpenSSH 9.6p1 (Ubuntu).
A udp scan reveals also SNMPv3 to be available. Unlike SNMPv1 and SNMPv2c, which rely on easily guessable community strings for access, SNMPv3 introduces a user-based security model that requires valid credentials, including a username and authentication passphrase. So we hit a dead end here for now, but maybe we get the required credentials later on.
FTP
We check the FTP. we log in anonymously and retrieve the data_breach_notification.txt file.
It concerns a recent breach and urges employees to compare their credentials with those in the Pastebin repository. Here we have an ideal wordlist of credentials that we can use for credential spraying later. We'll save these.
WEB
Next, we move on to the web page and visit the pages manually. It seems to be just a static page.
We take note of the e-mail address.
Next, we scan for further directories using Feroxbuster and do find a team page.
We take note of the team members for a later password spray.
Access as waserby on SNMP
We attempt to spray the discovered credentials against SNMPv3 using Legba, a multiprotocol credentials bruteforcer and password sprayer. By combining the usernames extracted from the team page with the passwords found in the data breach notification, we successfully identify valid SNMPv3 credentials.
Access as helena
Using the discovered credentials, we enumerate the SNMP service with snmpwalk...
... here we are able to identify the password used by helena to log in via SSH.
We try to authenticate as helena using the found credentials via SSH and are successful. We find the user flag at /home/helena/user.txt.
Shell as root
Since the initial enumeration both manual and using linpeas did not yield any immediate results, we'll look for kernel exploits and possible vulnerabilities on installed software.
The installed sudo 1.9.16p2 is withing the vulnerable range for CVE-2025-32463, which affects all versions from 1.9.14 through 1.9.17 and was patched in 1.9.17p1.
CVE-2025-32463 is a local privilege escalation vulnerability in sudo that allows a local user to escalate to root by abusing the --chroot / -R option. When sudo switches the root directory before completing policy evaluation, it ends up loading an attacker-controlled /etc/nsswitch.conf and malicious NSS libraries (e.g., libnss_*.so) as root.
We make use of the following PoC of CVE-2025-32463 and become root. We find the root flag at /root/root.txt.
Last updated