> For the complete documentation index, see [llms.txt](https://0xb0b.gitbook.io/writeups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://0xb0b.gitbook.io/writeups/hack-smarter-labs/2026/sysadmins.md). # SysAdmins {% embed url="" %} The following post by 0xb0b is licensed under [CC BY 4.0](http://creativecommons.org/licenses/by/4.0/?ref=chooser-v1) *** ## Scenario ### Objective You have been hired to perform a penetration test against a sensitive Linux server in the client's internal network. Your task is to thoroughly enumerate the machine, identify all vulnerabilities, and (if possible) elevate your privileges to root to demonstrate impact. #### Initial Access The client has provided you with VPN access but no other information. ## Summary
Summary In SysAdmins, we begin by scanning the target, discovering FTP (vsftpd 3.0.5) on port 21 with anonymous login enabled, SSH (OpenSSH 9.6p1) on port 22, and nginx 1.24.0 on port 80 serving a website titled "Sysadmins." A UDP scan additionally reveals SNMPv3, which requires valid credentials to query. Anonymous FTP access yields a `data_breach_notification.txt` file referencing a recent breach and linking to a Pastebin repository of exposed credentials, providing an ideal wordlist for credential spraying. Enumeration of the web application with Feroxbuster uncovers a `/team` page listing three employees: `waserby`, `helena`, and `peter.` Spraying these usernames against the leaked password list targeting SNMPv3 with Legba, yields valid credentials for `waserby`. Walking the SNMP tree with `snmpwalk` using these credentials reveals `helena`'s SSH password in the SNMP data, granting an initial foothold via SSH and the user flag from `/home/helena/user.txt`. Privilege escalation is achieved by identifying that the installed `sudo 1.9.16p2` falls within the vulnerable range for `CVE-2025-32463`, which affects all versions from `1.9.14` through `1.9.17` and was patched in `1.9.17p1`. This local privilege escalation vulnerability allows abusing sudo's `--chroot` option to load an attacker-controlled `/etc/nsswitch.conf` and malicious NSS libraries as root. Leveraging a public PoC grants a root shell and the root flag from `/root/root.txt`.
## Recon We use `rustscan -b 500 -a 10.1.71.170 --top -- -sC -sV -Pn` to enumerate all TCP ports on the target machine, piping the discovered results into Nmap, which runs default NSE scripts `-sC`, service and version detection `-sV`, and treats the host as online without ICMP echo `-Pn`. A batch size of `500` trades speed for stability, the default `1500` balances both, while much larger sizes increase throughput but risk missed responses and instability. {% code overflow="wrap" expandable="true" %} ``` rustscan -b 500 -a 10.1.71.170 --top -- -sC -sV -Pn ``` {% endcode %}
The target `10.1.71.170` is a Linux host running `nginx 1.24.0` on port `80` serving a website titled "Sysadmins - System Administration Services." FTP is exposed on port `21` via vsftpd 3.0.5 with anonymous login enabled, revealing a `data_breach_notification.txt` file in the `root` directory. SSH is available on port `22` running OpenSSH 9.6p1 (Ubuntu).
A udp scan reveals also `SNMPv3` to be available. Unlike `SNMPv1` and `SNMPv2c`, which rely on easily guessable community strings for access, `SNMPv3` introduces a user-based security model that requires valid credentials, including a username and authentication passphrase. So we hit a dead end here for now, but maybe we get the required credentials later on. {% code overflow="wrap" expandable="true" %} ``` udpz 10.1.71.170 ``` {% endcode %}
## FTP We check the FTP. we log in anonymously and retrieve the `data_breach_notification.txt` file. {% code overflow="wrap" expandable="true" %} ``` ftp 10.1.71.170 ``` {% endcode %}
It concerns a recent breach and urges employees to compare their credentials with those in the Pastebin repository. Here we have an ideal wordlist of credentials that we can use for credential spraying later. We'll save these. {% code overflow="wrap" expandable="true" %} ``` data_breach_notification.txt ``` {% endcode %}
{% code overflow="wrap" expandable="true" %} ``` curl https://pastebin.com/raw/mqPMU1cF -o passwords.txt ``` {% endcode %}
## WEB Next, we move on to the web page and visit the pages manually. It seems to be just a static page. {% code overflow="wrap" expandable="true" %} ``` http://10.1.71.170/ ``` {% endcode %}
We take note of the e-mail address.
Next, we scan for further directories using Feroxbuster and do find a `team` page. {% code overflow="wrap" expandable="true" %} ``` feroxbuster -w /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt -u 'http://sysadmins.hsm' ``` {% endcode %}
We take note of the team members for a later password spray. {% code overflow="wrap" expandable="true" %} ``` http://sysadmins.hsm/team ``` {% endcode %}
{% code title="users.txt" overflow="wrap" expandable="true" %} ``` waserby helena peter ``` {% endcode %} ## Access as waserby on SNMP We attempt to spray the discovered credentials against SNMPv3 using Legba, a multiprotocol credentials bruteforcer and password sprayer. By combining the usernames extracted from the team page with the passwords found in the data breach notification, we successfully identify valid SNMPv3 credentials. {% embed url="" %} {% code overflow="wrap" expandable="true" %} ``` ./legba snmp3 --target 10.1.71.170 --username ../users.txt --password ../passwords.txt ``` {% endcode %}
## Access as helena Using the discovered credentials, we enumerate the SNMP service with `snmpwalk`... {% code overflow="wrap" expandable="true" %} ``` snmpwalk -v3 -u waserby -A REDACTED 10.1.71.170 -l authNoPriv ``` {% endcode %}
... here we are able to identify the password used by helena to log in via SSH.
We try to authenticate as helena using the found credentials via SSH and are successful. We find the user flag at `/home/helena/user.txt`. {% code overflow="wrap" expandable="true" %} ``` ssh helena@sysadmins.hsm ``` {% endcode %}
## Shell as root Since the initial enumeration both manual and using linpeas did not yield any immediate results, we'll look for kernel exploits and possible vulnerabilities on installed software. The installed `sudo 1.9.16p2` is withing the vulnerable range for `CVE-2025-32463`, which affects all versions from `1.9.14` through `1.9.17` and was patched in `1.9.17p1`. `CVE-2025-32463` is a local privilege escalation vulnerability in sudo that allows a local user to escalate to `root` by abusing the `--chroot` / `-R` option. When sudo switches the root directory before completing policy evaluation, it ends up loading an attacker-controlled `/etc/nsswitch.conf` and malicious NSS libraries (e.g., `libnss_*.so`) as `root`. {% code overflow="wrap" expandable="true" %} ``` sudo --version ``` {% endcode %}
We make use of the following PoC of `CVE-2025-32463` and become `root`. We find the root flag at `/root/root.txt`. {% embed url="" %}